Class: Aws::SecurityHub::Types::MapFilter
- Inherits:
-
Struct
- Object
- Struct
- Aws::SecurityHub::Types::MapFilter
- Defined in:
- gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb
Overview
A map filter for filtering Security Hub findings. Each map filter provides the field to check for, the value to check for, and the comparison operator.
Constant Summary collapse
- SENSITIVE =
[]
Instance Attribute Summary collapse
-
#comparison ⇒ String
The condition to apply to the key value when filtering Security Hub findings with a map filter.
-
#key ⇒ String
The key of the map filter.
-
#value ⇒ String
The value for the key in the map filter.
Instance Attribute Details
#comparison ⇒ String
The condition to apply to the key value when filtering Security Hub findings with a map filter.
To search for values that have the filter value, use one of the following comparison operators:
To search for values that include the filter value, use
CONTAINS
. For example, for theResourceTags
field, the filterDepartment CONTAINS Security
matches findings that include the valueSecurity
for theDepartment
tag. In the same example, a finding with a value ofSecurity team
for theDepartment
tag is a match.To search for values that exactly match the filter value, use
EQUALS
. For example, for theResourceTags
field, the filterDepartment EQUALS Security
matches findings that have the valueSecurity
for theDepartment
tag.
CONTAINS
and EQUALS
filters on the same field are joined by
OR
. A finding matches if it matches any one of those filters. For
example, the filters Department CONTAINS Security OR Department
CONTAINS Finance
match a finding that includes either Security
,
Finance
, or both values.
To search for values that don't have the filter value, use one of the following comparison operators:
To search for values that exclude the filter value, use
NOT_CONTAINS
. For example, for theResourceTags
field, the filterDepartment NOT_CONTAINS Finance
matches findings that exclude the valueFinance
for theDepartment
tag.To search for values other than the filter value, use
NOT_EQUALS
. For example, for theResourceTags
field, the filterDepartment NOT_EQUALS Finance
matches findings that don’t have the valueFinance
for theDepartment
tag.
NOT_CONTAINS
and NOT_EQUALS
filters on the same field are joined
by AND
. A finding matches only if it matches all of those filters.
For example, the filters Department NOT_CONTAINS Security AND
Department NOT_CONTAINS Finance
match a finding that excludes both
the Security
and Finance
values.
CONTAINS
filters can only be used with other CONTAINS
filters.
NOT_CONTAINS
filters can only be used with other NOT_CONTAINS
filters.
You can’t have both a CONTAINS
filter and a NOT_CONTAINS
filter
on the same field. Similarly, you can’t have both an EQUALS
filter
and a NOT_EQUALS
filter on the same field. Combining filters in
this way returns an error.
CONTAINS
and NOT_CONTAINS
operators can be used only with
automation rules. For more information, see Automation rules in
the Security Hub User Guide.
26867 26868 26869 26870 26871 26872 26873 |
# File 'gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb', line 26867 class MapFilter < Struct.new( :key, :value, :comparison) SENSITIVE = [] include Aws::Structure end |
#key ⇒ String
The key of the map filter. For example, for ResourceTags
, Key
identifies the name of the tag. For UserDefinedFields
, Key
is
the name of the field.
26867 26868 26869 26870 26871 26872 26873 |
# File 'gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb', line 26867 class MapFilter < Struct.new( :key, :value, :comparison) SENSITIVE = [] include Aws::Structure end |
#value ⇒ String
The value for the key in the map filter. Filter values are case
sensitive. For example, one of the values for a tag called
Department
might be Security
. If you provide security
as the
filter value, then there's no match.
26867 26868 26869 26870 26871 26872 26873 |
# File 'gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb', line 26867 class MapFilter < Struct.new( :key, :value, :comparison) SENSITIVE = [] include Aws::Structure end |