AWS Security Hub Service Tables

The AWS Security Hub Service integration uses the following tables

Tables

AWSSecurityHubFindings

Name	Type	Description
ConfigID	integer	Internal configuration identifier for tracking the finding.
ProductARN	string	The Amazon Resource Name (ARN) of the product that generated the finding.
ProductName	string	The name of the product that generated the finding.
FirstObservedAt	datetime	The timestamp when the security findings provider first observed the potential security issue.
LastObservedAt	datetime	The timestamp when the security findings provider most recently observed the potential security issue.
CreatedAt	datetime	The timestamp when the security findings provider created the potential security issue that a finding captured.
UpdatedAt	datetime	The timestamp when the security findings provider last updated the finding record.
SeverityLabel	string	The severity value of the finding. Valid values include `INFORMATIONAL`, `LOW`, `MEDIUM`, `HIGH`, and `CRITICAL`.
Title	string	A short heading that describes the nature of the finding.
Description	string	A detailed description of the finding.
Remediation	string	Information about the recommended steps to remediate the issue identified in the finding.
SourceUrl	string	A URL that links to a page about the current finding in the security findings provider's solution.
ProductFieldsJson	string	A JSON object of additional information provided by the product that generated the finding.
ResourcesJson	string	A JSON array of resources that are associated with the finding.
ComplianceStatus	string	Indicates the result of a compliance check. Valid values include `PASSED`, `WARNING`, `FAILED`, and `NOT_AVAILABLE`.
WorkflowStatus	string	The workflow status of the finding. Valid values include `NEW`, `NOTIFIED`, `RESOLVED`, and `SUPPRESSED`.
RecordState	string	The record state of a finding. Valid values include `ACTIVE` and `ARCHIVED`.
BatchDate	datetime	The date when the data was batched or ingested.
AWSAccountID	string	The AWS account ID that a finding is generated in.
GeneratorID	string	The identifier for the solution-specific component that generated a finding.
ID	string	The security findings provider-specific identifier for a finding.

AWSSecurityHubInsights

Name	Type	Description
ARN	string	The Amazon Resource Name (ARN) of the insight.
ConfigID	integer	Internal configuration identifier used for tracking and organizing insights.
InsightArn	string	The ARN of the insight.
Name	string	The name of the insight.
CreatedAt	datetime	The date and time when the insight was created.
UpdatedAt	datetime	The date and time when the insight was last updated.
FiltersJson	string	A JSON object that contains the filters applied to the insight.
GroupByAttribute	string	The attribute used to group the findings in the insight.
BatchDate	datetime	The date when the insight data was ingested into the batch processing system.

AWSSecurityHubSecurityStandards

Name	Type	Description
ConfigId	integer	Internal configuration identifier used for tracking and organizing security standards.
Name	string	The name of the security standard.
Description	string	A detailed description of the security standard.
EnabledByDefault	bit	Indicates whether the security standard is enabled by default.
BatchDate	datetime	The date when the security standard data was ingested into the batch processing system.
StandardsArn	string	The Amazon Resource Name (ARN) of the security standard.
BatchId	integer	The identifier for the batch of findings or configurations in which the security standard was processed.
Id	integer	A unique identifier for the security standard.

Updated over 1 year ago

Learn more...

Did this page help you?