Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors See Also

CreateAutomationRule

Creates an automation rule based on input parameters.

Request Syntax


POST /automationrules/create HTTP/1.1
Content-type: application/json

{
   "Actions": [ 
      { 
         "FindingFieldsUpdate": { 
            "Confidence": number,
            "Criticality": number,
            "Note": { 
               "Text": "string",
               "UpdatedBy": "string"
            },
            "RelatedFindings": [ 
               { 
                  "Id": "string",
                  "ProductArn": "string"
               }
            ],
            "Severity": { 
               "Label": "string",
               "Normalized": number,
               "Product": number
            },
            "Types": [ "string" ],
            "UserDefinedFields": { 
               "string" : "string" 
            },
            "VerificationState": "string",
            "Workflow": { 
               "Status": "string"
            }
         },
         "Type": "string"
      }
   ],
   "Criteria": { 
      "AwsAccountId": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "AwsAccountName": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "CompanyName": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ComplianceAssociatedStandardsId": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ComplianceSecurityControlId": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ComplianceStatus": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "Confidence": [ 
         { 
            "Eq": number,
            "Gt": number,
            "Gte": number,
            "Lt": number,
            "Lte": number
         }
      ],
      "CreatedAt": [ 
         { 
            "DateRange": { 
               "Unit": "string",
               "Value": number
            },
            "End": "string",
            "Start": "string"
         }
      ],
      "Criticality": [ 
         { 
            "Eq": number,
            "Gt": number,
            "Gte": number,
            "Lt": number,
            "Lte": number
         }
      ],
      "Description": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "FirstObservedAt": [ 
         { 
            "DateRange": { 
               "Unit": "string",
               "Value": number
            },
            "End": "string",
            "Start": "string"
         }
      ],
      "GeneratorId": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "Id": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "LastObservedAt": [ 
         { 
            "DateRange": { 
               "Unit": "string",
               "Value": number
            },
            "End": "string",
            "Start": "string"
         }
      ],
      "NoteText": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "NoteUpdatedAt": [ 
         { 
            "DateRange": { 
               "Unit": "string",
               "Value": number
            },
            "End": "string",
            "Start": "string"
         }
      ],
      "NoteUpdatedBy": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ProductArn": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ProductName": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "RecordState": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "RelatedFindingsId": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "RelatedFindingsProductArn": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ResourceApplicationArn": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ResourceApplicationName": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ResourceDetailsOther": [ 
         { 
            "Comparison": "string",
            "Key": "string",
            "Value": "string"
         }
      ],
      "ResourceId": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ResourcePartition": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ResourceRegion": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "ResourceTags": [ 
         { 
            "Comparison": "string",
            "Key": "string",
            "Value": "string"
         }
      ],
      "ResourceType": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "SeverityLabel": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "SourceUrl": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "Title": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "Type": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "UpdatedAt": [ 
         { 
            "DateRange": { 
               "Unit": "string",
               "Value": number
            },
            "End": "string",
            "Start": "string"
         }
      ],
      "UserDefinedFields": [ 
         { 
            "Comparison": "string",
            "Key": "string",
            "Value": "string"
         }
      ],
      "VerificationState": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ],
      "WorkflowStatus": [ 
         { 
            "Comparison": "string",
            "Value": "string"
         }
      ]
   },
   "Description": "string",
   "IsTerminal": boolean,
   "RuleName": "string",
   "RuleOrder": number,
   "RuleStatus": "string",
   "Tags": { 
      "string" : "string" 
   }
}

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in JSON format.

Actions

One or more actions to update finding fields if a finding matches the conditions specified in Criteria.

Type: Array of AutomationRulesAction objects

Array Members: Fixed number of 1 item.

Required: Yes

Criteria

A set of ASFF finding field attributes and corresponding expected values that Security Hub uses to filter findings. If a rule is enabled and a finding matches the conditions specified in this parameter, Security Hub applies the rule action to the finding.

Type: AutomationRulesFindingFilters object

Required: Yes

Description

A description of the rule.

Type: String

Pattern: .*\S.*

Required: Yes

IsTerminal

Specifies whether a rule is the last to be applied with respect to a finding that matches the rule criteria. This is useful when a finding matches the criteria for multiple rules, and each rule has different actions. If a rule is terminal, Security Hub applies the rule action to a finding that matches the rule criteria and doesn't evaluate other rules for the finding. By default, a rule isn't terminal.

Type: Boolean

Required: No

RuleName

The name of the rule.

Type: String

Pattern: .*\S.*

Required: Yes

RuleOrder

An integer ranging from 1 to 1000 that represents the order in which the rule action is applied to findings. Security Hub applies rules with lower values for this parameter first.

Type: Integer

Valid Range: Minimum value of 1. Maximum value of 1000.

Required: Yes

RuleStatus

Whether the rule is active after it is created. If this parameter is equal to ENABLED, Security Hub starts applying the rule to findings and finding updates after the rule is created. To change the value of this parameter after creating a rule, use BatchUpdateAutomationRules.

Type: String

Valid Values: ENABLED | DISABLED

Required: No

Tags

User-defined tags associated with an automation rule.

Type: String to string map

Map Entries: Maximum number of 50 items.

Key Length Constraints: Minimum length of 1. Maximum length of 128.

Key Pattern: ^(?!aws:)[a-zA-Z+-=._:/]+$

Value Length Constraints: Maximum length of 256.

Required: No

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "RuleArn": "string"
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

RuleArn

The Amazon Resource Name (ARN) of the automation rule that you created.

Type: String

Pattern: .*\S.*

Errors

For information about the errors that are common to all actions, see Common Errors.

AccessDeniedException

You don't have permission to perform the action specified in the request.

HTTP Status Code: 403

InternalException

Internal server error.

HTTP Status Code: 500

InvalidAccessException

The account doesn't have permission to perform this action.

HTTP Status Code: 401

InvalidInputException

The request was rejected because you supplied an invalid or out-of-range value for an input parameter.

HTTP Status Code: 400

LimitExceededException

The request was rejected because it attempted to create resources beyond the current AWS account or throttling limits. The error code describes the limit exceeded.

HTTP Status Code: 429