Skip to content

/AWS1/IF_SHB=>CREATEAUTOMATIONRULE()

About CreateAutomationRule

Creates an automation rule based on input parameters.

Method Signature

METHODS /AWS1/IF_SHB~CREATEAUTOMATIONRULE
  IMPORTING
    !IT_TAGS TYPE /AWS1/CL_SHBTAGMAP_W=>TT_TAGMAP OPTIONAL
    !IV_RULESTATUS TYPE /AWS1/SHBRULESTATUS OPTIONAL
    !IV_RULEORDER TYPE /AWS1/SHBRULEORDERVALUE OPTIONAL
    !IV_RULENAME TYPE /AWS1/SHBNONEMPTYSTRING OPTIONAL
    !IV_DESCRIPTION TYPE /AWS1/SHBNONEMPTYSTRING OPTIONAL
    !IV_ISTERMINAL TYPE /AWS1/SHBBOOLEAN OPTIONAL
    !IO_CRITERIA TYPE REF TO /AWS1/CL_SHBAUTOMATIONRLSFND00 OPTIONAL
    !IT_ACTIONS TYPE /AWS1/CL_SHBAUTOMATIONRULESACT=>TT_ACTIONLIST OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_shbcreautomationrlrsp
  RAISING
    /AWS1/CX_SHBACCESSDENIEDEX
    /AWS1/CX_SHBINTERNALEXCEPTION
    /AWS1/CX_SHBINVALIDACCESSEX
    /AWS1/CX_SHBINVALIDINPUTEX
    /AWS1/CX_SHBLIMITEXCEEDEDEX
    /AWS1/CX_SHBCLIENTEXC
    /AWS1/CX_SHBSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING

Required arguments:

iv_ruleorder TYPE /AWS1/SHBRULEORDERVALUE /AWS1/SHBRULEORDERVALUE

An integer ranging from 1 to 1000 that represents the order in which the rule action is applied to findings. Security Hub applies rules with lower values for this parameter first.

iv_rulename TYPE /AWS1/SHBNONEMPTYSTRING /AWS1/SHBNONEMPTYSTRING

The name of the rule.

iv_description TYPE /AWS1/SHBNONEMPTYSTRING /AWS1/SHBNONEMPTYSTRING

A description of the rule.

io_criteria TYPE REF TO /AWS1/CL_SHBAUTOMATIONRLSFND00 /AWS1/CL_SHBAUTOMATIONRLSFND00

A set of ASFF finding field attributes and corresponding expected values that Security Hub uses to filter findings. If a rule is enabled and a finding matches the conditions specified in this parameter, Security Hub applies the rule action to the finding.

it_actions TYPE /AWS1/CL_SHBAUTOMATIONRULESACT=>TT_ACTIONLIST TT_ACTIONLIST

One or more actions to update finding fields if a finding matches the conditions specified in Criteria.

Optional arguments:

it_tags TYPE /AWS1/CL_SHBTAGMAP_W=>TT_TAGMAP TT_TAGMAP

User-defined tags associated with an automation rule.

iv_rulestatus TYPE /AWS1/SHBRULESTATUS /AWS1/SHBRULESTATUS

Whether the rule is active after it is created. If this parameter is equal to ENABLED, Security Hub starts applying the rule to findings and finding updates after the rule is created. To change the value of this parameter after creating a rule, use BatchUpdateAutomationRules .

iv_isterminal TYPE /AWS1/SHBBOOLEAN /AWS1/SHBBOOLEAN

Specifies whether a rule is the last to be applied with respect to a finding that matches the rule criteria. This is useful when a finding matches the criteria for multiple rules, and each rule has different actions. If a rule is terminal, Security Hub applies the rule action to a finding that matches the rule criteria and doesn't evaluate other rules for the finding. By default, a rule isn't terminal.

RETURNING

oo_output TYPE REF TO /aws1/cl_shbcreautomationrlrsp /AWS1/CL_SHBCREAUTOMATIONRLRSP

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->createautomationrule(
  io_criteria = new /aws1/cl_shbautomationrlsfnd00(
    it_awsaccountid = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_awsaccountname = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_companyname = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_compliancestatus = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_confidence = VALUE /aws1/cl_shbnumberfilter=>tt_numberfilterlist(
      (
        new /aws1/cl_shbnumberfilter(
          iv_eq = '0.1'
          iv_gt = '0.1'
          iv_gte = '0.1'
          iv_lt = '0.1'
          iv_lte = '0.1'
        )
      )
    )
    it_cplncassocdstandardsid = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_cplncsecuritycontrolid = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_createdat = VALUE /aws1/cl_shbdatefilter=>tt_datefilterlist(
      (
        new /aws1/cl_shbdatefilter(
          io_daterange = new /aws1/cl_shbdaterange(
            iv_unit = |string|
            iv_value = 123
          )
          iv_end = |string|
          iv_start = |string|
        )
      )
    )
    it_criticality = VALUE /aws1/cl_shbnumberfilter=>tt_numberfilterlist(
      (
        new /aws1/cl_shbnumberfilter(
          iv_eq = '0.1'
          iv_gt = '0.1'
          iv_gte = '0.1'
          iv_lt = '0.1'
          iv_lte = '0.1'
        )
      )
    )
    it_description = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_firstobservedat = VALUE /aws1/cl_shbdatefilter=>tt_datefilterlist(
      (
        new /aws1/cl_shbdatefilter(
          io_daterange = new /aws1/cl_shbdaterange(
            iv_unit = |string|
            iv_value = 123
          )
          iv_end = |string|
          iv_start = |string|
        )
      )
    )
    it_generatorid = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_id = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_lastobservedat = VALUE /aws1/cl_shbdatefilter=>tt_datefilterlist(
      (
        new /aws1/cl_shbdatefilter(
          io_daterange = new /aws1/cl_shbdaterange(
            iv_unit = |string|
            iv_value = 123
          )
          iv_end = |string|
          iv_start = |string|
        )
      )
    )
    it_notetext = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_noteupdatedat = VALUE /aws1/cl_shbdatefilter=>tt_datefilterlist(
      (
        new /aws1/cl_shbdatefilter(
          io_daterange = new /aws1/cl_shbdaterange(
            iv_unit = |string|
            iv_value = 123
          )
          iv_end = |string|
          iv_start = |string|
        )
      )
    )
    it_noteupdatedby = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_productarn = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_productname = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_recordstate = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_relatedfindingsid = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_relatedfindingsproductarn = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_resourceapplicationarn = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_resourceapplicationname = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_resourcedetailsother = VALUE /aws1/cl_shbmapfilter=>tt_mapfilterlist(
      (
        new /aws1/cl_shbmapfilter(
          iv_comparison = |string|
          iv_key = |string|
          iv_value = |string|
        )
      )
    )
    it_resourceid = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_resourcepartition = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_resourceregion = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_resourcetags = VALUE /aws1/cl_shbmapfilter=>tt_mapfilterlist(
      (
        new /aws1/cl_shbmapfilter(
          iv_comparison = |string|
          iv_key = |string|
          iv_value = |string|
        )
      )
    )
    it_resourcetype = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_severitylabel = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_sourceurl = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_title = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_type = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_updatedat = VALUE /aws1/cl_shbdatefilter=>tt_datefilterlist(
      (
        new /aws1/cl_shbdatefilter(
          io_daterange = new /aws1/cl_shbdaterange(
            iv_unit = |string|
            iv_value = 123
          )
          iv_end = |string|
          iv_start = |string|
        )
      )
    )
    it_userdefinedfields = VALUE /aws1/cl_shbmapfilter=>tt_mapfilterlist(
      (
        new /aws1/cl_shbmapfilter(
          iv_comparison = |string|
          iv_key = |string|
          iv_value = |string|
        )
      )
    )
    it_verificationstate = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
    it_workflowstatus = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |string|
          iv_value = |string|
        )
      )
    )
  )
  it_actions = VALUE /aws1/cl_shbautomationrulesact=>tt_actionlist(
    (
      new /aws1/cl_shbautomationrulesact(
        io_findingfieldsupdate = new /aws1/cl_shbautomationrlsfnd01(
          io_note = new /aws1/cl_shbnoteupdate(
            iv_text = |string|
            iv_updatedby = |string|
          )
          io_severity = new /aws1/cl_shbseverityupdate(
            iv_label = |string|
            iv_normalized = 123
            iv_product = '0.1'
          )
          io_workflow = new /aws1/cl_shbworkflowupdate( |string| )
          it_relatedfindings = VALUE /aws1/cl_shbrelatedfinding=>tt_relatedfindinglist(
            (
              new /aws1/cl_shbrelatedfinding(
                iv_id = |string|
                iv_productarn = |string|
              )
            )
          )
          it_types = VALUE /aws1/cl_shbtypelist_w=>tt_typelist(
            ( new /aws1/cl_shbtypelist_w( |string| ) )
          )
          it_userdefinedfields = VALUE /aws1/cl_shbfieldmap_w=>tt_fieldmap(
            (
              VALUE /aws1/cl_shbfieldmap_w=>ts_fieldmap_maprow(
                key = |string|
                value = new /aws1/cl_shbfieldmap_w( |string| )
              )
            )
          )
          iv_confidence = 123
          iv_criticality = 123
          iv_verificationstate = |string|
        )
        iv_type = |string|
      )
    )
  )
  it_tags = VALUE /aws1/cl_shbtagmap_w=>tt_tagmap(
    (
      VALUE /aws1/cl_shbtagmap_w=>ts_tagmap_maprow(
        value = new /aws1/cl_shbtagmap_w( |string| )
        key = |string|
      )
    )
  )
  iv_description = |string|
  iv_isterminal = ABAP_TRUE
  iv_rulename = |string|
  iv_ruleorder = 123
  iv_rulestatus = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lv_nonemptystring = lo_result->get_rulearn( ).
ENDIF.

To create an automation rule

The following example creates an automation rule.

DATA(lo_result) = lo_client->createautomationrule(
  io_criteria = new /aws1/cl_shbautomationrlsfnd00(
    it_compliancestatus = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |EQUALS|
          iv_value = |FAILED|
        )
      )
    )
    it_productname = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |EQUALS|
          iv_value = |Security Hub|
        )
      )
    )
    it_recordstate = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |EQUALS|
          iv_value = |ACTIVE|
        )
      )
    )
    it_resourceid = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |EQUALS|
          iv_value = |arn:aws:s3:::examplebucket/developers/design_info.doc|
        )
      )
    )
    it_workflowstatus = VALUE /aws1/cl_shbstringfilter=>tt_stringfilterlist(
      (
        new /aws1/cl_shbstringfilter(
          iv_comparison = |EQUALS|
          iv_value = |NEW|
        )
      )
    )
  )
  it_actions = VALUE /aws1/cl_shbautomationrulesact=>tt_actionlist(
    (
      new /aws1/cl_shbautomationrulesact(
        io_findingfieldsupdate = new /aws1/cl_shbautomationrlsfnd01(
          io_note = new /aws1/cl_shbnoteupdate(
            iv_text = |This is a critical S3 bucket, please look into this ASAP|
            iv_updatedby = |test-user|
          )
          io_severity = new /aws1/cl_shbseverityupdate( iv_label = |CRITICAL| )
        )
        iv_type = |FINDING_FIELDS_UPDATE|
      )
    )
  )
  it_tags = VALUE /aws1/cl_shbtagmap_w=>tt_tagmap(
    (
      VALUE /aws1/cl_shbtagmap_w=>ts_tagmap_maprow(
        value = new /aws1/cl_shbtagmap_w( |s3-bucket| )
        key = |important-resources-rule|
      )
    )
  )
  iv_description = |Elevate finding severity to Critical for important resources|
  iv_isterminal = ABAP_FALSE
  iv_rulename = |Elevate severity for important resources|
  iv_ruleorder = 1
  iv_rulestatus = |ENABLED|
).