SecurityHub / Client / create_insight

create_insight

SecurityHub.Client.create_insight(**kwargs)

Creates a custom insight in Security Hub. An insight is a consolidation of findings that relate to a security issue that requires attention or remediation.

To group the related findings in the insight, use the GroupByAttribute.

See also: AWS API Documentation

Request Syntax

response = client.create_insight(
    Name='string',
    Filters={
        'ProductArn': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'AwsAccountId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'Id': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'GeneratorId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'Region': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'Type': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'FirstObservedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'LastObservedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'CreatedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'UpdatedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'SeverityProduct': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'SeverityNormalized': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'SeverityLabel': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'Confidence': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'Criticality': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'Title': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'Description': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'RecommendationText': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'SourceUrl': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ProductFields': [
            {
                'Key': 'string',
                'Value': 'string',
                'Comparison': 'EQUALS'|'NOT_EQUALS'
            },
        ],
        'ProductName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'CompanyName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'UserDefinedFields': [
            {
                'Key': 'string',
                'Value': 'string',
                'Comparison': 'EQUALS'|'NOT_EQUALS'
            },
        ],
        'MalwareName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'MalwareType': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'MalwarePath': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'MalwareState': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'NetworkDirection': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'NetworkProtocol': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'NetworkSourceIpV4': [
            {
                'Cidr': 'string'
            },
        ],
        'NetworkSourceIpV6': [
            {
                'Cidr': 'string'
            },
        ],
        'NetworkSourcePort': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'NetworkSourceDomain': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'NetworkSourceMac': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'NetworkDestinationIpV4': [
            {
                'Cidr': 'string'
            },
        ],
        'NetworkDestinationIpV6': [
            {
                'Cidr': 'string'
            },
        ],
        'NetworkDestinationPort': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'NetworkDestinationDomain': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ProcessName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ProcessPath': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ProcessPid': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'ProcessParentPid': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'ProcessLaunchedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'ProcessTerminatedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'ThreatIntelIndicatorType': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ThreatIntelIndicatorValue': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ThreatIntelIndicatorCategory': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ThreatIntelIndicatorLastObservedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'ThreatIntelIndicatorSource': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ThreatIntelIndicatorSourceUrl': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceType': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourcePartition': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceRegion': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceTags': [
            {
                'Key': 'string',
                'Value': 'string',
                'Comparison': 'EQUALS'|'NOT_EQUALS'
            },
        ],
        'ResourceAwsEc2InstanceType': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsEc2InstanceImageId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsEc2InstanceIpV4Addresses': [
            {
                'Cidr': 'string'
            },
        ],
        'ResourceAwsEc2InstanceIpV6Addresses': [
            {
                'Cidr': 'string'
            },
        ],
        'ResourceAwsEc2InstanceKeyName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsEc2InstanceIamInstanceProfileArn': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsEc2InstanceVpcId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsEc2InstanceSubnetId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsEc2InstanceLaunchedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'ResourceAwsS3BucketOwnerId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsS3BucketOwnerName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsIamAccessKeyUserName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsIamAccessKeyPrincipalName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsIamAccessKeyStatus': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceAwsIamAccessKeyCreatedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'ResourceAwsIamUserUserName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceContainerName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceContainerImageId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceContainerImageName': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ResourceContainerLaunchedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'ResourceDetailsOther': [
            {
                'Key': 'string',
                'Value': 'string',
                'Comparison': 'EQUALS'|'NOT_EQUALS'
            },
        ],
        'ComplianceStatus': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'VerificationState': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'WorkflowState': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'WorkflowStatus': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'RecordState': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'RelatedFindingsProductArn': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'RelatedFindingsId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'NoteText': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'NoteUpdatedAt': [
            {
                'Start': 'string',
                'End': 'string',
                'DateRange': {
                    'Value': 123,
                    'Unit': 'DAYS'
                }
            },
        ],
        'NoteUpdatedBy': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'Keyword': [
            {
                'Value': 'string'
            },
        ],
        'FindingProviderFieldsConfidence': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'FindingProviderFieldsCriticality': [
            {
                'Gte': 123.0,
                'Lte': 123.0,
                'Eq': 123.0
            },
        ],
        'FindingProviderFieldsRelatedFindingsId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'FindingProviderFieldsRelatedFindingsProductArn': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'FindingProviderFieldsSeverityLabel': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'FindingProviderFieldsSeverityOriginal': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'FindingProviderFieldsTypes': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'Sample': [
            {
                'Value': True|False
            },
        ],
        'ComplianceSecurityControlId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ],
        'ComplianceAssociatedStandardsId': [
            {
                'Value': 'string',
                'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'
            },
        ]
    },
    GroupByAttribute='string'
)


**Parameters**
::

    # This section is too large to render.
    # Please see the AWS API Documentation linked below.

`AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/securityhub-2018-10-26/CreateInsight>`_

Return type:

dict

Returns:

Response Syntax

{
    'InsightArn': 'string'
}

Response Structure

• (dict) –

  • InsightArn (string) –

    The ARN of the insight created.

Exceptions

• SecurityHub.Client.exceptions.InternalException

• SecurityHub.Client.exceptions.InvalidInputException

• SecurityHub.Client.exceptions.LimitExceededException

• SecurityHub.Client.exceptions.InvalidAccessException

• SecurityHub.Client.exceptions.ResourceConflictException