batch_import_findings

batch_import_findings(**kwargs)

Imports security findings generated by a finding provider into Security Hub. This action is requested by the finding provider to import its findings into Security Hub.

BatchImportFindings must be called by one of the following:
  • The Amazon Web Services account that is associated with a finding if you are using the default product ARN or are a partner sending findings from within a customer's Amazon Web Services account. In these cases, the identifier of the account that you are calling BatchImportFindings from needs to be the same as the AwsAccountId attribute for the finding.
  • An Amazon Web Services account that Security Hub has allow-listed for an official partner integration. In this case, you can call BatchImportFindings from the allow-listed account and send findings from different customer accounts in the same batch.

The maximum allowed size for a finding is 240 Kb. An error is returned for any finding larger than 240 Kb.

After a finding is created, BatchImportFindings cannot be used to update the following finding fields and objects, which Security Hub customers use to manage their investigation workflow.

  • Note
  • UserDefinedFields
  • VerificationState
  • Workflow

Finding providers also should not use BatchImportFindings to update the following attributes.

  • Confidence
  • Criticality
  • RelatedFindings
  • Severity
  • Types

Instead, finding providers use FindingProviderFields to provide values for these attributes.

See also: AWS API Documentation

Request Syntax

# This section is too large to render.
# Please see the AWS API Documentation linked below.

AWS API Documentation

Parameters

# This section is too large to render.
# Please see the AWS API Documentation linked below.

AWS API Documentation

Return type
dict
Returns
Response Syntax
{
    'FailedCount': 123,
    'SuccessCount': 123,
    'FailedFindings': [
        {
            'Id': 'string',
            'ErrorCode': 'string',
            'ErrorMessage': 'string'
        },
    ]
}

Response Structure

  • (dict) --
    • FailedCount (integer) --

      The number of findings that failed to import.

    • SuccessCount (integer) --

      The number of findings that were successfully imported.

    • FailedFindings (list) --

      The list of findings that failed to import.

      • (dict) --

        The list of the findings that cannot be imported. For each finding, the list provides the error.

        • Id (string) --

          The identifier of the finding that could not be updated.

        • ErrorCode (string) --

          The code of the error returned by the BatchImportFindings operation.

        • ErrorMessage (string) --

          The message of the error returned by the BatchImportFindings operation.

Exceptions

  • SecurityHub.Client.exceptions.InternalException
  • SecurityHub.Client.exceptions.InvalidInputException
  • SecurityHub.Client.exceptions.LimitExceededException
  • SecurityHub.Client.exceptions.InvalidAccessException