SecurityHub / Client / create_insight
create_insight#
- SecurityHub.Client.create_insight(**kwargs)#
Creates a custom insight in Security Hub. An insight is a consolidation of findings that relate to a security issue that requires attention or remediation.
To group the related findings in the insight, use the
GroupByAttribute
.See also: AWS API Documentation
Request Syntax
response = client.create_insight( Name='string', Filters={ 'ProductArn': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'AwsAccountId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'Id': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'GeneratorId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'Region': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'Type': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'FirstObservedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'LastObservedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'CreatedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'UpdatedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'SeverityProduct': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'SeverityNormalized': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'SeverityLabel': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'Confidence': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'Criticality': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'Title': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'Description': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'RecommendationText': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'SourceUrl': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ProductFields': [ { 'Key': 'string', 'Value': 'string', 'Comparison': 'EQUALS'|'NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ProductName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'CompanyName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'UserDefinedFields': [ { 'Key': 'string', 'Value': 'string', 'Comparison': 'EQUALS'|'NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'MalwareName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'MalwareType': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'MalwarePath': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'MalwareState': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'NetworkDirection': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'NetworkProtocol': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'NetworkSourceIpV4': [ { 'Cidr': 'string' }, ], 'NetworkSourceIpV6': [ { 'Cidr': 'string' }, ], 'NetworkSourcePort': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'NetworkSourceDomain': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'NetworkSourceMac': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'NetworkDestinationIpV4': [ { 'Cidr': 'string' }, ], 'NetworkDestinationIpV6': [ { 'Cidr': 'string' }, ], 'NetworkDestinationPort': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'NetworkDestinationDomain': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ProcessName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ProcessPath': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ProcessPid': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'ProcessParentPid': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'ProcessLaunchedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'ProcessTerminatedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'ThreatIntelIndicatorType': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ThreatIntelIndicatorValue': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ThreatIntelIndicatorCategory': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ThreatIntelIndicatorLastObservedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'ThreatIntelIndicatorSource': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ThreatIntelIndicatorSourceUrl': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceType': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourcePartition': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceRegion': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceTags': [ { 'Key': 'string', 'Value': 'string', 'Comparison': 'EQUALS'|'NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsEc2InstanceType': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsEc2InstanceImageId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsEc2InstanceIpV4Addresses': [ { 'Cidr': 'string' }, ], 'ResourceAwsEc2InstanceIpV6Addresses': [ { 'Cidr': 'string' }, ], 'ResourceAwsEc2InstanceKeyName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsEc2InstanceIamInstanceProfileArn': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsEc2InstanceVpcId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsEc2InstanceSubnetId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsEc2InstanceLaunchedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'ResourceAwsS3BucketOwnerId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsS3BucketOwnerName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsIamAccessKeyUserName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsIamAccessKeyPrincipalName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsIamAccessKeyStatus': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceAwsIamAccessKeyCreatedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'ResourceAwsIamUserUserName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceContainerName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceContainerImageId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceContainerImageName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceContainerLaunchedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'ResourceDetailsOther': [ { 'Key': 'string', 'Value': 'string', 'Comparison': 'EQUALS'|'NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ComplianceStatus': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'VerificationState': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'WorkflowState': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'WorkflowStatus': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'RecordState': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'RelatedFindingsProductArn': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'RelatedFindingsId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'NoteText': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'NoteUpdatedAt': [ { 'Start': 'string', 'End': 'string', 'DateRange': { 'Value': 123, 'Unit': 'DAYS' } }, ], 'NoteUpdatedBy': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'Keyword': [ { 'Value': 'string' }, ], 'FindingProviderFieldsConfidence': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'FindingProviderFieldsCriticality': [ { 'Gte': 123.0, 'Lte': 123.0, 'Gt': 123.0, 'Lt': 123.0, 'Eq': 123.0 }, ], 'FindingProviderFieldsRelatedFindingsId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'FindingProviderFieldsRelatedFindingsProductArn': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'FindingProviderFieldsSeverityLabel': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'FindingProviderFieldsSeverityOriginal': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'FindingProviderFieldsTypes': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'Sample': [ { 'Value': True|False }, ], 'ComplianceSecurityControlId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ComplianceAssociatedStandardsId': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'VulnerabilitiesExploitAvailable': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'VulnerabilitiesFixAvailable': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ComplianceSecurityControlParametersName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ComplianceSecurityControlParametersValue': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'AwsAccountName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceApplicationName': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ], 'ResourceApplicationArn': [ { 'Value': 'string', 'Comparison': 'EQUALS'|'PREFIX'|'NOT_EQUALS'|'PREFIX_NOT_EQUALS'|'CONTAINS'|'NOT_CONTAINS' }, ] }, GroupByAttribute='string' ) **Parameters** :: # This section is too large to render. # Please see the AWS API Documentation linked below. `AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/securityhub-2018-10-26/CreateInsight>`_
- Return type:
dict
- Returns:
Response Syntax
{ 'InsightArn': 'string' }
Response Structure
(dict) –
InsightArn (string) –
The ARN of the insight created.
Exceptions
SecurityHub.Client.exceptions.InternalException
SecurityHub.Client.exceptions.InvalidInputException
SecurityHub.Client.exceptions.LimitExceededException
SecurityHub.Client.exceptions.InvalidAccessException
SecurityHub.Client.exceptions.ResourceConflictException