ActionTarget

Source: src/AWS/SecurityHub/ActionTarget.ts

A Security Hub custom action target. Selecting the custom action on findings or insights in the console publishes a Security Hub Findings - Custom Action event to EventBridge, which a Function can consume via consumeCustomActions.

Creating a Custom Action

Send Findings to a Triage Function

const action = yield* AWS.SecurityHub.ActionTarget("Escalate", {
  name: "Escalate",
  description: "Escalate the selected findings to on-call",
});

Consume Custom Action Events

yield* AWS.SecurityHub.consumeCustomActions(
  { actionArns: [action.actionTargetArn] },
  (events) =>
    Stream.runForEach(events, (event) =>
      Effect.log(event.detail.findings),
    ),
);