AutomationRule

Source: src/AWS/SecurityHub/AutomationRule.ts

A Security Hub automation rule — automatically updates findings that match its criteria (suppress, change severity, add notes) as they are ingested.

Automating Finding Triage

Suppress Informational Findings

const rule = yield* AWS.SecurityHub.AutomationRule("SuppressInfo", {
  description: "Suppress informational findings",
  ruleOrder: 1,
  criteria: {
    SeverityLabel: [{ Value: "INFORMATIONAL", Comparison: "EQUALS" }],
  },
  actions: [{
    Type: "FINDING_FIELDS_UPDATE",
    FindingFieldsUpdate: { Workflow: { Status: "SUPPRESSED" } },
  }],
});

Escalate Production Findings

const rule = yield* AWS.SecurityHub.AutomationRule("EscalateProd", {
  description: "Raise severity of findings on production resources",
  ruleOrder: 2,
  isTerminal: true,
  criteria: {
    ResourceTags: [{ Key: "env", Value: "prod", Comparison: "EQUALS" }],
  },
  actions: [{
    Type: "FINDING_FIELDS_UPDATE",
    FindingFieldsUpdate: { Severity: { Label: "CRITICAL" } },
  }],
});