Insight

Source: src/AWS/SecurityHub/Insight.ts

A Security Hub custom insight — a saved finding query grouped by an attribute. Read its aggregated results at runtime with the GetInsightResults binding.

Creating an Insight

Critical Findings by Resource

const insight = yield* AWS.SecurityHub.Insight("CriticalByResource", {
  filters: {
    SeverityLabel: [{ Value: "CRITICAL", Comparison: "EQUALS" }],
    RecordState: [{ Value: "ACTIVE", Comparison: "EQUALS" }],
  },
  groupByAttribute: "ResourceId",
});

Read Insight Results at Runtime

const getInsightResults = yield* AWS.SecurityHub.GetInsightResults();
const { InsightResults } = yield* getInsightResults({
  InsightArn: insight.insightArn,
});