aws-securityhub-finding-user-controlled-fields
ASFF findings contain producer- and user-controlled notes, custom fields, resource details, and descriptions that can hold pasted credentials or sensitive evidence.
Where it sits
location GetFindings.Findings[].{Note.Text,UserDefinedFields,Resources[].Details.Other,Description,Remediation.Recommendation.Text}location kind data_recorddata kinds credential password api_key access_key pii sensitive_data customer_data emits edge CanReadDataservice Security Hub (aws:securityhub)
Collection recipe
access mode read_apioperation GetFindingsresponse path Findings[].Note.Text / Findings[].UserDefinedFields.<key> / Findings[].Resources[].Details.Other.<key> / Findings[].Description / Findings[].Remediation.Recommendation.Textencoding jsonparams {"Filters": {"Id": [{"Comparison": "EQUALS", "Value": "\u003cfinding-id\u003e"}]}}
Required permissions
securityhub:GetFindings
Copy
References