aws-securityhub-suppress-findings

id: aws-securityhub-suppress-findings
emits: CanModifyConfiguration
description: "Principal can suppress Security Hub findings (securityhub:BatchUpdateFindings), setting\
  \ workflow state to SUPPRESSED or RESOLVED to hide attacker activity from dashboards and automated response\
  \ \u2014 a defense-evasion primitive that does not grant access to any resource."
match:
- - principal: null
  - HasPermission
  - hub: null
where:
- node_type(?hub) == SecurityService
- node_class(?hub) == ManagementService
- ?hub.provider_type == 'AWS::SecurityHub::Hub'
- '?principal has EFFECTIVE securityhub:BatchUpdateFindings on ?hub (resource scope: arn:aws:securityhub:*)'
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?hub
  permissions:
  - securityhub:BatchUpdateFindings
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE if securityhub:BatchUpdateFindings is in the principal's effective policy for the
    hub scope and no SCP or permission boundary denies it; BLOCKED if an explicit deny or SCP denies securityhub:BatchUpdateFindings;
    CONDITIONAL(scp_or_org_policy) if org policy applicability is unknown.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?hub (securityhub:BatchUpdateFindings effective)
  false_positive_note: "BatchUpdateFindings updates only the Workflow status (SUPPRESSED/NEW/ NOTIFIED/RESOLVED)\
    \ of findings \u2014 it cannot delete findings, modify the underlying resources, or alter IAM permissions.\
    \ The SecurityAudit and ReadOnlyAccess AWS managed policies do NOT grant this action; only principals\
    \ with explicit grants (e.g. AWSSecurityHubFullAccess or a custom policy) should have this edge emitted.\
    \ The delegated administrator account can suppress findings from member accounts, but this is still\
    \ a detective-only action. Do NOT chain to CanExecuteAs or CanEscalateTo \u2014 this is cover-tracks,\
    \ not privilege escalation."
  narrative: '{principal.name} can suppress AWS Security Hub findings (securityhub:BatchUpdateFindings),
    setting their workflow state to SUPPRESSED or RESOLVED. This hides attacker-generated findings from
    Security Hub dashboards and from automated EventBridge/Lambda response rules, reducing detection fidelity.
    It does not grant access to any AWS resource.'