Returns aggregated statistical data about findings¶

Description¶

Returns aggregated statistical data about findings.

You can use the Scopes parameter to define the data boundary for the query. Currently, Scopes supports AwsOrganizations, which lets you aggregate findings from your entire organization or from specific organizational units. Only the delegated administrator account can use Scopes.

get_finding_statistics_v2 uses securityhub:GetAdhocInsightResults in the Action element of an IAM policy statement. You must have permission to perform the securityhub:GetAdhocInsightResults action.

Usage¶

securityhub_get_finding_statistics_v2(GroupByRules, Scopes, SortOrder,
  MaxStatisticResults)

Arguments¶

GroupByRules

[required] Specifies how security findings should be aggregated and organized in the statistical analysis. It can accept up to 5 groupBy fields in a single call.
Scopes

Limits the results to findings from specific organizational units or from the delegated administrator's organization. Only the delegated administrator account can use this parameter. Other accounts receive an AccessDeniedException.

This parameter is optional. If you omit it, the delegated administrator sees statistics from all accounts across the entire organization. Other accounts see only statistics for their own findings.

You can specify up to 10 entries in Scopes.AwsOrganizations. If multiple entries are specified, the entries are combined using OR logic.
SortOrder

Orders the aggregation count in descending or ascending order. Descending order is the default.
MaxStatisticResults

The maximum number of results to be returned.

Value¶

A list with the following syntax:

list(
  GroupByResults = list(
    list(
      GroupByField = "string",
      GroupByValues = list(
        list(
          FieldValue = "string",
          Count = 123
        )
      )
    )
  )
)

Request syntax¶

svc$get_finding_statistics_v2(
  GroupByRules = list(
    list(
      Filters = list(
        CompositeFilters = list(
          list(
            StringFilters = list(
              list(
                FieldName = "metadata.uid"|"activity_name"|"cloud.account.uid"|"cloud.provider"|"cloud.region"|"compliance.assessments.category"|"compliance.assessments.name"|"compliance.control"|"compliance.status"|"compliance.standards"|"finding_info.desc"|"finding_info.src_url"|"finding_info.title"|"finding_info.types"|"finding_info.uid"|"finding_info.related_events.traits.category"|"finding_info.related_events.uid"|"finding_info.related_events.product.uid"|"finding_info.related_events.title"|"metadata.product.name"|"metadata.product.uid"|"metadata.product.vendor_name"|"remediation.desc"|"remediation.references"|"resources.cloud_partition"|"resources.name"|"resources.owner.account.uid"|"resources.owner.org.uid"|"resources.owner.account.name"|"resources.provider"|"resources.region"|"resources.type"|"resources.uid"|"severity"|"status"|"comment"|"vulnerabilities.fix_coverage"|"class_name"|"databucket.encryption_details.algorithm"|"databucket.encryption_details.key_uid"|"databucket.file.data_classifications.classifier_details.type"|"evidences.actor.user.account.uid"|"evidences.api.operation"|"evidences.api.response.error_message"|"evidences.api.service.name"|"evidences.connection_info.direction"|"evidences.connection_info.protocol_name"|"evidences.dst_endpoint.autonomous_system.name"|"evidences.dst_endpoint.location.city"|"evidences.dst_endpoint.location.country"|"evidences.src_endpoint.autonomous_system.name"|"evidences.src_endpoint.hostname"|"evidences.src_endpoint.location.city"|"evidences.src_endpoint.location.country"|"finding_info.analytic.name"|"malware.name"|"malware_scan_info.uid"|"malware.severity"|"resources.cloud_function.layers.uid_alt"|"resources.cloud_function.runtime"|"resources.cloud_function.user.uid"|"resources.device.encryption_details.key_uid"|"resources.device.image.uid"|"resources.image.architecture"|"resources.image.registry_uid"|"resources.image.repository_name"|"resources.image.uid"|"resources.subnet_info.uid"|"resources.vpc_uid"|"vulnerabilities.affected_code.file.path"|"vulnerabilities.affected_packages.name"|"vulnerabilities.cve.epss.score"|"vulnerabilities.cve.uid"|"vulnerabilities.related_vulnerabilities"|"cloud.account.name"|"vendor_attributes.severity",
                Filter = list(
                  Value = "string",
                  Comparison = "EQUALS"|"PREFIX"|"NOT_EQUALS"|"PREFIX_NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"|"CONTAINS_WORD"
                )
              )
            ),
            DateFilters = list(
              list(
                FieldName = "finding_info.created_time_dt"|"finding_info.first_seen_time_dt"|"finding_info.last_seen_time_dt"|"finding_info.modified_time_dt"|"resources.image.created_time_dt"|"resources.image.last_used_time_dt"|"resources.modified_time_dt",
                Filter = list(
                  Start = "string",
                  End = "string",
                  DateRange = list(
                    Value = 123,
                    Unit = "DAYS",
                    Comparison = "WITHIN"|"OLDER_THAN"
                  )
                )
              )
            ),
            BooleanFilters = list(
              list(
                FieldName = "compliance.assessments.meets_criteria"|"vulnerabilities.is_exploit_available"|"vulnerabilities.is_fix_available",
                Filter = list(
                  Value = TRUE|FALSE
                )
              )
            ),
            NumberFilters = list(
              list(
                FieldName = "activity_id"|"compliance.status_id"|"confidence_score"|"severity_id"|"status_id"|"finding_info.related_events_count"|"evidences.api.response.code"|"evidences.dst_endpoint.autonomous_system.number"|"evidences.dst_endpoint.port"|"evidences.src_endpoint.autonomous_system.number"|"evidences.src_endpoint.port"|"resources.image.in_use_count"|"vulnerabilities.cve.cvss.base_score"|"vendor_attributes.severity_id",
                Filter = list(
                  Gte = 123.0,
                  Lte = 123.0,
                  Eq = 123.0,
                  Gt = 123.0,
                  Lt = 123.0
                )
              )
            ),
            MapFilters = list(
              list(
                FieldName = "resources.tags"|"compliance.control_parameters"|"databucket.tags"|"finding_info.tags",
                Filter = list(
                  Key = "string",
                  Value = "string",
                  Comparison = "EQUALS"|"NOT_EQUALS"|"CONTAINS"|"NOT_CONTAINS"
                )
              )
            ),
            IpFilters = list(
              list(
                FieldName = "evidences.dst_endpoint.ip"|"evidences.src_endpoint.ip",
                Filter = list(
                  Cidr = "string"
                )
              )
            ),
            NestedCompositeFilters = list(),
            Operator = "AND"|"OR"
          )
        ),
        CompositeOperator = "AND"|"OR"
      ),
      GroupByField = "activity_name"|"cloud.account.uid"|"cloud.provider"|"cloud.region"|"compliance.assessments.name"|"compliance.status"|"compliance.control"|"finding_info.title"|"finding_info.related_events.traits.category"|"finding_info.types"|"metadata.product.name"|"metadata.product.uid"|"resources.type"|"resources.cloud_partition"|"resources.name"|"resources.owner.account.uid"|"resources.owner.org.uid"|"resources.owner.account.name"|"resources.provider"|"resources.region"|"resources.uid"|"severity"|"status"|"vulnerabilities.fix_coverage"|"class_name"|"vulnerabilities.affected_packages.name"|"finding_info.analytic.name"|"compliance.standards"|"cloud.account.name"|"vendor_attributes.severity"|"metadata.product.vendor_name"
    )
  ),
  Scopes = list(
    AwsOrganizations = list(
      list(
        OrganizationId = "string",
        OrganizationalUnitId = "string"
      )
    )
  ),
  SortOrder = "asc"|"desc",
  MaxStatisticResults = 123
)