{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--aws-securityhub-automationrule.json",
  "title": "AWSSecurityHubAutomationRuleProperties",
  "description": "The AWS::SecurityHub::AutomationRule resource represents the Automation Rule in your account. One rule resource is created for each Automation Rule in which you configure rule criteria and actions.\n\n. Source:- <https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-securityhub>",
  "x-lintel": {
    "source": "https://raw.githubusercontent.com/lalcebo/json-schema/master/serverless/resources/cloudformation-modified/aws-securityhub-automationrule.json",
    "sourceSha256": "71d60c932d6a710354d62ebf57c58f205cd6b818c795cca6d6b90bcb429b29c7"
  },
  "type": "object",
  "properties": {
    "RuleStatus": {
      "oneOf": [
        {
          "type": "string",
          "enum": [
            "ENABLED",
            "DISABLED"
          ]
        },
        {
          "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
        }
      ],
      "description": "Status of the Rule upon creation"
    },
    "RuleOrder": {
      "description": "Rule order value",
      "type": "integer",
      "minimum": 1,
      "maximum": 1000
    },
    "Description": {
      "oneOf": [
        {
          "type": "string",
          "minLength": 1,
          "maxLength": 1024
        },
        {
          "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
        }
      ],
      "description": "Rule description"
    },
    "RuleName": {
      "oneOf": [
        {
          "type": "string",
          "minLength": 1,
          "maxLength": 256
        },
        {
          "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
        }
      ],
      "description": "Rule name"
    },
    "IsTerminal": {
      "description": "If Rule is a terminal rule",
      "type": "boolean"
    },
    "Actions": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/AutomationRulesAction"
      },
      "minItems": 1,
      "maxItems": 1
    },
    "Criteria": {
      "description": "The rule criteria for evaluating findings",
      "$ref": "#/$defs/AutomationRulesFindingFilters"
    },
    "Tags": {
      "$ref": "#/$defs/Tags"
    }
  },
  "typeName": "AWS::SecurityHub::AutomationRule",
  "tagging": {
    "taggable": true,
    "tagOnCreate": true,
    "tagUpdatable": true,
    "cloudFormationSystemTags": true,
    "tagProperty": "/properties/Tags"
  },
  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-securityhub",
  "additionalProperties": false,
  "readOnlyProperties": [
    "/properties/RuleArn",
    "/properties/CreatedAt",
    "/properties/UpdatedAt",
    "/properties/CreatedBy"
  ],
  "$defs": {
    "Tags": {
      "description": "A key-value pair to associate with a resource.",
      "type": "object",
      "title": "AWSSecurityHubAutomationRuleTagsDefinition",
      "additionalProperties": false,
      "patternProperties": {
        "^[a-zA-Z0-9]{1,128}$": {
          "type": "string",
          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "minLength": 0,
          "maxLength": 256
        }
      }
    },
    "NonEmptyString": {
      "oneOf": [
        {
          "type": "string",
          "minLength": 1
        },
        {
          "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
        }
      ],
      "title": "AWSSecurityHubAutomationRuleNonEmptyStringDefinition"
    },
    "DateFilter": {
      "properties": {
        "DateRange": {
          "$ref": "#/$defs/DateRange"
        },
        "End": {
          "$ref": "#/$defs/ISO8601DateString"
        },
        "Start": {
          "$ref": "#/$defs/ISO8601DateString"
        }
      },
      "type": "object",
      "oneOf": [
        {
          "required": [
            "DateRange"
          ]
        },
        {
          "allOf": [
            {
              "required": [
                "Start"
              ]
            },
            {
              "required": [
                "End"
              ]
            }
          ]
        }
      ],
      "title": "AWSSecurityHubAutomationRuleDateFilterDefinition",
      "additionalProperties": false
    },
    "DateRange": {
      "properties": {
        "Unit": {
          "oneOf": [
            {
              "enum": [
                "DAYS"
              ],
              "type": "string"
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        },
        "Value": {
          "type": "number"
        }
      },
      "required": [
        "Unit",
        "Value"
      ],
      "type": "object",
      "title": "AWSSecurityHubAutomationRuleDateRangeDefinition",
      "additionalProperties": false
    },
    "BooleanFilter": {
      "properties": {
        "Value": {
          "type": "boolean"
        }
      },
      "required": [
        "Value"
      ],
      "type": "object",
      "title": "AWSSecurityHubAutomationRuleBooleanFilterDefinition",
      "additionalProperties": false
    },
    "MapFilter": {
      "properties": {
        "Comparison": {
          "oneOf": [
            {
              "enum": [
                "EQUALS",
                "NOT_EQUALS"
              ],
              "type": "string"
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        },
        "Key": {
          "oneOf": [
            {
              "type": "string"
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        },
        "Value": {
          "oneOf": [
            {
              "type": "string"
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        }
      },
      "required": [
        "Comparison",
        "Key",
        "Value"
      ],
      "type": "object",
      "title": "AWSSecurityHubAutomationRuleMapFilterDefinition",
      "additionalProperties": false
    },
    "NumberFilter": {
      "properties": {
        "Eq": {
          "type": "number"
        },
        "Gte": {
          "type": "number"
        },
        "Lte": {
          "type": "number"
        }
      },
      "oneOf": [
        {
          "required": [
            "Eq"
          ]
        },
        {
          "anyOf": [
            {
              "required": [
                "Gte"
              ]
            },
            {
              "required": [
                "Lte"
              ]
            }
          ]
        }
      ],
      "type": "object",
      "title": "AWSSecurityHubAutomationRuleNumberFilterDefinition",
      "additionalProperties": false
    },
    "StringFilter": {
      "properties": {
        "Comparison": {
          "$ref": "#/$defs/StringFilterComparison"
        },
        "Value": {
          "oneOf": [
            {
              "type": "string"
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        }
      },
      "required": [
        "Comparison",
        "Value"
      ],
      "type": "object",
      "title": "AWSSecurityHubAutomationRuleStringFilterDefinition",
      "additionalProperties": false
    },
    "StringFilterComparison": {
      "oneOf": [
        {
          "enum": [
            "EQUALS",
            "PREFIX",
            "NOT_EQUALS",
            "PREFIX_NOT_EQUALS"
          ],
          "type": "string"
        },
        {
          "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
        }
      ],
      "title": "AWSSecurityHubAutomationRuleStringFilterComparisonDefinition"
    },
    "ISO8601DateString": {
      "oneOf": [
        {
          "type": "string",
          "pattern": "^(\\d\\d\\d\\d)-([0][1-9]|[1][0-2])-([0][1-9]|[1-2](\\d)|[3][0-1])[T](?:([0-1](\\d)|[2][0-3]):[0-5](\\d):[0-5](\\d)|23:59:60)(?:\\.(\\d)+)?([Z]|[+-](\\d\\d)(:?(\\d\\d))?)$"
        },
        {
          "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
        }
      ],
      "title": "AWSSecurityHubAutomationRuleISO8601DateStringDefinition"
    },
    "arn": {
      "oneOf": [
        {
          "type": "string",
          "minLength": 12,
          "maxLength": 2048,
          "pattern": "^arn:(aws|aws-cn|aws-us-gov|aws-iso-?[a-z]{0,2}):[A-Za-z0-9]{1,63}:[a-z]+-([a-z]{1,10}-)?[a-z]+-[0-9]+:([0-9]{12})?:.+$"
        },
        {
          "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
        }
      ],
      "title": "AWSSecurityHubAutomationRulearnDefinition"
    },
    "arnOrId": {
      "anyOf": [
        {
          "type": "string",
          "minLength": 1,
          "maxLength": 512
        },
        {
          "$ref": "#/$defs/arn"
        }
      ],
      "title": "AWSSecurityHubAutomationRulearnOrIdDefinition"
    },
    "timestamp": {
      "oneOf": [
        {
          "type": "string",
          "format": "date-time",
          "pattern": "(\\d\\d\\d\\d)-[0-1](\\d)-[0-3](\\d)[Tt](?:[0-2](\\d):[0-5](\\d):[0-5](\\d)|23:59:60)(?:\\.(\\d)+)?(?:[Zz]|[+-](\\d\\d)(?::?(\\d\\d))?)$"
        },
        {
          "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
        }
      ],
      "title": "AWSSecurityHubAutomationRuletimestampDefinition"
    },
    "int100": {
      "type": "integer",
      "minimum": 0,
      "maximum": 100,
      "title": "AWSSecurityHubAutomationRuleint100Definition"
    },
    "map": {
      "type": "object",
      "minProperties": 1,
      "maxProperties": 50,
      "additionalProperties": false,
      "title": "AWSSecurityHubAutomationRulemapDefinition",
      "patternProperties": {
        "^[-_+=.:/@\\w\\s]{1,128}$": {
          "type": "string",
          "minLength": 0,
          "maxLength": 1024
        }
      }
    },
    "RelatedFinding": {
      "type": "object",
      "properties": {
        "ProductArn": {
          "$ref": "#/$defs/arn"
        },
        "Id": {
          "$ref": "#/$defs/arnOrId"
        }
      },
      "title": "AWSSecurityHubAutomationRuleRelatedFindingDefinition",
      "required": [
        "ProductArn",
        "Id"
      ],
      "additionalProperties": false
    },
    "NoteUpdate": {
      "type": "object",
      "properties": {
        "Text": {
          "oneOf": [
            {
              "type": "string",
              "minLength": 1,
              "maxLength": 512
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        },
        "UpdatedBy": {
          "$ref": "#/$defs/arnOrId"
        }
      },
      "title": "AWSSecurityHubAutomationRuleNoteUpdateDefinition",
      "required": [
        "Text",
        "UpdatedBy"
      ],
      "additionalProperties": false
    },
    "WorkflowUpdate": {
      "type": "object",
      "properties": {
        "Status": {
          "oneOf": [
            {
              "type": "string",
              "enum": [
                "NEW",
                "NOTIFIED",
                "RESOLVED",
                "SUPPRESSED"
              ]
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        }
      },
      "required": [
        "Status"
      ],
      "title": "AWSSecurityHubAutomationRuleWorkflowUpdateDefinition",
      "additionalProperties": false
    },
    "SeverityUpdate": {
      "type": "object",
      "properties": {
        "Product": {
          "type": "number"
        },
        "Label": {
          "oneOf": [
            {
              "type": "string",
              "enum": [
                "INFORMATIONAL",
                "LOW",
                "MEDIUM",
                "HIGH",
                "CRITICAL"
              ]
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        },
        "Normalized": {
          "$ref": "#/$defs/int100"
        }
      },
      "title": "AWSSecurityHubAutomationRuleSeverityUpdateDefinition",
      "additionalProperties": false
    },
    "AutomationRulesFindingFieldsUpdate": {
      "type": "object",
      "properties": {
        "Types": {
          "type": "array",
          "maxItems": 50,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "pattern": "^([^/]+)(/[^/]+){0,2}$"
          }
        },
        "Severity": {
          "type": "object",
          "description": "Severity of the finding",
          "$ref": "#/$defs/SeverityUpdate"
        },
        "Confidence": {
          "$ref": "#/$defs/int100"
        },
        "Criticality": {
          "$ref": "#/$defs/int100"
        },
        "UserDefinedFields": {
          "$ref": "#/$defs/map"
        },
        "VerificationState": {
          "oneOf": [
            {
              "type": "string",
              "enum": [
                "UNKNOWN",
                "TRUE_POSITIVE",
                "FALSE_POSITIVE",
                "BENIGN_POSITIVE"
              ]
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        },
        "RelatedFindings": {
          "type": "array",
          "minItems": 1,
          "maxItems": 10,
          "items": {
            "$ref": "#/$defs/RelatedFinding"
          }
        },
        "Note": {
          "type": "object",
          "description": "Note added to the finding",
          "$ref": "#/$defs/NoteUpdate"
        },
        "Workflow": {
          "type": "object",
          "description": "Workflow status set for the finding",
          "$ref": "#/$defs/WorkflowUpdate"
        }
      },
      "title": "AWSSecurityHubAutomationRuleAutomationRulesFindingFieldsUpdateDefinition"
    },
    "AutomationRulesAction": {
      "type": "object",
      "properties": {
        "Type": {
          "oneOf": [
            {
              "type": "string",
              "enum": [
                "FINDING_FIELDS_UPDATE"
              ]
            },
            {
              "$ref": "https://catalog.lintel.tools/schemas/schemastore/serverless-framework-configuration/_shared/latest--cf.functions.json#/Aws_CF_FunctionString"
            }
          ]
        },
        "FindingFieldsUpdate": {
          "$ref": "#/$defs/AutomationRulesFindingFieldsUpdate"
        }
      },
      "required": [
        "Type",
        "FindingFieldsUpdate"
      ],
      "title": "AWSSecurityHubAutomationRuleAutomationRulesActionDefinition"
    },
    "AutomationRulesFindingFilters": {
      "type": "object",
      "title": "AWSSecurityHubAutomationRuleAutomationRulesFindingFiltersDefinition",
      "properties": {
        "ProductArn": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "AwsAccountId": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 100
        },
        "Id": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "GeneratorId": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 100
        },
        "Type": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "FirstObservedAt": {
          "items": {
            "$ref": "#/$defs/DateFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "LastObservedAt": {
          "items": {
            "$ref": "#/$defs/DateFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "CreatedAt": {
          "items": {
            "$ref": "#/$defs/DateFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "UpdatedAt": {
          "items": {
            "$ref": "#/$defs/DateFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "Confidence": {
          "items": {
            "$ref": "#/$defs/NumberFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "Criticality": {
          "items": {
            "$ref": "#/$defs/NumberFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "Title": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 100
        },
        "Description": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "SourceUrl": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ProductName": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "CompanyName": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "SeverityLabel": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ResourceType": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ResourceId": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 100
        },
        "ResourcePartition": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ResourceRegion": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ResourceTags": {
          "items": {
            "$ref": "#/$defs/MapFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ResourceDetailsOther": {
          "items": {
            "$ref": "#/$defs/MapFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ComplianceStatus": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ComplianceSecurityControlId": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "ComplianceAssociatedStandardsId": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "VerificationState": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "WorkflowStatus": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "RecordState": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "RelatedFindingsProductArn": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "RelatedFindingsId": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "NoteText": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "NoteUpdatedAt": {
          "items": {
            "$ref": "#/$defs/DateFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "NoteUpdatedBy": {
          "items": {
            "$ref": "#/$defs/StringFilter"
          },
          "type": "array",
          "maxItems": 20
        },
        "UserDefinedFields": {
          "items": {
            "$ref": "#/$defs/MapFilter"
          },
          "type": "array",
          "maxItems": 20
        }
      },
      "additionalProperties": false
    }
  },
  "primaryIdentifier": [
    "/properties/RuleArn"
  ]
}