{
  "typeName" : "AWS::SecurityHub::AutomationRuleV2",
  "description" : "Resource schema for AWS::SecurityHub::AutomationRuleV2",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-securityhub",
  "definitions" : {
    "Tags" : {
      "description" : "A key-value pair to associate with a resource.",
      "type" : "object",
      "additionalProperties" : false,
      "patternProperties" : {
        "^(?!aws:)[a-zA-Z+-=._:/]{1,128}$" : {
          "type" : "string",
          "description" : "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "minLength" : 0,
          "maxLength" : 256
        }
      }
    },
    "OcsfFindingFilters" : {
      "description" : "The filtering conditions that align with OCSF standards",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "CompositeFilters" : {
          "description" : "Enables the creation of complex filtering conditions by combining filter",
          "type" : "array",
          "insertionOrder" : true,
          "uniqueItems" : true,
          "items" : {
            "$ref" : "#/definitions/CompositeFilter"
          }
        },
        "CompositeOperator" : {
          "$ref" : "#/definitions/AllowedOperators"
        }
      }
    },
    "CompositeFilter" : {
      "description" : "Enables the creation of filtering criteria for security findings",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "StringFilters" : {
          "description" : "Enables filtering based on string field values",
          "type" : "array",
          "insertionOrder" : true,
          "uniqueItems" : true,
          "items" : {
            "$ref" : "#/definitions/OcsfStringFilter"
          },
          "minItems" : 1,
          "maxItems" : 20
        },
        "DateFilters" : {
          "description" : "Enables filtering based on date and timestamp fields",
          "type" : "array",
          "insertionOrder" : true,
          "uniqueItems" : true,
          "items" : {
            "$ref" : "#/definitions/OcsfDateFilter"
          },
          "minItems" : 1,
          "maxItems" : 20
        },
        "BooleanFilters" : {
          "description" : "Enables filtering based on boolean field values",
          "type" : "array",
          "insertionOrder" : true,
          "uniqueItems" : true,
          "items" : {
            "$ref" : "#/definitions/OcsfBooleanFilter"
          },
          "minItems" : 1,
          "maxItems" : 20
        },
        "NumberFilters" : {
          "description" : "Enables filtering based on numerical field values",
          "type" : "array",
          "insertionOrder" : true,
          "uniqueItems" : true,
          "items" : {
            "$ref" : "#/definitions/OcsfNumberFilter"
          },
          "minItems" : 1,
          "maxItems" : 20
        },
        "MapFilters" : {
          "description" : "Enables filtering based on map field value",
          "items" : {
            "$ref" : "#/definitions/OcsfMapFilter"
          },
          "type" : "array",
          "minItems" : 1,
          "maxItems" : 20
        },
        "Operator" : {
          "$ref" : "#/definitions/AllowedOperators"
        }
      }
    },
    "OcsfStringFilter" : {
      "description" : "Enables filtering of security findings based on string field values in OCSF",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "FieldName" : {
          "$ref" : "#/definitions/OcsfStringField"
        },
        "Filter" : {
          "$ref" : "#/definitions/StringFilter"
        }
      },
      "required" : [ "FieldName", "Filter" ]
    },
    "OcsfDateFilter" : {
      "description" : "Enables filtering of security findings based on date and timestamp fields in OCSF",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "FieldName" : {
          "type" : "string",
          "description" : "The name of the field",
          "enum" : [ "finding_info.created_time_dt", "finding_info.first_seen_time_dt", "finding_info.last_seen_time_dt", "finding_info.modified_time_dt" ]
        },
        "Filter" : {
          "$ref" : "#/definitions/DateFilter"
        }
      },
      "required" : [ "FieldName", "Filter" ]
    },
    "OcsfBooleanFilter" : {
      "description" : "Enables filtering of security findings based on boolean field values in OCSF",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "FieldName" : {
          "description" : "The name of the field",
          "type" : "string",
          "enum" : [ "compliance.assessments.meets_criteria", "vulnerabilities.is_exploit_available", "vulnerabilities.is_fix_available" ]
        },
        "Filter" : {
          "$ref" : "#/definitions/BooleanFilter"
        }
      },
      "required" : [ "FieldName", "Filter" ]
    },
    "OcsfNumberFilter" : {
      "description" : "Enables filtering of security findings based on numerical field values in OCSF",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "FieldName" : {
          "description" : "The name of the field",
          "type" : "string",
          "enum" : [ "activity_id", "compliance.status_id", "confidence_score", "finding_info.related_events_count", "vendor_attributes.severity_id" ]
        },
        "Filter" : {
          "$ref" : "#/definitions/NumberFilter"
        }
      },
      "required" : [ "FieldName", "Filter" ]
    },
    "OcsfMapFilter" : {
      "description" : "Enables filtering of security findings based on map field values in OCSF",
      "properties" : {
        "FieldName" : {
          "description" : "The name of the field",
          "enum" : [ "resources.tags" ],
          "type" : "string"
        },
        "Filter" : {
          "$ref" : "#/definitions/MapFilter"
        }
      },
      "required" : [ "FieldName", "Filter" ],
      "type" : "object",
      "additionalProperties" : false
    },
    "StringFilter" : {
      "description" : "A string filter for filtering findings",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Value" : {
          "description" : "The string filter value",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 4096
        },
        "Comparison" : {
          "description" : "The condition to apply to a string value when filtering findings",
          "type" : "string",
          "enum" : [ "EQUALS", "PREFIX", "NOT_EQUALS", "PREFIX_NOT_EQUALS", "CONTAINS" ]
        }
      },
      "required" : [ "Value", "Comparison" ]
    },
    "DateFilter" : {
      "description" : "A date filter for querying findings",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "DateRange" : {
          "$ref" : "#/definitions/DateRange"
        },
        "End" : {
          "$ref" : "#/definitions/ISO8601DateString"
        },
        "Start" : {
          "$ref" : "#/definitions/ISO8601DateString"
        }
      }
    },
    "DateRange" : {
      "description" : "A date range for the date filter",
      "properties" : {
        "Unit" : {
          "description" : "A date range unit for the date filter",
          "enum" : [ "DAYS" ],
          "type" : "string"
        },
        "Value" : {
          "description" : "A date range value for the date filter",
          "type" : "number"
        }
      },
      "required" : [ "Unit", "Value" ],
      "type" : "object",
      "additionalProperties" : false
    },
    "BooleanFilter" : {
      "description" : "Boolean filter for querying findings",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Value" : {
          "description" : "The value of the boolean",
          "type" : "boolean"
        }
      },
      "required" : [ "Value" ]
    },
    "NumberFilter" : {
      "type" : "object",
      "description" : "A number filter for querying findings",
      "additionalProperties" : false,
      "properties" : {
        "Eq" : {
          "description" : "The equal-to condition to be applied to a single field when querying for findings",
          "type" : "number"
        },
        "Gte" : {
          "description" : "The greater-than-equal condition to be applied to a single field when querying for findings",
          "type" : "number"
        },
        "Lte" : {
          "description" : "The less-than-equal condition to be applied to a single field when querying for findings",
          "type" : "number"
        }
      }
    },
    "MapFilter" : {
      "description" : "A map filter for filtering findings",
      "properties" : {
        "Comparison" : {
          "description" : "The condition to apply to the key value when filtering findings with a map filter",
          "enum" : [ "EQUALS", "NOT_EQUALS" ],
          "type" : "string"
        },
        "Key" : {
          "description" : "The key of the map filter",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 4096
        },
        "Value" : {
          "description" : "The value for the key in the map filter",
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 4096
        }
      },
      "required" : [ "Comparison", "Key", "Value" ],
      "type" : "object",
      "additionalProperties" : false
    },
    "OcsfStringField" : {
      "description" : "The name of the field",
      "type" : "string",
      "enum" : [ "activity_name", "cloud.account.name", "cloud.account.uid", "cloud.provider", "cloud.region", "compliance.assessments.category", "compliance.assessments.name", "compliance.control", "compliance.status", "compliance.standards", "finding_info.desc", "finding_info.src_url", "finding_info.title", "finding_info.types", "finding_info.uid", "finding_info.related_events.uid", "finding_info.related_events.product.uid", "finding_info.related_events.title", "metadata.product.feature.uid", "metadata.product.name", "metadata.product.uid", "metadata.product.vendor_name", "remediation.desc", "remediation.references", "resources.cloud_partition", "resources.name", "resources.region", "resources.type", "resources.uid", "vulnerabilities.fix_coverage", "class_name", "vendor_attributes.severity" ]
    },
    "AllowedOperators" : {
      "description" : "The logical operator used to combine multiple conditions",
      "type" : "string",
      "enum" : [ "AND", "OR" ]
    },
    "ISO8601DateString" : {
      "description" : "The timestamp formatted in ISO8601",
      "type" : "string",
      "pattern" : "^(\\d\\d\\d\\d)-([0][1-9]|[1][0-2])-([0][1-9]|[1-2](\\d)|[3][0-1])[T](?:([0-1](\\d)|[2][0-3]):[0-5](\\d):[0-5](\\d)|23:59:60)(?:\\.(\\d)+)?([Z]|[+-](\\d\\d)(:?(\\d\\d))?)$"
    },
    "Criteria" : {
      "type" : "object",
      "description" : "Defines the parameters and conditions used to evaluate and filter security findings",
      "additionalProperties" : false,
      "properties" : {
        "OcsfFindingCriteria" : {
          "$ref" : "#/definitions/OcsfFindingFilters"
        }
      }
    },
    "AutomationRulesActionV2" : {
      "description" : "Allows you to configure automated responses",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Type" : {
          "description" : "The category of action to be executed by the automation rule",
          "type" : "string",
          "enum" : [ "FINDING_FIELDS_UPDATE", "EXTERNAL_INTEGRATION" ]
        },
        "FindingFieldsUpdate" : {
          "$ref" : "#/definitions/AutomationRulesFindingFieldsUpdateV2"
        },
        "ExternalIntegrationConfiguration" : {
          "$ref" : "#/definitions/ExternalIntegrationConfiguration"
        }
      },
      "required" : [ "Type" ]
    },
    "AutomationRulesFindingFieldsUpdateV2" : {
      "description" : "The changes to be applied to fields in a security finding when an automation rule is triggered",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "SeverityId" : {
          "description" : "The severity level to be assigned to findings that match the automation rule criteria",
          "type" : "integer"
        },
        "Comment" : {
          "description" : "Notes or contextual information for findings that are modified by the automation rule",
          "type" : "string",
          "pattern" : ".*\\S.*"
        },
        "StatusId" : {
          "description" : "The status to be applied to findings that match automation rule criteria",
          "type" : "integer"
        }
      }
    },
    "ExternalIntegrationConfiguration" : {
      "description" : "The settings for integrating automation rule actions with external systems or service",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "ConnectorArn" : {
          "description" : "The ARN of the connector that establishes the integration",
          "type" : "string",
          "pattern" : ".*\\S.*"
        }
      }
    }
  },
  "properties" : {
    "RuleName" : {
      "description" : "The name of the automation rule",
      "type" : "string",
      "pattern" : ".*\\S.*",
      "minLength" : 1,
      "maxLength" : 256
    },
    "RuleStatus" : {
      "description" : "The status of the automation rule",
      "type" : "string",
      "enum" : [ "ENABLED", "DISABLED" ]
    },
    "Description" : {
      "description" : "A description of the automation rule",
      "type" : "string",
      "pattern" : ".*\\S.*",
      "minLength" : 1,
      "maxLength" : 256
    },
    "RuleOrder" : {
      "description" : "The value for the rule priority",
      "type" : "number",
      "minimum" : 1.0,
      "maximum" : 1000.0
    },
    "Criteria" : {
      "$ref" : "#/definitions/Criteria"
    },
    "Actions" : {
      "description" : "A list of actions to be performed when the rule criteria is met",
      "type" : "array",
      "insertionOrder" : true,
      "uniqueItems" : true,
      "items" : {
        "$ref" : "#/definitions/AutomationRulesActionV2"
      },
      "minItems" : 1,
      "maxItems" : 1
    },
    "Tags" : {
      "$ref" : "#/definitions/Tags"
    },
    "RuleArn" : {
      "description" : "The ARN of the automation rule",
      "type" : "string",
      "pattern" : "^arn:aws\\S*:securityhub:[a-z0-9-]+:[0-9]{12}:automation-rulev2/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
    },
    "RuleId" : {
      "description" : "The ID of the automation rule",
      "type" : "string",
      "pattern" : "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
    },
    "CreatedAt" : {
      "$ref" : "#/definitions/ISO8601DateString"
    },
    "UpdatedAt" : {
      "$ref" : "#/definitions/ISO8601DateString"
    }
  },
  "required" : [ "RuleName", "Description", "RuleOrder", "Criteria", "Actions" ],
  "readOnlyProperties" : [ "/properties/RuleArn", "/properties/RuleId", "/properties/CreatedAt", "/properties/UpdatedAt" ],
  "primaryIdentifier" : [ "/properties/RuleArn" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "securityhub:ListTagsForResource", "securityhub:TagResource", "securityhub:UntagResource" ]
  },
  "additionalProperties" : false,
  "handlers" : {
    "create" : {
      "permissions" : [ "securityhub:CreateAutomationRuleV2", "securityhub:GetAutomationRuleV2", "securityhub:TagResource", "securityhub:ListTagsForResource" ]
    },
    "read" : {
      "permissions" : [ "securityhub:GetAutomationRuleV2", "securityhub:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "securityhub:UpdateAutomationRuleV2", "securityhub:GetAutomationRuleV2", "securityhub:TagResource", "securityhub:UntagResource", "securityhub:ListTagsForResource" ]
    },
    "delete" : {
      "permissions" : [ "securityhub:GetAutomationRuleV2", "securityhub:DeleteAutomationRuleV2" ]
    },
    "list" : {
      "permissions" : [ "securityhub:ListAutomationRulesV2", "securityhub:ListTagsForResource" ]
    }
  }
}