batch_import_findings async ¶

async def batch_import_findings(
    self,
    *,
    config_overrides: Optional[AsyncSecurityHubClientConfig] = None,
    findings: Optional[
        "capo_securityhub.types.batch_import_findings_request_finding_list.BatchImportFindingsRequestFindingList"
    ] = None,
) -> "capo_securityhub.types.batch_import_findings_response.BatchImportFindingsResponse":
    """<p>Imports security findings generated by a finding provider into Security Hub CSPM. This action is requested by the finding provider to import its findings into Security Hub CSPM.</p> <p> <code>BatchImportFindings</code> must be called by one of the following:</p> <ul> <li> <p>The Amazon Web Services account that is associated with a finding if you are using the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-custom-providers.html#securityhub-custom-providers-bfi-reqs">default product ARN</a> or are a partner sending findings from within a customer's Amazon Web Services account. In these cases, the identifier of the account that you are calling <code>BatchImportFindings</code> from needs to be the same as the <code>AwsAccountId</code> attribute for the finding.</p> </li> <li> <p>An Amazon Web Services account that Security Hub CSPM has allow-listed for an official partner integration. In this case, you can call <code>BatchImportFindings</code> from the allow-listed account and send findings from different customer accounts in the same batch.</p> </li> </ul> <p>The maximum allowed size for a finding is 240 Kb. An error is returned for any finding larger than 240 Kb.</p> <p>After a finding is created, <code>BatchImportFindings</code> cannot be used to update the following finding fields and objects, which Security Hub CSPM customers use to manage their investigation workflow.</p> <ul> <li> <p> <code>Note</code> </p> </li> <li> <p> <code>UserDefinedFields</code> </p> </li> <li> <p> <code>VerificationState</code> </p> </li> <li> <p> <code>Workflow</code> </p> </li> </ul> <p>Finding providers also should not use <code>BatchImportFindings</code> to update the following attributes.</p> <ul> <li> <p> <code>Confidence</code> </p> </li> <li> <p> <code>Criticality</code> </p> </li> <li> <p> <code>RelatedFindings</code> </p> </li> <li> <p> <code>Severity</code> </p> </li> <li> <p> <code>Types</code> </p> </li> </ul> <p>Instead, finding providers use <code>FindingProviderFields</code> to provide values for these attributes.</p>

    Args:
        findings: <p>A list of findings to import. To successfully import a finding, it must follow the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html">Amazon Web Services Security Finding Format</a>. Maximum of 100 findings per request.</p>

    Raises:
        capo_securityhub.errors.internal_exception.InternalException: <p>Internal server error.</p>
        capo_securityhub.errors.invalid_access_exception.InvalidAccessException: <p>The account doesn't have permission to perform this action.</p>
        capo_securityhub.errors.invalid_input_exception.InvalidInputException: <p>The request was rejected because you supplied an invalid or out-of-range value for an input parameter.</p>
        capo_securityhub.errors.limit_exceeded_exception.LimitExceededException: <p>The request was rejected because it attempted to create resources beyond the current Amazon Web Services account or throttling limits. The error code describes the limit exceeded.</p>
        capo_securityhub.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        To import security findings from a third party provider to Security Hub
        The following example imports findings from a third party provider to Security Hub.

        >>> await client.batch_import_findings(findings=[{'AwsAccountId': '123456789012', 'CreatedAt': '2020-05-27T17:05:54.832Z', 'Description': 'Vulnerability in a CloudTrail trail', 'FindingProviderFields': {'Severity': {'Label': 'LOW', 'Original': '10'}, 'Types': ['Software and Configuration Checks/Vulnerabilities/CVE']}, 'GeneratorId': 'TestGeneratorId', 'Id': 'Id1', 'ProductArn': 'arn:aws:securityhub:us-west-1:123456789012:product/123456789012/default', 'Resources': [{'Id': 'arn:aws:cloudtrail:us-west-1:123456789012:trail/TrailName', 'Partition': 'aws', 'Region': 'us-west-1', 'Type': 'AwsCloudTrailTrail'}], 'SchemaVersion': '2018-10-08', 'Title': 'CloudTrail trail vulnerability', 'UpdatedAt': '2020-06-02T16:05:54.832Z'}])
    """

    async def _handler(
        req: "AsyncOperationRequest[capo_securityhub.types.batch_import_findings_request.BatchImportFindingsRequest]",
    ) -> AsyncOperationResponse[
        "capo_securityhub.types.batch_import_findings_response.BatchImportFindingsResponse"
    ]:
        import capo_securityhub._operations.security_hub_api_service.batch_import_findings

        (
            output,
            http_response,
        ) = await capo_securityhub._operations.security_hub_api_service.batch_import_findings.async_batch_import_findings(
            req.options, req.input
        )
        return AsyncOperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("BatchImportFindings")
    )
    input_: capo_securityhub.types.batch_import_findings_request.BatchImportFindingsRequest = {}
    if findings is not None:
        input_["findings"] = findings

    response = await aexecute_pipeline(
        AsyncOperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    await response.response.aclose()
    return response.output