AWSSecurityHubFindings

AWSSecurityHubFindings Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel AWS Security Hub Findings, which are collected in AWS S3 buckets, into Microsoft Sentinel. AWS Security Hub Finding is a detailed record of a security check or security-related detection, which can originate from various sources like enabled controls, integrations with other AWS services, third-party products, or custom integrations.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AwsAccountId The AWS account ID associated with the event. String
AwsRegion The AWS region where the event occurred. String
AwsSecurityFindingCreatedAt The timestamp when the security finding was created. DateTime
AwsSecurityFindingDescription A detailed description of the AWS security finding. String
AwsSecurityFindingFirstObservedAt The timestamp when the security finding was first observed. DateTime
AwsSecurityFindingGeneratorId The ID of the generator that created the security finding. String
AwsSecurityFindingId The unique identifier for the AWS security finding. String
AwsSecurityFindingLastObservedAt The timestamp when the security finding was last observed. DateTime
AwsSecurityFindingProcessedAt The timestamp when the security finding was processed. DateTime
AwsSecurityFindingProductArn The Amazon Resource Name (ARN) of the product that generated the finding. String
AwsSecurityFindingProductFields Additional fields provided by the product that generated the finding. Object
AwsSecurityFindingProductName The name of the product that generated the finding. String
AwsSecurityFindingSeverity The severity level of the security finding. Object
AwsSecurityFindingTitle The title of the AWS security finding. String
AwsSecurityFindingTypes The types or categories of the AWS security finding. Object
AwsSecurityFindingUpdatedAt The timestamp when the security finding was last updated. DateTime
ComplianceAssociatedStandards The compliance standards associated with the resource. Object
ComplianceRelatedRequirements The related compliance requirements. Object
ComplianceSecurityControlId The ID of the security control related to compliance. String
ComplianceSecurityControlParameters Parameters associated with the security control. Object
ComplianceStatus The compliance status of the resource (e.g., COMPLIANT, NON_COMPLIANT). String
ComplianceStatusReasons The reasons for the compliance status. Object
RawData The raw data associated with the finding. Object
RecordState The state of the record (e.g., ACTIVE, ARCHIVED). String
Remediation Details about how to remediate the security finding. Object
Resources The resources associated with the security finding. Object
SchemaVersion The version of the schema used for the finding. String
SourceSystem String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The timestamp when the event was generated. DateTime
Type The name of the table String
WorkflowState The workflow state of the finding (e.g., NEW, RESOLVED). String

Schema changes #

Date Action
2026-01-02 Table added to tracking