Filter aws_securityhub_findings by active record_state and created_at conditions

CloudQuery Plugins
1

Regarding the AWS table aws_securityhub_findings (CloudQuery Documentation), I would like to filter the findings with record_state of active only.

How do I write the filter?

Update 1

Let me test with

table_options:
  aws_securityhub_findings:
    get_findings:
      - filters:
          created_at:
          - date_range:
              unit: DAYS
              value: 7
          record_state:
          - value: ACTIVE
            comparison: EQUALS

My other question is, will the two filter conditions be and or or conditions?

  • created_at (createAt)
  • record_state (recordState)
2

It’s not explicitly stated, but I think the filter conditions will be an AND in this case AWS Security Hub Finding Filters Documentation

3

To add to @herman’s reply, we link to AWS Security Hub API Reference: Get Findings from CloudQuery AWS Plugin Documentation and we pass the filters to the AWS Go SDK. Based on the AWS docs, it seems the logic for filters is AND.

4

with test result, it is an AND condition.