AWS Security Hubに集約した検出結果を流量制御しながらTeamsに通知する仕組み

AWSTemplateFormatVersion: 2010-09-09

### ------------------------------------------------------------
### Description Section
### ------------------------------------------------------------
Description: SecurityHubNotifications

## ------------------------------------------------------------
## Parameters Section
## ------------------------------------------------------------
Parameters:
  SecurityHubTeamsWebHookUrl:
    Type: String
    Description: |
      (Require) Enter WebHookUrl for Teams(Securityhub).
    Default: https://xxx.com
  SleepTimeNotifySecurityhubFunc:
    Type: String
    Description: |
      (Require) Enter SleepTime for NotifySecurityhubFunc.
    Default: 96
  SecurityHubMailSNSArn:
    Type: String
    Description: |
      (Require) Enter SNSArn.
    Default: arn:aws:sns:ap-northeast-1:XXXXXXXXXX:XXXXX
  SecurityHubIntegrationGuardDuty:
    Type: String
    Description: |
      Select SecurityHub ProductName
    AllowedValues:
      - GuardDuty
      - ""
    Default: GuardDuty
  SecurityHubIntegrationConfig:
    Type: String
    Description: |
      Select SecurityHub ProductName
    AllowedValues:
      - Config
      - ""
    Default: Config
  SecurityHubIntegrationAccessAnalyzer:
    Type: String
    Description: |
      Select SecurityHub ProductName
    AllowedValues:
      - IAM Access Analyzer
      - ""
    Default: IAM Access Analyzer

## ------------------------------------------------------------
## Conditions Section
## ------------------------------------------------------------
Conditions:
  SecurityHubProductValue1: !Equals [!Ref SecurityHubIntegrationGuardDuty, "GuardDuty"]
  SecurityHubProductValue2: !Equals [!Ref SecurityHubIntegrationConfig, "Config"]
  SecurityHubProductValue3: !Equals [!Ref SecurityHubIntegrationAccessAnalyzer, "IAM Access Analyzer"]

### ------------------------------------------------------------
### Resources Section
### ------------------------------------------------------------
Resources:
  # ------------------------------------------------------------#
  #  EventBridge & DeadLetterQueue
  # ------------------------------------------------------------#
  SecurityHubEventToSQSEvent:
    Type: AWS::Events::Rule
    Properties:
      Name: securityhubevent-sqs
      EventPattern:
        source:
          - "aws.securityhub"
          - "EventBridge.retry"
        detail-type:
          - "Security Hub Findings - Imported"
        detail:
          findings:
            AwsAccountId:
              - !Sub ${AWS::AccountId}
            Compliance:
              Status:
                - FAILED
                - WARNING
                - NOT_AVAILABLE
            ProductName:
              - "Security Hub"
            Severity:
              Label:
                - CRITICAL
                - HIGH
            Workflow:
              Status:
                - NEW
            RecordState:
              - ACTIVE

      Targets:
        - Arn: !GetAtt SqsSecurityHub.Arn
          Id: AWSSecurityHub_Queue
          DeadLetterConfig:
            Arn: !GetAtt SqsEventBridgeDlq.Arn
          RetryPolicy:
            MaximumEventAgeInSeconds: 120
            MaximumRetryAttempts: 30

  GuardDutyEventToSQSEvent:
    Condition: SecurityHubProductValue1
    Type: AWS::Events::Rule
    Properties:
      Name: securityhub-guarddutyevent-sqs
      EventPattern:
        source:
          - "aws.securityhub"
          - "EventBridge.retry"
        detail-type:
          - "Security Hub Findings - Imported"
        detail:
          findings:
            AwsAccountId:
              - !Sub ${AWS::AccountId}
            ProductName:
              - !Sub ${SecurityHubIntegrationGuardDuty}
            Severity:
              Label:
                - CRITICAL
                - HIGH
            Workflow:
              Status:
                - NEW
            RecordState:
              - ACTIVE

      Targets:
        - Arn: !GetAtt SqsSecurityHub.Arn
          Id: AWSSecurityHub_Queue
          DeadLetterConfig:
            Arn: !GetAtt SqsGuardDutyEventBridgeDlq.Arn
          RetryPolicy:
            MaximumEventAgeInSeconds: 120
            MaximumRetryAttempts: 30

  ConfigEventToSQSEvent:
    Condition: SecurityHubProductValue2
    Type: AWS::Events::Rule
    Properties:
      Name: securityhub-configevent-sqs
      EventPattern:
        source:
          - "aws.securityhub"
          - "EventBridge.retry"
        detail-type:
          - "Security Hub Findings - Imported"
        detail:
          findings:
            AwsAccountId:
              - !Sub ${AWS::AccountId}
            Compliance:
              Status:
                - FAILED
                - WARNING
                - NOT_AVAILABLE
            ProductName:
              - !Sub ${SecurityHubIntegrationConfig}
            Workflow:
              Status:
                - NEW
            RecordState:
              - ACTIVE

      Targets:
        - Arn: !GetAtt SqsSecurityHub.Arn
          Id: AWSSecurityHub_Queue
          DeadLetterConfig:
            Arn: !GetAtt SqsConfigEventBridgeDlq.Arn
          RetryPolicy:
            MaximumEventAgeInSeconds: 120
            MaximumRetryAttempts: 30

  IAMAccessAnalyzerEventToSQSEvent:
    Condition: SecurityHubProductValue3
    Type: AWS::Events::Rule
    Properties:
      Name: securityhub-iamaccessanalyzerevent-sqs
      EventPattern:
        source:
          - "aws.securityhub"
          - "EventBridge.retry"
        detail-type:
          - "Security Hub Findings - Imported"
        detail:
          findings:
            AwsAccountId:
              - !Sub ${AWS::AccountId}
            ProductName:
              - !Sub ${SecurityHubIntegrationAccessAnalyzer}
            Workflow:
              Status:
                - NEW
            RecordState:
              - ACTIVE

      Targets:
        - Arn: !GetAtt SqsSecurityHub.Arn
          Id: AWSSecurityHub_Queue
          DeadLetterConfig:
            Arn: !GetAtt SqsIAMAccessAnalyzerEventBridgeDlq.Arn
          RetryPolicy:
            MaximumEventAgeInSeconds: 120
            MaximumRetryAttempts: 30

  #Eventbridge DeadLetterQueue
  SqsEventBridgeDlq:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: sqs-securityhubevent-eventbridge-dlq-01
      DelaySeconds: 0
      MaximumMessageSize: 262144
      MessageRetentionPeriod: 1209600
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 30

  SqsEventBridgeDlqPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref SqsEventBridgeDlq
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: SQS:SendMessage
            Resource: !GetAtt SqsEventBridgeDlq.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt SecurityHubEventToSQSEvent.Arn

  SqsGuardDutyEventBridgeDlq:
    Condition: SecurityHubProductValue1
    Type: AWS::SQS::Queue
    Properties:
      QueueName: sqs-securityhub-guarddutyevent-eventbridge-dlq-01
      DelaySeconds: 0
      MaximumMessageSize: 262144
      MessageRetentionPeriod: 1209600
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 30

  SqsGuardDutyEventBridgeDlqPolicy:
    Condition: SecurityHubProductValue1
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref SqsGuardDutyEventBridgeDlq
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: SQS:SendMessage
            Resource: !GetAtt SqsGuardDutyEventBridgeDlq.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt GuardDutyEventToSQSEvent.Arn

  SqsConfigEventBridgeDlq:
    Condition: SecurityHubProductValue2
    Type: AWS::SQS::Queue
    Properties:
      QueueName: sqs-securityhub-configevent-eventbridge-dlq-01
      DelaySeconds: 0
      MaximumMessageSize: 262144
      MessageRetentionPeriod: 1209600
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 30

  SqsConfigEventBridgeDlqPolicy:
    Condition: SecurityHubProductValue2
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref SqsConfigEventBridgeDlq
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: SQS:SendMessage
            Resource: !GetAtt SqsConfigEventBridgeDlq.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt ConfigEventToSQSEvent.Arn

  SqsIAMAccessAnalyzerEventBridgeDlq:
    Condition: SecurityHubProductValue3
    Type: AWS::SQS::Queue
    Properties:
      QueueName: sqs-securityhub-iamaccessanalyzerevent-eventbridge-dlq-01
      DelaySeconds: 0
      MaximumMessageSize: 262144
      MessageRetentionPeriod: 1209600
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 30

  SqsIAMAccessAnalyzerEventBridgeDlqPolicy:
    Condition: SecurityHubProductValue3
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref SqsIAMAccessAnalyzerEventBridgeDlq
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: SQS:SendMessage
            Resource: !GetAtt SqsIAMAccessAnalyzerEventBridgeDlq.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt IAMAccessAnalyzerEventToSQSEvent.Arn

  # ------------------------------------------------------------#
  #  SQS & DeadLetteQueue
  # ------------------------------------------------------------#
  SqsSecurityHub:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: sqs-securityhubevent-lambda-01
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt SqsSecurityHubDlq.Arn
        maxReceiveCount: 5
      DelaySeconds: 1
      MaximumMessageSize: 262144
      MessageRetentionPeriod: 1209600
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 720

  SqsSecurityHubPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref SqsSecurityHub
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: SQS:SendMessage
            Resource: !GetAtt SqsSecurityHub.Arn
            Condition:
              ArnEquals:
                aws:SourceArn:
                  - !GetAtt SecurityHubEventToSQSEvent.Arn
                  - !GetAtt GuardDutyEventToSQSEvent.Arn
                  - !GetAtt ConfigEventToSQSEvent.Arn
                  - !GetAtt IAMAccessAnalyzerEventToSQSEvent.Arn
          - Effect: Allow
            Principal:
              Service: sqs.amazonaws.com
            Action:
              - SQS:SendMessage
              - SQS:ReceiveMessage
            Resource: !GetAtt SqsSecurityHub.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt SqsSecurityHubDlq.Arn

  SqsSecurityHubDlq:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: sqs-securityhubevent-lambda-dlq-01
      DelaySeconds: 0
      MaximumMessageSize: 262144
      MessageRetentionPeriod: 1209600
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 30

  SqsSecurityHubDlqPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref SqsSecurityHubDlq
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: sqs.amazonaws.com
            Action:
              - SQS:SendMessage
              - SQS:ReceiveMessage
            Resource: !GetAtt SqsSecurityHubDlq.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt SqsSecurityHub.Arn
  # ------------------------------------------------------------#
  #  Lambda
  # ------------------------------------------------------------#
  # SecurityHubEvent
  SecurityHubEventFunc:
    Type: AWS::Lambda::Function
    DependsOn: SecurityHubEventFuncLogs
    Properties:
      Code:
        ZipFile: |
          #impoort library
          import boto3
          import botocore
          import datetime
          import json
          import os
          import sys
          import time

          from botocore.exceptions import ClientError
          from urllib.error import HTTPError, URLError
          from urllib.request import Request, urlopen

          #client make
          securityhub = boto3.client('securityhub')
          sns = boto3.client('sns')

          #environ
          HOOK_URL = os.environ['TeamsWebHookUrl']
          TOPIC_ARN = os.environ['SNSTopicArn']
          SLEEP_TIME =  int(os.environ['SleepTime'])
                                          
          #######################################
          # Funtion：Teams notification
          #######################################
          def notification_teams(message):
              msg = json.loads(message)
              product_name = msg['detail']['findings'][0]['ProductName']
              event_id = msg['detail']['findings'][0]['Id']
              event_title = msg['detail']['findings'][0]["Title"]
              event_description =  msg['detail']['findings'][0]['Description']
              resource = msg['detail']['findings'][0]['Resources'][0]['Id']
              account_id = msg['detail']['findings'][0]['AwsAccountId']
              region = msg['detail']['findings'][0]['Region']
              event_time = msg['detail']['findings'][0]['UpdatedAt']
              
              teams_msg = {
                  'title': "SecurityHub Event Nortify",
                  'text': "**ProductName:** %s<br>**AlarmID:** %s<br>**Title:** %s<br>**Description:** %s<br>**Resource:** %s<br>**AccountID:** %s<br>**Region:** %s<br>**AlarmTime:** %s" % (product_name, event_id, event_title, event_description, resource, account_id, region, parse_date(event_time))
              }
              req = Request(HOOK_URL, json.dumps(teams_msg).encode('utf-8'))
              try:
                  print('======================== Notify a message to Teams ====================')
                  print("Notify Teams Message: " + str(teams_msg))
                  response = urlopen(req)
                  responsecheck = response.read()
                  if b'Webhook message delivery failed with error' in responsecheck:
                      print('ERROR:%s. ' % (responsecheck))
                      return False
                  print("Successfully posted Message to Teams")
                  return None
              except HTTPError as e:
                  print("Request failed: %d %s" %(e.code, e.reason))
                  return False
              except URLError as e:
                  print("Server connection failed: %s" % e.reason)
                  return False

          #######################################
          # Funtion：Securityhub workflowstatus change
          #######################################
          def change_securityhub_workflowstatus(SQS_message):
              print('======================== Get Securityhub information from SQS message ====================')
              Securityhub = json.loads(SQS_message)
              Securityhub_Id = Securityhub['detail']['findings'][0]['Id']
              Securityhub_ProductArn = Securityhub['detail']['findings'][0]['ProductArn']
              print("Securityhub Id: %s \nSecurityhub Arn: %s"% (Securityhub_Id, Securityhub_ProductArn))
              try:
                  print('======================== Change the Securityhub workflow status to Notified ====================')
                  print("Change to Notified Securityhub Id: %s \nChange to Notified Securityhub Arn: %s"% (Securityhub_Id, Securityhub_ProductArn))
                  securityhub.batch_update_findings(
                      FindingIdentifiers=[
                          {
                              'Id': Securityhub_Id,
                              'ProductArn': Securityhub_ProductArn,
                          },
                      ],
                      Workflow={
                          'Status': 'NOTIFIED'
                      },
                  )
                  print("Successfully changed Securityhub workflow status to Notified")
                  return None
              except botocore.exceptions.ClientError as e:
                  print('ERROR:%s. ' % (e))
                  return False


          #######################################
          # Funtion：SNS notification
          #######################################
          def notification_sns(message):
              msg = json.loads(message)

              product_name = msg['detail']['findings'][0]['ProductName']
              event_id = msg['detail']['findings'][0]['Id']
              event_title = msg['detail']['findings'][0]["Title"]
              event_description =  msg['detail']['findings'][0]['Description']
              resource = msg['detail']['findings'][0]['Resources'][0]['Id']
              account_id = msg['detail']['findings'][0]['AwsAccountId']
              region = msg['detail']['findings'][0]['Region']
              event_time = msg['detail']['findings'][0]['UpdatedAt']

              sns_msg = "ProductName: " + product_name + "\n" + "AlarmID: " + event_id + "\n" + "Title: " + event_title + "\n" + "Description: " + event_description + "\n" + "Resource: " + resource + "\n" + "AccountID: " + account_id + "\n" + "Region: " + region + "\n" + "AlarmTime: " + parse_date(event_time)
              subject = "SecurityHub Event Nortify"

              try:
                  print('======================== Notify a message to SNS ====================')
                  print("Notify SNS Message: \n" + str(sns_msg))
                  sns.publish(TopicArn=TOPIC_ARN, Message=sns_msg, Subject=subject)
                  print("Successfully posted Message to SNS")
                  return None
              except botocore.exceptions.ClientError as e:
                  print('ERROR:%s. ' % (e))
                  return False
                  
          #######################################
          # Funtion：Parse Date
          #######################################
          def parse_date(event_time, date_format='%Y/%m/%d %H:%M:%S'):
              time = datetime.datetime.strptime(event_time, '%Y-%m-%dT%H:%M:%S.%f%z')
              time += datetime.timedelta(hours=9)
              return time.strftime(date_format)
              
          #######################################
          # Main
          #######################################
          def lambda_handler(event, context): 
              print('======================== MAIN ====================')
              SQS_message = event['Records'][0]['body']
              print("Securityhub Error : " + str(SQS_message))
              print('======================== Securityhub Error notify to Teams ====================')
              if notification_teams(SQS_message) is not None:
                  print('======================== Securityhub Error notify to SNS ====================')
                  if notification_sns(SQS_message) is not None:
                      time.sleep(SLEEP_TIME)
                      return False

              print('======================== Change the Securityhub workflow status ====================')
              if change_securityhub_workflowstatus(SQS_message) is not None:
                  time.sleep(SLEEP_TIME)
                  return False

              time.sleep(SLEEP_TIME)

      FunctionName: securityhub-notify-func
      Handler: index.lambda_handler
      Role: !GetAtt LambdaforSecurityHubEventRole.Arn
      Runtime: python3.8
      MemorySize: 128
      EphemeralStorage:
        Size: 512
      Timeout: 120
      Environment:
        Variables:
          TeamsWebHookUrl: !Sub ${SecurityHubTeamsWebHookUrl}
          SNSTopicArn: !Sub ${SecurityHubMailSNSArn}
          SleepTime: !Sub ${SleepTimeNotifySecurityhubFunc}

  LambdaforSecurityHubEventRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: securityhub-notify-func-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: securityhub-notify-func-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !GetAtt SecurityHubEventFuncLogs.Arn
              - Effect: "Allow"
                Action:
                  - sqs:ReceiveMessage
                  - sqs:DeleteMessage
                  - sqs:GetQueueAttributes
                Resource: !GetAtt SqsSecurityHub.Arn
              - Effect: "Allow"
                Action:
                  - securityhub:BatchUpdateFindings
                Resource: !Sub arn:aws:securityhub:${AWS::Region}:${AWS::AccountId}:hub/default
              - Effect: "Allow"
                Action:
                  - sns:Publish
                Resource: !Sub ${SecurityHubMailSNSArn}

  SecurityHubEventFuncEventSourceMapping:
    Type: AWS::Lambda::EventSourceMapping
    Properties:
      BatchSize: 1
      Enabled: true
      EventSourceArn: !GetAtt SqsSecurityHub.Arn
      FunctionName: !GetAtt SecurityHubEventFunc.Arn
      FunctionResponseTypes:
        - ReportBatchItemFailures
      ScalingConfig:
        MaximumConcurrency: 2

  # ------------------------------------------------------------#
  #  CloudWatch Logs
  # ------------------------------------------------------------#
  SecurityHubEventFuncLogs:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Retain
    Properties:
      LogGroupName: /aws/lambda/securityhub-notify-func
      RetentionInDays: 90

 

## Lambdaのログから Teams通知成功のメッセージをカウント
root@1922c7e1be9d:/infra# aws logs filter-log-events --log-group-name /aws/lambda/securityhub-notify-func  --start-time `TZ=Asia/Tokyo date --date='2023-03-24 20:45:00.000' +%s%3N` \
--filter-pattern "Successfully posted Message to Teams" \
--query "events[].[message]" \
--output text | grep ^S | wc -l
117
root@1922c7e1be9d:/infra# 

## Lambdaのログから SNS(メール)通知成功のメッセージをカウント
root@1922c7e1be9d:/infra# aws logs filter-log-events --log-group-name /aws/lambda/securityhub-notify-func --start-time `TZ=Asia/Tokyo date --date='2023-03-24 20:45:00.000' +%s%3N` \
---filter-pattern "Successfully posted Message to SNS" \
--query "events[].[message]" \
--output text | grep ^S | wc -l 
0
root@1922c7e1be9d:/infra# 

　# DLQ message投入※実際に定義する際にはEventBridgeのDLQも定義
  SQSSecurityHubEventDLQApproximateNumberOfMessagesVisibleAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: sqs-securityhubevent-dlq-alarm
      Namespace: AWS/SQS
      # MetricName: NumberOfMessagesReceived
      MetricName: ApproximateNumberOfMessagesVisible
      Statistic: Sum
      Period: 300
      Dimensions:
        - Value: !GetAtt SqsSecurityHubDlq.QueueName
          Name: QueueName
      Threshold: 0
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      DatapointsToAlarm: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Sub ${SecurityHubMailSNSArn}
      OKActions:
        - !Sub ${SecurityHubMailSNSArn}
      InsufficientDataActions: []
  # SQSのイベント滞留
  SQSSecurityHubEventLambdaApproximateAgeOfOldestMessageOver1hourAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: sqs-securityhubevent-approximateageofoldestmessage-over1hour-alarm
      Namespace: AWS/SQS
      # MetricName: NumberOfMessagesReceived
      MetricName: ApproximateAgeOfOldestMessage
      Statistic: Maximum
      Period: 300
      Dimensions:
        - Value: !GetAtt SqsSecurityHub.QueueName
          Name: QueueName
      Threshold: 100
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      DatapointsToAlarm: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Sub ${SecurityHubMailSNSArn}
      OKActions:
        - !Sub ${SecurityHubMailSNSArn}
      InsufficientDataActions: []
　♯ Lambda関数エラー
  LambdaFuncErrorsAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: lambda-securityhub-notify-func-errors-alarm
      Namespace: AWS/Lambda
      MetricName: Errors
      Statistic: Sum
      Period: 300
      Dimensions:
        - Value: securityhub-notify-func
          Name: FunctionName
      Threshold: 0
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      DatapointsToAlarm: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Sub ${SecurityHubMailSNSArn}
      InsufficientDataActions: []