AWS Security Hub Documentation

AWS Security Hub is a cloud security posture management service that is designed to streamline security operations with automated, continuous security best practice checks against your AWS resources. Security Hub is designed to aggregate your security alerts (i.e., findings) from various AWS services and partner products in a standardized format so that you can more easily take action on them. To help you understand your security posture in AWS, you need to integrate multiple tools and services including threat detections from Amazon GuardDuty, vulnerabilities from Amazon Inspector, sensitive data classifications from Amazon Macie, resource configuration issues from AWS Config, and AWS Partner Network Products. Security Hub helps simplify how you understand and improve your security posture with security best practice checks powered by AWS Config rules and integrations with other AWS services and partner products.

Security Hub can help you to understand your overall security posture via a consolidated security score across your AWS accounts, and assesses the security of your AWS accounts' resources via the AWS Foundational Security Best Practices standard and other compliance frameworks. It also aggregates all of your security findings from other AWS security services and APN products in a single place and format via the AWS Security Finding Format, and helps reduce your Mean Time To Remediation (MTTR) with response and remediation support. Security Hub has out-of-the-box integrations with ticketing, chat, Security Information and Event Management (SIEM), Security Orchestration Automation and Response (SOAR), threat investigation, Governance Risk and Compliance (GRC), and incident management tools to provide your users with a complete security operations workflow.

Security Hub provides you with a set of security controls called the AWS Foundational Security Best Practices standard. This is a curated set of recommended security practices vetted by our AWS security experts that either run continuously whenever there are changes to the associated resources or on a set periodic schedule. Each control has a specific severity score to help you prioritize your remediation efforts. Security Hub is regularly updated with new controls and additional service coverage. We recommend that you enable the AWS Foundational Security Best Practices standard across all of your accounts and regions.

Security Hub is designed to collect and consolidate findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, Amazon Simple Storage Service (Amazon S3) bucket policy findings from Amazon Macie, publicly-accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. AWS Security Hub is also designed to consolidate findings from other integrated AWS Partner Network (APN) security solutions. All findings are stored in Security hub for 90 days after last update date.

Traditionally, when combining security alerts into a single system, you would need to parse and normalize each data source to get it into a common format for search, analytics, and response and remediation actions. Security Hub helps eliminate these time-consuming and resource-intensive processes by introducing the AWS Security Findings Format (ASFF). With the ASFF, all of Security Hub’s integration partners (including both AWS services and external partners) are required to send their findings to Security Hub in JSON format consisting of over 1,000 available fields. This means that these security findings should be normalized before they are ingested into Security Hub, and helps eliminate the need to do any parsing and normalization yourself. The findings identify resources, severities, and timestamps in a consistent way, so that you can more easily search and take action on them.

In addition to the AWS Foundational Security Best Practices standard, Security Hub also offers additional standards aligned to industry and regulatory frameworks, such as the Payment Card Industry Data Security Standard (PCI DSS) and the Center for Internet Security (CIS) AWS Foundations Benchmark. These standards are also powered by continuous security checks.

You can update or suppress findings in near-real time with Security Hub Automation Rules. Security admins can create rules with specific criteria that can be evaluated against incoming finding and updated finding fields if matched. Use automation rules to change the severity or workflow status of specific findings, suppress them, or update their user-defined fields. 

You can create custom response, remediation, and enrichment workflows using Security Hub’s integration with Amazon EventBridge. All of Security Hub findings are sent to EventBridge, and you can create EventBridge rules that have AWS Lambda functions, AWS Step Function functions, or AWS Systems Manager Automation runbooks as their targets. These functions and runbooks can help enrich findings with additional data or take response and remediation actions on the findings. Security Hub also supports sending findings to EventBridge on demand via custom actions, so that you can have an analyst decide when to trigger a response or remediation action. The Security Hub Automated Response and Remediation (SHARR) solution provides you with prepackaged EventBridge rules for you to deploy via AWS CloudFormation.

You can connect multiple AWS accounts and consolidate findings across those accounts in the AWS Security Hub console. By designating an administrator account, you can enable your security team to see consolidated findings for your organization’s accounts, while individual account owners see only findings associated with their account. Integration with AWS Organizations allows you to enable any account in your organization with Security Hub and the AWS Foundational Security Best Practices standard.

Customize Security Hub controls in accordance with the specific security guidelines of your organization, without forgoing the benefits of using managed controls. You can modify the parameter values in many Security Hub controls, reducing the manual efforts of building and testing these across your accounts by hand, while still maintaining security scoring for them. Specify parameters such as the number of days until a resource is considered unused, specific characteristic of a password policy, or a list of high-risk ports. You can also centralize these configurations and capabilities for all or some accounts globally, without needing to update them account-by-account and Region-by-Region.

Security Hub enables you to customize your dashboard according to your specific requirements to more easily identify patterns, vulnerabilities, and threats leading to faster response. Security Hub’s dashboard features a set of AWS managed insights that were carefully chosen to reflect the modern cloud security threat landscape as observed by AWS, and guided by lessons learned from AWS’s own security operations. You can select and modify the widgets you want to display, apply and save filters to create contextual views by specific criteria, and prioritize the data and view of your organization’s security posture that fits your needs.

AWS Security Hub allows you to designate an aggregator Region and link some or all Regions to that aggregator Region to give you a centralized view of all your findings across all your accounts and all your linked Regions. After linking a Region to the aggregator Region, your findings are continuously synced between the Regions, so that any update made to a finding in one Region is replicated to the other Region. Your Security Hub administrator or delegated administrator account in your aggregator Region can view and manage all of your findings. Individual Security Hub member accounts in the aggregator Region can also view and manage all of their findings across all linked Regions. Your Amazon EventBridge feed in your administrator account and aggregator Region now also includes all your findings across all member accounts and linked Regions, which allows you to simplify integrations with ticketing, chat, incident management, logging, and auto-remediation tools by consolidating those integrations into your aggregator Region.

In addition to integrating with a selection of other AWS security services and partner products that send Security Hub findings, Security Hub also has integrations with various ticketing, chat, incident management, threat investigation, Governance Risk and Compliance (GRC), Security Orchestration Automation and Response (SOAR), and Security Information and Event Management (SIEM) tools that can receive findings from Security Hub. These integrations include AWS services such as Amazon Detective (threat investigations), AWS Audit Manager, and various partner tools such as Splunk, Slack, PagerDuty, Sumo Logic, ServiceNow ITSM, and Atlassian’s Jira Service Management. The integration with ServiceNow and Jira are bi-directional, so that any updates to tickets are synced with the findings in Security Hub.

Security Hub provides a simple 0-100 security score for each standard, for each account across all enabled standards, and a total score for all accounts associated with your administrator account. This score is based on the number of controls that have passed vs. failed for a standard, account, and/or organization. To help you monitor your security posture, security score information is presented along with other key insights, such as which resources have the most failed security checks, in summary dashboards.

You can filter findings based on fields in the AWS Security Finding Format and use GroupBy statements to aggregate findings into buckets. For example, you can filter findings to show only Critical or High severity findings and then group them by resource IDs to see which resources have the most critical or high findings. Security Hub calls these types of searches “insights”, and provides prepackaged managed insights and lets you define your own custom insights. Each insight includes a time series sparkline to show the trend over time in findings that match the insight.

For additional information about service controls, security features and functionalities, including, as applicable, information about storing, retrieving, modifying, restricting, and deleting data, please see https://docs.aws.amazon.com/index.html. This additional information does not form part of the Documentation for purposes of the AWS Customer Agreement available at http://aws.amazon.com/agreement, or other agreement between you and AWS governing your use of AWS’s services.