Sold by: Info Inlet Inc.
Deployed on AWS
Convert AWS Security Hub findings (ASFF) to OCSF and back, for OCSF 1.1 to 1.9. Every finding comes with a plain-language report of what changed and why. Runs in your AWS account on Bedrock AgentCore.
Overview
Security Finding Converter translates security findings between the AWS Security Finding Format (ASFF) used by AWS Security Hub and the Open Cybersecurity Schema Framework (OCSF) used by Amazon Security Lake, the new AWS Security Hub and most modern SIEMs. It works in both directions, as MCP tools your AI agents and automation can call.
Use it to:
- Send Security Hub, GuardDuty, Inspector and Macie findings to an OCSF-based SIEM or data lake
- Bring findings from any OCSF tool into Security Hub, ready to import
- Move your security automation to the new, OCSF-based AWS Security Hub
- Give a security operations agent one consistent format for findings from every tool
Nothing lost in translation. ASFF and OCSF do not match field for field, and hand-written converters quietly drop what does not fit. This one keeps it: a finding converted to OCSF and back returns exactly as it was. Every finding comes with a plain-language report that says what changed, why, and whether you need to act.
Ready for every destination. Supports OCSF 1.1 through 1.9, built from the official OCSF schema and updated as new versions are released. The version of each incoming finding is detected automatically, and you can target Security Hub or Security Lake by name. Aligned with AWS's published field mapping for the new Security Hub.
Private by design. Runs on Amazon Bedrock AgentCore in your own AWS account. Your findings never leave it, and nothing is stored between requests.
Works with single findings, batches, Security Hub API responses and EventBridge events as they are. Network, process, malware and threat-intelligence details are carried through exactly but not yet mapped to native OCSF fields.
Highlights
- Lossless round trip: ASFF to OCSF to ASFF returns the identical finding, tested on GuardDuty, Inspector, Macie, Access Analyzer and Security Hub control findings.
- A plain-language report on every finding says what changed, why and whether to act. Fields with no exact equivalent are kept, never silently dropped.
- OCSF 1.1 to 1.9 from the official schema, with targets for the new AWS Security Hub (1.6) and Security Lake (1.1). Runs in your own AWS account.
Details
Sold by
Categories
Delivery method
Type
Supported services
Delivery option
Amazon Bedrock AgentCore Runtime
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on a fixed subscription cost. You pay the same amount each billing period for unlimited usage of the product. Pricing is prorated, so you're only charged for the number of days you've been subscribed. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
- Monthly subscription
- $19.00/month
Vendor refund policy
Subscriptions can be cancelled at any time in AWS Marketplace and will not renew for the following month. Within 48 hours of purchase, cancelling gives a full refund, which AWS processes directly. For any other billing question, email contact@infoinlet.com with your AWS account ID and the billing period concerned. We respond within one business day and will work with you and AWS to resolve it.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Amazon Bedrock AgentCore Runtime
Supported services: Learn more
- Amazon Bedrock AgentCore
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
Initial release.
Additional details
Usage instructions
Security Finding Converter is an MCP server that converts security findings between AWS Security Finding Format (ASFF) and OCSF, in both directions. It runs in your own AWS account on Amazon Bedrock AgentCore Runtime, so your findings stay there.
-
Deploy Follow the launch instructions on your fulfillment page: create the IAM role, attach the permissions policy, and create the AgentCore runtime with the container image shown there. This server does not call any foundation model, so the Bedrock model permissions in that policy are optional. Wait for status READY.
-
Connect Call it from your agent over MCP streamable HTTP (POST /mcp) using tools/list and tools/call. The runtime endpoint uses AWS SigV4 (service bedrock-agentcore) unless you configure a JWT authorizer.
-
Tools
- convert_asff_to_ocsf: ASFF findings to OCSF
- convert_ocsf_to_asff: OCSF findings to ASFF, ready to import into Security Hub
- validate_finding: check either format without changing it
- list_mappings: field table, supported OCSF versions and the round-trip guarantee
Pass findings as exactly one of findings, text, base64_data or path. Choose the OCSF version with ocsf_version: security_hub, security_lake, latest, or a release from 1.1.0 to 1.9.0. OCSF findings that are not about an AWS account need aws_account_id and region. Each finding's report says in one sentence whether anything needs attention.
- Optional environment variables
- SFC_MAX_INPUT_BYTES: input limit in bytes, default 33554432 (32 MiB)
- SFC_SCRATCH_DIR: where large results are written, default /tmp
Support: contact@infoinlet.com
Detailed usage instructions: https://github.com/infoinlet-com/aws-marketplace-resources/blob/main/mcp/container/security_finding_converter.md
Support
Vendor support
Email contact@infoinlet.com . We reply within one business day, Monday to Friday.
The server runs in your own AWS account and sends us nothing, so a support request needs your description rather than your data. If a conversion looks wrong, send the report it returned: reports name fields and reasons and never contain a finding's values. Add the tool name and the OCSF version you asked for.
Billing and cancellation run through AWS Marketplace. What we refund directly is set out in the refund policy on this listing.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
The Wiz Model Context Protocol (MCP) Server acts as an MCP-compatible service that translates plain-language queries into Wiz-specific operations, like querying resources, or assessing risks.
Leverage the Orca Security MCP Server to connect your Orca Security Platform to query and act on your cloud security environment in natural language. The MCP Server allows customers to easily leverage their preferred AI assistants, like Claude, Cursor, ChatGPT, with no requirements for custom integrations or dashboards.
falcon-mcp enables seamless communication between AI agents and the CrowdStrike Falcon platform. Deployable directly onto Amazon Bedrock AgentCore, it provides programmatic access to Falcon data for agentic workflows and accelerating AI-native security automation.
With Vendor Rating, weeks of cloud vendor audits turn into minutes. Instantly detect risks, monitor third-party cloud environments, and make smarter decisions.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.