AWS Security Hub Overview

AWS Security Hub provides you with automated security controls called the AWS Foundational Security Best Practices standard that either run continuously whenever changes to the associated resources or on a set periodic schedule. Each control has a specific severity score to help you prioritize your remediation efforts. Security Hub also offers additional standards aligned to industry and regulatory frameworks, such as the PCI DSS and the CIS AWS Foundations Benchmark.

Security Hub automatically collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, Amazon Simple Storage Service (Amazon S3) bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. AWS Security Hub consolidates findings from dozens of integrated AWS Partner Network (APN) security solutions.

With the AWS Security Findings Format, all of Security Hub’s integration partners (including both AWS services and external partners) send their findings to Security Hub in a well-typed JSON format consisting of over 1,000 available fields. This means you don’t need to do any parsing and normalization yourself.

From anIntegration with AWS Organizations allows you to automatically enable any account in your organization with Security Hub and the AWS Foundational Security Best Practices standard.  administrator account, you can enable your security team to see consolidated findings for all accounts, while individual account owners see only findings associated with their acc

AWS Security Hub provides a simple 0-100 security score for each standard, for each account across all enabled standards, and a total score for all accounts associated with your administrator account. This score is based on the number of controls passed vs. failed for a standard, history, and/or organization.

You can filter findings based on fields in the AWS Security Finding Format and use GroupBy statements to aggregate findings into buckets.  You can decide to show only Critical or High severity findings and then group them by resource IDs to see which resources have the most critical or high findings.