You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/security-hub.md
+10-8Lines changed: 10 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -136,7 +136,7 @@ To write a query and create a scheduled search, do the following:
136
136
| ComplianceStatus | Results of a compliance check. This is an optional field and its value should be one of the following: PASSED/WARNING/FAILED/NOT_AVAILABLE. |
137
137
1. The `aws_account_id` field in the search results.
138
138
1.`AWS_ACCOUNT_ID` set as a Lambda environment variable.
139
-
1. The `account_id` where the lambda function is running.
139
+
1. The `account_id` where the Lambda function is running.
140
140
141
141
The `aws_account_id` defaults to the account in which Lambda is running.
142
142
@@ -157,11 +157,11 @@ In the case of a problem, perform the following tasks to discover the cause.
157
157
}
158
158
```
159
159
2. Check for `status code 200` in the response body to verify whether the API Gateway and Lambda integration is working correctly. For more information on how to test API Gateway with console refer these [docs](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-test-method.html).
160
-
3. Monitor scheduled search logs using following query in Sumo Logic. This verifies whether the scheduled search was triggered or not.
160
+
3. Monitor scheduled search logs using the following query in Sumo Logic. This verifies whether the scheduled search was triggered or not.
4. Check the CloudWatch logs for the Lambda function. Sumo saves Lambda function logs to CloudWatch in a log group: `/aws/lambda/<function_name>`. Check this log for any errors during lambda execution.
164
+
4. Check the CloudWatch logs for the Lambda function. Sumo Logic saves Lambda function logs to CloudWatch in a log group: `/aws/lambda/<function_name>`. Check this log for any errors during lambda execution.
165
165
166
166
## Collecting findings for the AWS Security Hub CSPM app
167
167
@@ -182,7 +182,8 @@ To create an HTTP source in Sumo Logic, see [HTTP Logs and Metrics Source](/docs
182
182
183
183
#### Step 2: Configure EventBridge API destination
184
184
185
-
1. Open your Amazon EventBridge Console.
185
+
Follow the steps below to configure the EventBridge API destination:
186
+
1. Open your [Amazon EventBridge Console](https://us-east-1.console.aws.amazon.com/events/home?region=us-east-1#/).
186
187
1. In the navigation bar, click **API destinations**.
187
188
1. Click **Create destination**.
188
189
1. Enter a name for the API Destination.
@@ -191,12 +192,13 @@ To create an HTTP source in Sumo Logic, see [HTTP Logs and Metrics Source](/docs
191
192
1. Provide a connection name.
192
193
1. Keep the API Type as **Public**.
193
194
1. Select **Basic (Username/Password)** in the **Authorization type**.
194
-
1. Add any random values for **Username** and **Password**.
195
-
1. Create the connection.
195
+
1. Add any value of your choice for **Username** and **Password**.
196
196
197
197
#### Step 3: Create the EventBridge rule
198
198
199
-
1. Click **Rules** and then click **Create rule**.
199
+
Follow the steps below to configure the EventBridge rule:
200
+
1. Open your [Amazon EventBridge Console](https://us-east-1.console.aws.amazon.com/events/home?region=us-east-1#/).
201
+
1. In the navigation bar, click **Rules**.
200
202
1. Set the event source to **AWS services** and then select **Security Hub** as the AWS service.
201
203
1. Select **All Events** in Event Type.
202
204
1. Under **Select targets**, choose **EventBridge API destination**.
@@ -357,4 +359,4 @@ Use this dashboard to:
357
359
* Analyze how they are distributed across AWS accounts.
358
360
* Filter on Finding Type, Resource Type, Provider, AWS Account, Title, Category, Resource Type with the Finding details panel.
0 commit comments