AWS Security Hub updates #4531
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| --- | ||
| applies_to: | ||
| stack: preview 9.3 | ||
| serverless: | ||
| security: preview | ||
| products: | ||
| - id: security | ||
| - id: cloud-serverless | ||
| --- | ||
|
|
||
| # AWS Security Hub | ||
| This integration uses the AWS Security Hub API to ingest vulnerability findings which appear in Elastic’s native vulnerability workflows. This page explains how to make data from the AWS Security Hub integration appear in the following places within {{elastic-sec}}: | ||
|
|
||
| - **Findings page**: Data appears on the [Vulnerabilities](/solutions/security/cloud/findings-page.md) tab. | ||
|
Contributor
There was a problem hiding this comment. The linked page is about the Misconfigurations tab. |
||
| - **Alert and Entity details flyouts**: Applicable data appears in the [Insights section](/solutions/security/detect-and-alert/view-detection-alert-details.md#insights-section). | ||
|
|
||
| In order for AWS Security Hub data to appear in these workflows: | ||
|
|
||
| * Follow the steps to [set up the AWS Security Hub integration](https://docs.elastic.co/en/integrations/aws/securityhub link invalid). | ||
| * Ensure you have `read` privileges for the `security_solution-*.vulnerabilities_latest` index. | ||
| DRAFT? * While configuring the AWS Security Hub integration, turn on **Collect AWS Security Hub Findings from AWS**. We recommend you also set the **Initial Interval** value to `2160h` (equivalent to 90 days) to ingest existing logs. | ||
|
|
||
| ::::{note} | ||
| You can ingest data from the AWS Security Hub integration for other purposes without following these steps. | ||
| :::: | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| --- | ||
| mapped_pages: | ||
| - https://www.elastic.co/guide/en/security/current/ingest-aws-securityhub-data.html | ||
| - https://www.elastic.co/guide/en/serverless/current/ingest-aws-securityhub-data.html | ||
| applies_to: | ||
| stack: all | ||
|
Contributor
There was a problem hiding this comment. I don't think we use |
||
| serverless: | ||
| security: all | ||
| products: | ||
| - id: security | ||
| - id: cloud-serverless | ||
| --- | ||
|
|
||
| # AWS Security Hub CSPM | ||
|
Check notice on line 14 in solutions/security/integrations/aws-security-hub-cspm.md
|
||
|
Contributor
There was a problem hiding this comment. Because the names of the two integrations are so similar, it might be helpful to briefly explain the difference between them. Is the difference that Security Hub ingests vulnerability findings and Security Hub CSPM ingests misconfiguration findings? If so, we could add a sentence here similar to this one ("This integration uses the AWS Security Hub API to ingest misconfiguration findings...") |
||
| This page explains how to make data from the AWS Security Hub CSPM integration appear in the following places within {{elastic-sec}}: | ||
|
|
||
| - **Findings page**: Data appears on the [Misconfigurations](/solutions/security/cloud/findings-page.md) tab. | ||
| - **Alert and Entity details flyouts**: Applicable data appears in the [Insights section](/solutions/security/detect-and-alert/view-detection-alert-details.md#insights-section). | ||
|
|
||
| In order for AWS Security Hub CSPM data to appear in these workflows: | ||
|
|
||
| * Follow the steps to [set up the AWS Security Hub CSPM integration](https://docs.elastic.co/en/integrations/aws/securityhub). | ||
| * Make sure the integration version is at least 2.31.1. | ||
| * Ensure you have `read` privileges for the `security_solution-*.misconfiguration_latest` index. | ||
| * While configuring the AWS Security Hub CSPM integration, turn on **Collect AWS Security Hub CSPM Findings from AWS**. We recommend you also set the **Initial Interval** value to `2160h` (equivalent to 90 days) to ingest existing logs. | ||
|
|
||
| :::{image} /solutions/images/security-aws-config-finding-logs.png | ||
|
Contributor
There was a problem hiding this comment. This screenshot still shows the previous integration name. |
||
| :alt: AWS Security Hub CSPM integration settings showing the findings toggle | ||
| ::: | ||
|
|
||
| ::::{note} | ||
| You can ingest data from the AWS Security Hub CSPM integration for other purposes without following these steps. | ||
| :::: | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This line is adding another redirect for a cross-cluster-search doc...Is this intentional?