Connecting Security Controls to Standards Controls to Findings in the Security Hub API

Question

I'm trying to create a view similar to the controls view in Security Hub.  I can see there's a way to connect standards to standards controls, and standards to security controls, but I can't figure out how to reliably connect security controls to standards controls.  Is there a good way to figure out which standards control belongs to which security control?

Similarly, while findings tend to consistently have security control ids, they don't always have Associated Standards or Related Requirements.  Is there a consistent way of connecting findings to standards controls?

Answer

Hello,

We can use filters in 'get-findings' API call to list security controls from specific Security Standard. Below is an example which returns findings for the PCI DSS standard:

aws securityhub get-findings \
    --filters '{"GeneratorId":[{"Value": "pci-dss","Comparison":"PREFIX"}]}' \
    --max-items 1

You may use filters as per your requirement to filter controls based for specific standard. Please refer document [1] for deeper insight of filters to GetFindings API call.

==== Reference ====

[1] https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-findings.html

Connecting Security Controls to Standards Controls to Findings in the Security Hub API

Conteúdo relevante