Cant trigger EventBridge rule with Security Hub Findings - Imported

Is the Event Mapper correctly formatted such as in:

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "<attribute filter values>"
    }
  }
}

Check these docs as well.

https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-all-findings.html https://repost.aws/questions/QUOflWp-STRvupcKEScX6yIg/securityhub-to-eventbridge

Hi,

The issue you're facing could be due to several reasons. Here are a few things you have to check:

1. **EventBridge Rule Configuration

   • Verify that the EventBridge rule is configured correctly by checking the event patern and target settings.
   • Double-check that you have selected the correct "Event Source" as "AWS Services" and the "AWS service" as "Security Hub".
   • Ensure that the "Event Type" is set to "Security Hub Findings - Imported".
   • Confirm that the SNS topic you selected as the target is the correct one.

2. IAM Permissions

   • Make sure that the IAM role or user that you're using has the necessary permissions to create and manage EventBridge rules, SNS topics, and Security Hub findings.
   • You can refer to the AWS documentation for the required IAM permissions for EventBridge.

3. Security Hub Findings Delivery

   • Ensur that Security Hub is configured to send findings to EventBridge. By default, Security Hub sends new findings and updates to EventBridge as "Security Hub Findings - Imported" events.
   • You can check the Security Hub settings by navigating to the Security Hub console, selecting "Settings," and then verifying that the "Send findings to EventBridge" option is enabled.

4. EventBridge Rule Status

   • Check the status of the EventBridge rule in the EventBridge console. If the rule is in the "Enabled" state, it should be triggered when new "Security Hub Findings - Imported" events occur.

5. CloudWatch Logs

   • Check the CloudWatch Logs for any relevant error messages or failures related to EventBridge or Security Hub. You can find the logs in the CloudWatch console under the "/aws/events" and "/aws/securityhub" log groups.

If you've verified all the above points and are still not receiving SNS notifications, you can try creating a new EventBridge rule and SNS topic to isolate the issue further.

Kindly find couple of Reference links to revalidate your configuration:

• Security Hub Integration with EventBridge
• EventBridge IAM Permissions
• [Enabling Security Hub Findings Delivery to EventBridge](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-integration-types.html#securityhub-cwe-integration-types-eventbridge

Hope this will help.

Thanks