securityhub notification when scores drop to a certain percent

Hello,

You can check this blog post https://aws.amazon.com/blogs/security/how-to-set-up-a-recurring-security-hub-summary-email/

Hope this helps!

AWS Security Hub does not currently have a built-in feature to directly send notifications or alerts based on changes in the overall Security Score. However, you can achieve this functionality by leveraging other AWS services in combination with Security Hub.

Here's a general approach you could follow:

1. Use AWS Lambda and Security Hub Custom Insight:

   • Create an AWS Lambda function that retrieves the overall Security Hub Score periodically (e.g., every hour or every day).
   • Within the Lambda function, compare the current Security Score with the desired threshold (e.g., 80%).
   • If the score drops below the threshold, send an email notification using Amazon Simple Notification Service (SNS).

2. Use AWS CloudWatch Events and EventBridge:

   • Configure Security Hub to send findings to an EventBridge event bus.
   • Create a CloudWatch Event Rule that monitors for specific Security Hub findings related to the overall score.
   • Associate the CloudWatch Event Rule with an AWS Lambda function or an SNS topic.
   • When the event rule is triggered (e.g., when the overall score drops below the threshold), it will invoke the Lambda function or send a notification to the SNS topic.

3. Use AWS CloudTrail and CloudWatch Log:

   • Enable CloudTrail logging for Security Hub.
   • Create a CloudWatch Logs Metric Filter to monitor for specific log entries related to the overall Security Score.
   • Configure a CloudWatch Alarm based on the metric filter, which will trigger an SNS notification when the alarm is in the ALARM state (i.e., when the score drops below the threshold).

All of these approaches require some custom coding or configuration, as Security Hub does not provide a built-in notification mechanism based on the overall Security Score out of the box. The choice between these approaches depends on your specific requirements, such as the desired notification frequency, the level of customization needed, and your familiarity with the different AWS services involved.