Configuring an EventBridge rule for Security Hub findings

There's an issue with your EventBridge rule pattern. Security Hub automatically sends all new findings and updates to existing findings to EventBridge as "Security Hub Findings - Imported" events, not "Security Hub Findings" as you've specified in your rule.

To fix this, you should update your event pattern to:

{
"source": ["aws.securityhub"],
"detail-type": ["Security Hub Findings - Imported"]
}

Each "Security Hub Findings - Imported" event contains a single finding, and these events are generated by BatchImportFindings and BatchUpdateFindings operations.

If you want to filter for specific types of findings, you can add a "detail" section to your event pattern with attribute filter values. For example, you might want to filter based on severity or specific finding attributes.

Also, ensure that:

1. Your SNS topic is properly configured with the appropriate subscriptions
2. The EventBridge rule has the correct permissions to publish to your SNS topic
3. You're checking for notifications in the correct AWS account (for administrator accounts, the event feed includes findings from both their account and member accounts)
   Sources
   Configuring an EventBridge rule for Security Hub CSPM findings - AWS Security Hub
   Security Hub CSPM event types in EventBridge - AWS Security Hub