How to retrieve Securityhub insights into Quicksight Dashboard

Question

Hi, 
I am following step by step instructions to build AWS Security Hub analytic pipeline and visualize Security Hub data using the  link : 
https://aws.amazon.com/blogs/security/how-to-build-a-multi-region-aws-security-hub-analytic-pipeline/

The CDK solution provided in the above link is only retrieving Securityhub findings but not the insights. We would like to  see the insights as well on the Quicksight dashboard. Could you please advise on how to go about that.

Thank you

Answer

Hi.

I checked the template you used.  
The template uses the following Lambda code to send SecurityHub Finding data to S3.

https://github.com/aws-samples/aws-security-hub-analytic-pipeline/blob/main/assets/lambdas/transform_findings/index.py

You can use the same approach and write custom Lambda code that retrieves insights using the AWS SDK and outputs the desired information to S3.

You can then customize your dashboard by retrieving query results in QuickSight via Athena.

Answer

Hey!

There is also a workshop on setting up the integration between Security Hub and QuickSight.

Check it out here: https://catalog.us-east-1.prod.workshops.aws/workshops/51c37f4d-f2be-441b-b30f-5fa17b10042e

How to retrieve Securityhub insights into Quicksight Dashboard

Relevant content