By using AWS re:Post, you agree to the Terms of Use
/Security Hub and Cloudwatch Events/

Security Hub and Cloudwatch Events

0

Hi

Are there any plans to have CloudWatch events trigger automatically?
From what I understand and tested, the only way to trigger an event is to use a custom action and a manual press it. This seems very limited and would very much like something that automatically sends events when a finding is found.

The event pattern:

{
  "source": [
    "aws.securityhub"
  ]
}

only seems to trigger on manual custom actions taken from Security Hub.

We are trying to make security hub automatically create incidents in our own ticket system and not having to check every account/region for new findings.

Is this just me not getting how this works, or is there a plan to implement this?

7 Answers
0
Accepted Answer

As a general rule, we don't comment on the future direction of the service in forums, but this is something that we are closely looking at as a future feature. Stay tuned for future announcements.

answered 3 years ago
0

@AWS,
any update to make security hub automatically send findings/insights to CloudWatch? instead of 'current method of manually pressing Action button'?
We also have scenario to automatically forward insight/finding events to CloudWatch Events and NOT pressing manually 'Action' button.
This is really a nice to have and very helpful feature which makes sense.
Thanks.

Edited by: shaileshkanzariya on Apr 2, 2019 6:24 AM

answered 3 years ago
0

This capability is pushing to all regions on Thursday.

answered 3 years ago
0

Thanks a lot.
Excited to use it into our application use case.

answered 3 years ago
0

Hi Ely-AWS,
As of now, I use AWS management console (GUI) to create custom action and send findings to Cloud Watch using that Action drop down in Security Hub. But I want to do same using AWS SDK or CLI.

Is there a way I can (1) "create custom action" and (2) "send findings to Cloud Watch using created Custom Action" using "AWS SDK" or "AWS CLI"?

I referred documentation @ https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/SecurityHub.html link but could NOT find any API which allows to create custom action and api to send specific finding to cloud watch event using the action?

Appreciate your help.

answered 3 years ago
0

Yes, API support for Creating Action is something we are working on.

answered 3 years ago
0

Thanks, look forward to use API to automate further.

Edited by: shaileshkanzariya on Apr 23, 2019 7:38 AM

answered 3 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions