Security Hub and Cloudwatch Events
Hi
Are there any plans to have CloudWatch events trigger automatically?
From what I understand and tested, the only way to trigger an event is to use a custom action and a manual press it. This seems very limited and would very much like something that automatically sends events when a finding is found.
The event pattern:
{
"source": [
"aws.securityhub"
]
}
only seems to trigger on manual custom actions taken from Security Hub.
We are trying to make security hub automatically create incidents in our own ticket system and not having to check every account/region for new findings.
Is this just me not getting how this works, or is there a plan to implement this?
As a general rule, we don't comment on the future direction of the service in forums, but this is something that we are closely looking at as a future feature. Stay tuned for future announcements.
@AWS,
any update to make security hub automatically send findings/insights to CloudWatch? instead of 'current method of manually pressing Action button'?
We also have scenario to automatically forward insight/finding events to CloudWatch Events and NOT pressing manually 'Action' button.
This is really a nice to have and very helpful feature which makes sense.
Thanks.
Edited by: shaileshkanzariya on Apr 2, 2019 6:24 AM
Thanks a lot.
Excited to use it into our application use case.
Hi Ely-AWS,
As of now, I use AWS management console (GUI) to create custom action and send findings to Cloud Watch using that Action drop down in Security Hub. But I want to do same using AWS SDK or CLI.
Is there a way I can (1) "create custom action" and (2) "send findings to Cloud Watch using created Custom Action" using "AWS SDK" or "AWS CLI"?
I referred documentation @ https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/SecurityHub.html link but could NOT find any API which allows to create custom action and api to send specific finding to cloud watch event using the action?
Appreciate your help.
Thanks, look forward to use API to automate further.
Edited by: shaileshkanzariya on Apr 23, 2019 7:38 AM
Relevant questions
Security Hub and Cloudwatch Events
Accepted Answerasked 3 years agoHow do a trigger a reboot action on lightsail cloudwatch alarm state?
asked 2 months agoPass Cloudwatch Event Data to Lambda Function
asked 18 days agoPipeline trigger on pull request
asked 4 months agoI want to send a notification to discord when amplify's app is deployed.
asked 5 months agoCan we trigger AWS Cloudwatch event bridge from AWS config aggregator?
asked 2 months agoAWS Trigger Automation from CloudWatch scheduled event
asked 3 years agoWhere to see RabbitMQ maintenance events? And can maintenance trigger some kind of notification?
asked 5 months agoCloud Watch Event Integration With Third Party Tool
Accepted Answerasked 5 months agoInvoke specified CloudWatch Rule on MediaConvert Event
asked 3 years ago