Security Hub and Cloudwatch Events

Question

Hi  
  
Are there any plans to have CloudWatch events trigger automatically?  
From what I understand and tested, the only way to trigger an event is to use a custom action and a manual press it. This seems very limited and would very much like something that automatically sends events when a finding is found.  
  
The event pattern:

```
{
  "source": [
    "aws.securityhub"
  ]
}
```

only seems to trigger on manual custom actions taken from Security Hub.  
  
We are trying to make security hub automatically create incidents in our own ticket system and not having to check every account/region for new findings.  
  
Is this just me not getting how this works, or is there a plan to implement this?

Accepted Answer

As a general rule, we don't comment on the future direction of the service in forums, but this is something that we are closely looking at as a future feature. Stay tuned for future announcements.

Answer

Hi Ely-AWS,  
As of now, I use AWS management console (GUI) to create custom action and send findings to Cloud Watch using that Action drop down in Security Hub. But I want to do same using AWS SDK or CLI.  
  
Is there a way I can (1) "create custom action" and (2) "send findings to Cloud Watch using created Custom Action" using "AWS SDK" or "AWS CLI"?   
  
I referred documentation @ https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/SecurityHub.html link but could NOT find any API which allows to create custom action and api to send specific finding to cloud watch event using the action?  
  
Appreciate your help.

Answer

Yes, API support for Creating Action is something we are working on.

Answer

Thanks a lot.  
Excited to use it into our application use case.

Answer

@AWS,   
any update to make security hub automatically send findings/insights to CloudWatch? instead of 'current method of manually pressing Action button'?  
We also have scenario to automatically forward insight/finding events to CloudWatch Events and NOT pressing manually 'Action' button.  
This is really a nice to have and very helpful feature which makes sense.  
Thanks.  
  
Edited by: shaileshkanzariya on Apr 2, 2019 6:24 AM

Answer

Thanks, look forward to use API to automate further.  
  
Edited by: shaileshkanzariya on Apr 23, 2019 7:38 AM

Answer

This capability is pushing to all regions on Thursday.

Security Hub and Cloudwatch Events

Relevant content