How to receive email alert when compliance status changes to failed for particular test in security hub

1

Hi, recently start exploring about security hub, but I was just wondering, is it possible to through anyway if we can receive an email for a particular test case if the compliance status for that test case changes to failed? for eg: one test case from foundation best practice, that no EC2 instance should alot with public IP. so I want to get an alert if this test case gets failed, as someone launched an instance with public IP.

So if there is any way possible to achieve this, please let me know, any kind of help will be appreciable.

2 回答
1
已接受的回答

Security Hub automatically sends all new findings and all updates to existing findings to EventBridge as EventBridge events. You can also create custom actions that allow you to send selected findings and insight results to EventBridge.

So what you can do is configure an EventBridge rule for the specific finding that you're interested in and hook that up to an SNS topic and subscribe to that topic with your email address. There is a section in the documentation (Configuring an EventBridge rule for automatically sent findings) that talks about how to do this for Security Hub. There's a link in that documentation as well to the more general documentation around creating EventBridge rules: Creating Amazon EventBridge rules that react to events

profile pictureAWS
已回答 2 年前
0

You can use this code for the above solution. https://asecure.cloud/a/detect-securityhub-findings/

已回答 1 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则