AWS Security Hub Event Collector

Details

ID	`AWS Security Hub Event Collector`
Provider	Amazon
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/boto3py3:1.0.0.10221838`
Supported Modules	Agentix XSIAM

README

An XSIAM event collector for AWS Security Hub.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure AWS Security Hub Event Collector in Cortex

Parameter	Description	Required
AWS Default Region		True
Role Arn		False
Access Key		False
Secret Key		False
First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)		False
Role Session Name		False
Role Session Duration		False
Max events per fetch	The maximum number of events to retrieve for each event type (up to 10000 events). For more information about event types, see the help section.	False
Timeout	The time in seconds until a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 second will be used.	False
Retries	The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

aws-securityhub-get-events

Fetch events from AWS Security Hub.

Base Command

aws-securityhub-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum results to return.	Optional
start_time	Start time for filtering events (e.g., 2023-01-01T00:00:00Z, ‘3 days ago’, ‘yesterday’).	Optional
end_time	End time for filtering events (e.g., 2023-01-01T23:59:59Z, ‘1 hour ago’, ‘now’).	Optional

Configuration parameters

default_region — AWS Default Region (required)
role_arn — Role Arn
credentials — Access Key
first_fetch — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
role_session_name — Role Session Name
role_session_duration — Role Session Duration
max_fetch — Max events per fetch
timeout — Timeout
retries — Retries
sts_regional_endpoint — AWS STS Regional Endpoints
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

aws-securityhub-get-events
Fetch events from AWS Security Hub.

Source

AWSSecurityHubEventCollector.py AWSSecurityHubEventCollector_test.py AWSSecurityHubEventCollector.yml AWSSecurityHubEventCollector_description.md

Download History Raw

For detailed instructions about setting up authentication, see: [AWS Integrations - Authentication](https://xsoar.pan.dev/docs/reference/articles/aws-integrations---authentication).

#### Configure the AWS Security Hub Integration on Cortex XSIAM
- Role Arn: The Amazon Resource Name (ARN) role used for EC2 instance authentication. If this is used, an access key and secret key are not required. (For example: arn:aws:iam::<account-no>:role/xsoar-IAM.integration-Role).
- Role Session Name: A descriptive name for the assumed role session. For example, xsiam-IAM.integration-Role_SESSION.
- Role Session Duration: The maximum length of each session in seconds. Default: 900 seconds. The integration will have the permissions assigned only when the session is initiated and for the defined duration.
- Access Key: The access key ID used for authentication, that was configured during IAM user configuration. If this is used, Role ARN is not required.
- Secret Key: The secret key used for authentication, that was configured during IAM user configuration. If this is used, Role ARN is not required.
- Security Hub Incidents Severity Level: Severity level of fetched incidents. Could be Low, Medium and High. For example, if you set the severity level to Medium, only findings with severity level Medium or High will be fetched.
- Additional Incidents Filters: A comma-separated list of additional incident filters in the form 'name=name1,value=value1,comparison=comparison1
- Change findings workflow to 'NOTIFIED': Notify the resource owner about the security issue. You can use this status when you are not the resource owner, and you need intervention from the resource owner in order to resolve a security issue.