AWS - Security Hub v2
Use the AWS Security Hub V2 integration to import, manage, and retrieve unified security and compliance findings across your cloud environments.
- Category
- IT Services
- Pack
- AWS-SecurityHub
Configuration parameters
- region — AWS Default Region (required)
- credentials — Access Key
- role_arn — Role Arn
- role_session_name — Role Session Name
- session_duration — Role Session Duration
- timeout — Timeout
- retries — Retries
- endpoint_url — PrivateLink service URL.
- sts_endpoint_url — STS PrivateLink URL.
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
- isFetch — Fetch incidents
- incidentFetchInterval — Incidents Fetch Interval
- incidentType — Incident type
- first_fetch — First fetch time
- max_fetch — Maximum number of incidents per fetch
- min_severity — Minimum severity to fetch
- fetch_filters — Additional fetch filters
- mirror_direction — Incident Mirroring Direction
- resolve_finding — Resolve finding of closed incident from Cortex XSOAR in AWS Security Hub
Commands (7)
- aws-securityhub-v2-findings-batch-update — Updates one or more AWS Security Hub V2 findings in a single batch request. Findings are targeted by metadata_uids and/or finding_identifiers. Required IAM Permission: securityhub:BatchUpdateFindingsV2.
- aws-securityhub-v2-findings-get — Retrieves a list of OCSF-formatted findings from AWS Security Hub V2. Required IAM Permission: securityhub:GetFindingsV2.
- aws-securityhub-v2-security-hub-disable — Disables AWS Security Hub V2 for the configured account and region. Required IAM Permission: securityhub:DisableSecurityHubV2.
- aws-securityhub-v2-security-hub-enable — Enables AWS Security Hub V2 for the configured account and region. Required IAM Permission: securityhub:EnableSecurityHubV2.
- get-mapping-fields — Returns the list of fields available for outgoing mirroring. This command is used for mirroring and is not intended to be run manually.
- get-remote-data — Returns the updated data of a single mirrored AWS Security Hub V2 finding. This command is used for mirroring and is not intended to be run manually.
- update-remote-system — Pushes local (Cortex XSOAR) incident changes to the corresponding AWS Security Hub V2 finding. This command is used for mirroring and is not intended to be run manually.