AWS Security Hub

1 About the Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration parameters

About the Device

AWS Security Hub provides you with a comprehensive view of your security state in AWS and helps you check your environment against security industry standards and best practices.

Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues.

AWS Security Hub reduces the effort of collecting and prioritizing security findings across accounts, from AWS services, and AWS partner tools. The service ingests data using a standard findings format called ASFF.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Amazon Web Services
Product Name	Security Hub
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source
AWS Security Hub	AWS_SECURITY_HUB	Cloud Storage - JSON	C2C - Storage	https://cloud.google.com/chronicle/docs/reference/feed-management-api#amazon_s3

Device Configuration

Prerequisite:

AWS Config is enabled. Please refer below page to enable AWS Config: https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html
AWS Security Hub is enabled. Please refer below page to enable Security Hub: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-enable.html
Cloudwatch log group should be created. Please refer the following page to create a Cloudwatch loggroup. https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.html
Integrations with AWS services

We support two methods to ingest logs into Chronicle from AWS Security Hub. The Lambda+S3+SQS method is preferred, while the Data Firehose method is secondary.

Based on our observations, Firehose generally incurs higher costs.

Device Configuration

Method 1: Lambda+S3+SQS

Please follow below steps to forward security hub findings to Cloudwatch log group:

Navigate to Amazon EventBridge, Click Rules and click create rule.

Provide details like Name, Description, Rule type and click next.

In Build Event Pattern, select other.

For Event source, choose Event Pattern, select Security hub.
1. Choose Custom pattern (JSON editor)
2. Copy the following example pattern and paste it into the Event pattern text area. Be sure to replace the existing brackets.

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Custom Action", "Security Hub Findings – Imported"]
}

On the target screen, select AWS Service as target type. Select target as CloudWatch log group.
1. Select the Log Group.

On the review and create screen, review your configured event pattern, target and click Create rule.

If you have enabled security hub, findings will be forwarded to the provided CloudWatch log group.

As Adaptive MxDR support logging through SQS, we have to export logs from cloudwatch to S3 and attach SQS to S3 bucket. Please follow below page to automate continuous export of logs from cloudwatch loggroup to S3 bucket using lambda.

CloudWatch Log Group to S3 Bucket Export Automation using Lambda

Once logs are available in the S3 bucket, please configure SQS, please follow below step:

Follow the guide provided above for log export from Cloudwatch log group to S3 bucket.
Create SQS and attach it with S3. Please refer: Configuring AWS Simple Queue Service (SQS) with S3 Storage

Method 2: Amazon Data Firehose

Please find more details on Firehose Configuration on the below page:

Amazon Data Firehose to Chronicle: C2C-Push

Important Links:

For more details on how to get required credentials for integration parameters please refer: Get Credentials for AWS Storage
Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS:IAM User and KMS Key Policies Required for AWS
Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):
- IAM: For any logging source IAM URL should be allowed :https://docs.aws.amazon.com/general/latest/gr/iam-service.html
- S3: For S3 or SQS logging source, S3 URL should be allowed: https://docs.aws.amazon.com/general/latest/gr/s3.html
- SQS: For SQS logging source, SQS URL should be allowed:https://docs.aws.amazon.com/general/latest/gr/sqs-service.html

Integration parameters

SQS:

Parameter	Default Value	Description
REGION	N/A	Select the region of your S3 bucket
QUEUE NAME	N/A	The SQS queue name.
ACCOUNT NUMBER	N/A	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
S3 BUCKET ACCESS KEY ID	No	This is the 20 character ID associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
S3 BUCKET SECRET ACCESS KEY	No	This is the 40 character access key associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
ASSET NAMESPACE	No	To assign an asset namespace to all events that are ingested from a particular feed, set the `"namespace"` field within `details`. The `namespace` field is a string.

Integration via Amazon Data Firehose:

Configure Amazon Data Firehose on Google Chronicle instance and copy a Endpoint URL & Secret key.