Findings in Amazon Security Hub
Amazon Security Hub eliminates the complexity of addressing large volumes of findings from multiple providers. It reduces the effort required to manage and improve the security of all of your Amazon Web Services accounts, resources, and workloads.
Security Hub receives findings from the following sources.
-
Security Hub checks against enabled controls. See Generating and updating control findings.
-
Integrations with Amazon Web Services that you enable. See Amazon Web Service integrations with Amazon Security Hub.
-
Integrations with third-party products that you enable. See Available third-party partner product integrations.
-
Custom integrations that you configure. See Using custom product integrations to send findings to Amazon Security Hub.
Security Hub consumes findings using a standard findings format called the Amazon Security Finding Format. For more information about the finding format, see Amazon Security Finding Format (ASFF).
Security Hub correlates the findings across integrated products to prioritize the most important ones.
Finding providers can update findings to reflect additional instances of the finding. You can update findings to provide details about your investigation and its results.
Security Hub also allows you to aggregate findings across Regions, so that you can view all of your findings from one place. See Cross-Region aggregation.