Amazon Inspector 与 Amazon Security Hub CSPM 集成
Security Hub 可提供 Amazon 中安全状况的全面视图。这将帮助您根据安全行业标准和最佳实践来检查您的环境。Security Hub 从 Amazon 账户、服务和其他受支持产品中收集安全数据。您可以使用此信息来分析安全趋势并确定安全问题。当您激活 Amazon Inspector 与 Security Hub 的集成时，Amazon Inspector 可以将扫描结果发送到 Security Hub，Security Hub 可以将这些扫描结果作为安全状况的一部分进行分析。
Security Hub 将以结果的形式追踪安全问题。有些调查发现可能是由在其他 Amazon 服务或第三方产品中检测到的安全问题产生的。Security Hub 使用一套规则来检测安全问题和生成调查发现，并通过提供工具来帮助您管理调查发现。Amazon Inspector 调查发现在 Amazon Inspector 中关闭后，Security Hub 将存档这些调查发现。您还可以查看调查发现历史记录和调查发现详细信息，以及跟踪针对调查发现的调查状态。
Security Hub 使用 Amazon 安全调查发现格式（ASFF）来处理调查发现。此格式包括唯一标识符、严重性级别、受影响资源、修复指导、工作流状态以及上下文信息等详细内容。
注意
Amazon Inspector Code Security 生成的安全调查发现不适用于此集成。但是，您可以在 Amazon Inspector 控制台中和通过 Amazon Inspector API 访问这些特定调查发现。
主题
在 Amazon Security Hub CSPM 中查看 Amazon Inspector 调查发现
您可以通过 Security Hub 查看 Amazon Inspector Classic 和 Amazon Inspector 调查发现。
注意
要仅筛选 Amazon Inspector 调查发现，请将 "aws/inspector/ProductVersion": "2" 添加到筛选栏中。此筛选条件会从 Security Hub 控制面板中排除 Amazon Inspector Classic 的调查发现。
Amazon Inspector 调查发现示例
{ "SchemaVersion": "2018-10-08", "Id": "arn:aws:inspector2:us-east-1:123456789012:finding/FINDING_ID", "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/inspector", "ProductName": "Inspector", "CompanyName": "Amazon", "Region": "us-east-1", "GeneratorId": "AWSInspector", "AwsAccountId": "123456789012", "Types": [ "Software and Configuration Checks/Vulnerabilities/CVE" ], "FirstObservedAt": "2023-01-31T20:25:38Z", "LastObservedAt": "2023-05-04T18:18:43Z", "CreatedAt": "2023-01-31T20:25:38Z", "UpdatedAt": "2023-05-04T18:18:43Z", "Severity": { "Label": "HIGH", "Normalized": 70 }, "Title": "CVE-2022-34918 - kernel", "Description": "An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.", "Remediation": { "Recommendation": { "Text": "Remediation is available. Please refer to the Fixed version in the vulnerability details section above. For detailed remediation guidance for each of the affected packages, refer to the vulnerabilities section of the detailed finding JSON." } }, "ProductFields": { "aws/inspector/FindingStatus": "ACTIVE", "aws/inspector/inspectorScore": "7.8", "aws/inspector/resources/1/resourceDetails/awsEc2InstanceDetails/platform": "AMAZON_LINUX_2", "aws/inspector/ProductVersion": "2", "aws/inspector/instanceId": "i-0f1ed287081bdf0fb", "aws/securityhub/FindingId": "arn:aws:securityhub:us-east-1::product/aws/inspector/arn:aws:inspector2:us-east-1:123456789012:finding/FINDING_ID", "aws/securityhub/ProductName": "Inspector", "aws/securityhub/CompanyName": "Amazon" }, "Resources": [ { "Type": "AwsEc2Instance", "Id": "arn:aws:ec2:us-east-1:123456789012:i-0f1ed287081bdf0fb", "Partition": "aws", "Region": "us-east-1", "Tags": { "Patch Group": "SSM", "Name": "High-SEv-Test" }, "Details": { "AwsEc2Instance": { "Type": "t2.micro", "ImageId": "ami-0cff7528ff583bf9a", "IpV4Addresses": [ "52.87.229.97", "172.31.57.162" ], "KeyName": "ACloudGuru", "IamInstanceProfileArn": "arn:aws:iam::123456789012:instance-profile/AmazonSSMRoleForInstancesQuickSetup", "VpcId": "vpc-a0c2d7c7", "SubnetId": "subnet-9c934cb1", "LaunchedAt": "2022-07-26T21:49:46Z" } } } ], "WorkflowState": "NEW", "Workflow": { "Status": "NEW" }, "RecordState": "ACTIVE", "Vulnerabilities": [ { "Id": "CVE-2022-34918", "VulnerablePackages": [ { "Name": "kernel", "Version": "5.10.118", "Epoch": "0", "Release": "111.515.amzn2", "Architecture": "X86_64", "PackageManager": "OS", "FixedInVersion": "0:5.10.130-118.517.amzn2", "Remediation": "yum update kernel" } ], "Cvss": [ { "Version": "2.0", "BaseScore": 7.2, "BaseVector": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "Source": "NVD" }, { "Version": "3.1", "BaseScore": 7.8, "BaseVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "Source": "NVD" }, { "Version": "3.1", "BaseScore": 7.8, "BaseVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "Source": "NVD", "Adjustments": [] } ], "Vendor": { "Name": "NVD", "Url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34918", "VendorSeverity": "HIGH", "VendorCreatedAt": "2022-07-04T21:15:00Z", "VendorUpdatedAt": "2022-10-26T17:05:00Z" }, "ReferenceUrls": [ "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6", "https://lore.kernel.org/netfilter-devel/cd9428b6-7ffb-dd22-d949-d86f4869f452@randorisec.fr/T/", "https://www.debian.org/security/2022/dsa-5191" ], "FixAvailable": "YES" } ], "FindingProviderFields": { "Severity": { "Label": "HIGH" }, "Types": [ "Software and Configuration Checks/Vulnerabilities/CVE" ] }, "ProcessedAt": "2023-05-05T20:28:38.822Z" }
激活和配置 Amazon Inspector 与 Security Hub 的集成
可以通过启用 Security Hub，激活 Amazon Inspector 与 Amazon Security Hub CSPM 的集成。启用 Security Hub 后，Amazon Inspector 与 Amazon Security Hub CSPM 的集成将自动激活，Amazon Inspector 开始使用 Amazon 安全调查发现格式（ASFF）将其所有调查发现发送给 Security Hub。
禁用来自集成的调查发现流
要让 Amazon Inspector 停止向 Security Hub 发送调查发现，可以使用 Security Hub 控制台或 API 和 Amazon CLI。
在 Security Hub 中查看适用于 Amazon Inspector 的安全控件
Security Hub 会分析来自受支持的 Amazon 和第三方产品的调查发现，并根据规则执行自动和连续安全检查，以生成其自己的调查发现。这些规则以安全控件表示，可帮助您确定是否满足标准中的要求。
Amazon Inspector 使用安全控件来检查是否启用或应该启用 Amazon Inspector 的特征。这些功能如下所示：
-
Amazon EC2 扫描
-
Amazon ECR 扫描
-
Lambda 标准扫描
-
Lambda 代码扫描
有关更多信息，请参阅《Amazon Security Hub CSPM 用户指南》中的 Amazon Inspector 控件。