Amazon Inspector 与 Amazon Security Hub - Amazon Inspector
在中查看亚马逊 Inspector 的调查结果 Amazon Security Hub激活和配置 Amazon Inspector 与 Security Hub 的集成禁用来自集成的调查发现流在 Security Hub 中查看适用于 Amazon Inspector 的安全控件
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

Amazon Inspector 与 Amazon Security Hub

Amazon Security Hub 全面了解您的安全状态， Amazon 并帮助您根据安全行业标准和最佳实践检查您的环境。Security Hub 从 Amazon 账户、服务和支持产品收集安全数据。您可以使用 Security Hub 提供的信息来分析安全趋势并确定优先级最高的安全问题。激活集成后，您可以将 Amazon Inspector 的调查发现发送到 Security Hub，Security Hub 可以在其安全状况分析中包含这些调查发现。

Security Hub 将以结果的形式追踪安全问题。其中一些发现可能是由其他 Amazon 服务或第三方产品检测到的问题造成的。Security Hub 使用一套规则，用于检测安全问题和生成调查发现。Security Hub 提供的工具可帮助您管理调查发现。Amazon Inspector 调查发现在 Amazon Inspector 中关闭后，Security Hub 将存档这些调查发现。您还可以查看调查发现历史记录和调查发现详细信息，以及跟踪针对调查发现的调查状态。

Security Hub 调查发现使用名为 Amazon 安全调查发现格式（ASFF）的标准 JSON 格式。ASFF 包含有关问题根源、受影响资源以及调查发现当前状态的详细信息。

在中查看亚马逊 Inspector 的调查结果 Amazon Security Hub

您可以通过 Security Hub 查看 Amazon Inspector Classic 和 Amazon Inspector 调查发现。

注意

要仅筛选 Amazon Inspector 调查发现，请将 "aws/inspector/ProductVersion": "2" 添加到筛选栏中。此筛选条件会从 Security Hub 控制面板中排除 Amazon Inspector Classic 的调查发现。

Amazon Inspector 调查发现示例 

{
  "SchemaVersion": "2018-10-08",
  "Id": "arn:aws:inspector2:us-east-1:123456789012:finding/FINDING_ID",
  "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/inspector",
  "ProductName": "Inspector",
  "CompanyName": "Amazon",
  "Region": "us-east-1",
  "GeneratorId": "AWSInspector",
  "AwsAccountId": "123456789012",
  "Types": [
    "Software and Configuration Checks/Vulnerabilities/CVE"
  ],
  "FirstObservedAt": "2023-01-31T20:25:38Z",
  "LastObservedAt": "2023-05-04T18:18:43Z",
  "CreatedAt": "2023-01-31T20:25:38Z",
  "UpdatedAt": "2023-05-04T18:18:43Z",
  "Severity": {
    "Label": "HIGH",
    "Normalized": 70
  },
  "Title": "CVE-2022-34918 - kernel",
  "Description": "An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.",
  "Remediation": {
    "Recommendation": {
      "Text": "Remediation is available. Please refer to the Fixed version in the vulnerability details section above. For detailed remediation guidance for each of the affected packages, refer to the vulnerabilities section of the detailed finding JSON."
    }
  },
  "ProductFields": {
    "aws/inspector/FindingStatus": "ACTIVE",
    "aws/inspector/inspectorScore": "7.8",
    "aws/inspector/resources/1/resourceDetails/awsEc2InstanceDetails/platform": "AMAZON_LINUX_2",
    "aws/inspector/ProductVersion": "2",
    "aws/inspector/instanceId": "i-0f1ed287081bdf0fb",
    "aws/securityhub/FindingId": "arn:aws:securityhub:us-east-1::product/aws/inspector/arn:aws:inspector2:us-east-1:123456789012:finding/FINDING_ID",
    "aws/securityhub/ProductName": "Inspector",
    "aws/securityhub/CompanyName": "Amazon"
  },
  "Resources": [
    {
      "Type": "AwsEc2Instance",
      "Id": "arn:aws:ec2:us-east-1:123456789012:i-0f1ed287081bdf0fb",
      "Partition": "aws",
      "Region": "us-east-1",
      "Tags": {
        "Patch Group": "SSM",
        "Name": "High-SEv-Test"
      },
      "Details": {
        "AwsEc2Instance": {
          "Type": "t2.micro",
          "ImageId": "ami-0cff7528ff583bf9a",
          "IpV4Addresses": [
            "52.87.229.97",
            "172.31.57.162"
          ],
          "KeyName": "ACloudGuru",
          "IamInstanceProfileArn": "arn:aws:iam::123456789012:instance-profile/AmazonSSMRoleForInstancesQuickSetup",
          "VpcId": "vpc-a0c2d7c7",
          "SubnetId": "subnet-9c934cb1",
          "LaunchedAt": "2022-07-26T21:49:46Z"
        }
      }
    }
  ],
  "WorkflowState": "NEW",
  "Workflow": {
    "Status": "NEW"
  },
  "RecordState": "ACTIVE",
  "Vulnerabilities": [
    {
      "Id": "CVE-2022-34918",
      "VulnerablePackages": [
        {
          "Name": "kernel",
          "Version": "5.10.118",
          "Epoch": "0",
          "Release": "111.515.amzn2",
          "Architecture": "X86_64",
          "PackageManager": "OS",
          "FixedInVersion": "0:5.10.130-118.517.amzn2",
          "Remediation": "yum update kernel"
        }
      ],
      "Cvss": [
        {
          "Version": "2.0",
          "BaseScore": 7.2,
          "BaseVector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "Source": "NVD"
        },
        {
          "Version": "3.1",
          "BaseScore": 7.8,
          "BaseVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "Source": "NVD"
        },
        {
          "Version": "3.1",
          "BaseScore": 7.8,
          "BaseVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "Source": "NVD",
          "Adjustments": []
        }
      ],
      "Vendor": {
        "Name": "NVD",
        "Url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34918",
        "VendorSeverity": "HIGH",
        "VendorCreatedAt": "2022-07-04T21:15:00Z",
        "VendorUpdatedAt": "2022-10-26T17:05:00Z"
      },
      "ReferenceUrls": [
        "https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6",
        "https://lore.kernel.org/netfilter-devel/cd9428b6-7ffb-dd22-d949-d86f4869f452@randorisec.fr/T/",
        "https://www.debian.org/security/2022/dsa-5191"
      ],
      "FixAvailable": "YES"
    }
  ],
  "FindingProviderFields": {
    "Severity": {
      "Label": "HIGH"
    },
    "Types": [
      "Software and Configuration Checks/Vulnerabilities/CVE"
    ]
  },
  "ProcessedAt": "2023-05-05T20:28:38.822Z"
}

激活和配置 Amazon Inspector 与 Security Hub 的集成

您可以通过启用 Sec urit Amazon Security Hub y Hub 来激活 Amazon Inspector 与的集成。启用 Security Hub 后，Amazon Inspec Amazon Security Hub tor 与的集成将自动激活，Amazon Inspector 开始使用安全调查格式 (ASFF) 将其所有发现结果发送到 Sec Amazon ur ity Hub。

禁用来自集成的调查发现流

要阻止 Amazon Inspector 向 Security Hub 发送调查结果，你可以使用 Security Hub 控制台或 API 然后 Amazon CLI...

在 Security Hub 中查看适用于 Amazon Inspector 的安全控件

Security Hub 会分析受支持产品 Amazon 和第三方产品的发现，并根据规则进行自动和持续的安全检查，以生成自己的调查结果。这些规则以安全控件表示，可帮助您确定是否满足标准中的要求。

Amazon Inspector 使用安全控件来检查是否启用或应该启用 Amazon Inspector 的特征。这些功能如下所示：

  • 亚马逊 EC2 扫描

  • Amazon ECR 扫描

  • Lambda 标准扫描

  • Lambda 代码扫描

有关更多信息，请参阅《Amazon Security Hub 用户指南》中的 Amazon Inspector 控件。