AWS Security Hub

Receive AWS Security Hub aggregated security findings via SNS/EventBridge.

InboundCloud Platforms

Start Free Trial

Quick Setup

Copy Webhook URL

Go to your Alert24 dashboard and copy the webhook URL for AWS Security Hub.

Configure AWS Security Hub

Add the webhook URL in your AWS Security Hub settings.

Auto-Detected

Alert24 auto-detects AWS Security Hub payloads and maps them to incidents.

Step-by-Step Setup Instructions

AWS Security Hub Webhook Setup

1.Create an SNS Topic for Security Hub findings

2.In EventBridge, create a rule matching Security Hub finding events:

- Source: aws.securityhub

- Detail type: Security Hub Findings - Imported

3.Set the target to your SNS topic

4.Add an HTTPS subscription to the SNS topic using the webhook URL above

5.Confirm the subscription

Example Webhook Payload

This is a sample payload that AWS Security Hub sends to Alert24 when an alert fires.

{
  "version": "0",
  "source": "aws.securityhub",
  "detail-type": "Security Hub Findings - Imported",
  "detail": {
    "findings": [
      {
        "SchemaVersion": "2018-10-08",
        "Id": "arn:aws:securityhub:us-east-1:123456789012:finding/abc123",
        "Title": "S3 bucket my-bucket has public read access enabled",
        "Severity": {
          "Label": "HIGH",
          "Normalized": 70
        },
        "Workflow": {
          "Status": "NEW"
        },
        "Resources": [
          {
            "Type": "AwsS3Bucket",
            "Id": "my-bucket"
          }
        ]
      }
    ]
  }
}