AWS Security Hub Integration
Last updated
Was this helpful?
Last updated
Was this helpful?
AWS Security Hub is a security service that provides a comprehensive view of security alerts and compliance status across AWS accounts by aggregating findings from various AWS services and third-party tools. When used with ilert, Security Hub’s alerts are instantly routed to the right team members through multi-channel notifications and escalation policies, ensuring rapid response to security threats.
AWS Security Hub generates finding events that are relayed by AWS EventBridge. If AWS EventBridge rules match, notifications will be published to specific Amazon Simple Notification Service (SNS) topics; the events will be sent to ilert.
Go to Alert sources -> Alert sources and click on Create new alert source
Search for Amazon SNS in the search field, click on the Amazon SNS tile and click on Next.
Give your alert source a name, optionally assign teams and click Next.
Select an escalation policy by creating a new one or assigning an existing one.
The next page show additional settings such as customer alert templates or notification prioritiy. Click on Finish setup for now.
On the final page, an API key and / or webhook URL will be generated that you will need later in this guide.
On the sidebar click on Custom actions.
Click on Create custom action.
Enter a Action name, Description and a Custom action ID.
On the sidebar navigate to Topics and click on Create topic.
Select Standard and enter a Name.
Save the topic.
Now create a new Subscription for this topic.
Select HTTPS as Protocol and Enter the in ilert previously generated alert source url as Endpoint.
Click on Create subscription.
On the sidebar click on Event buses and then on Create rule.
Enter a Name for the rule.
Enter following Event pattern and click on Next:
Select the previous created topic as target.
Click on Create rule to finish the setup.
Will alerts in ilert be resolved automatically?
No, but you can use the eventType custom attribute to resolve an incident in specified incidentKey.
Select you preference and click Continue setup. You may click Do not group alerts for now and change it later.
