# AWS Security Hub Integration
[AWS Security Hub](https://aws.amazon.com/security-hub/) is a security service that provides a comprehensive view of security alerts and compliance status across AWS accounts by aggregating findings from various AWS services and third-party tools. When used with ilert, Security Hub’s alerts are instantly routed to the right team members through multi-channel notifications and escalation policies, ensuring rapid response to security threats.
## How this integration works
AWS Security Hub generates finding events that are relayed by AWS EventBridge. If AWS EventBridge rules match, notifications will be published to specific Amazon Simple Notification Service (SNS) topics; the events will be sent to ilert.
## Architecture
## In ilert: Create an Amazon SNS alert source
1. Go to **Alert sources** -> **Alert sources** and click on **Create new alert source**
2. Search for **Amazon SNS** in the search field, click on the Amazon SNS tile and click on **Next**.
3. Give your alert source a name, optionally assign teams and click **Next**.
4. Select an **escalation policy** by creating a new one or assigning an existing one.
5. Select you [Alert grouping](/alerting/configure-alerting/alert-sources.md#alert-grouping) preference and click **Continue setup**. You may click **Do not group alerts** for now and change it later.
6. The next page show additional settings such as customer alert templates or notification prioritiy. Click on **Finish setup** for now.
7. On the final page, an API key and / or webhook URL will be generated that you will need later in this guide.
## In AWS Security Hub: Create a Custom action
1. On the sidebar click on **Custom actions**.
2. Click on **Create custom action**.
3. Enter a **Action name**, **Description** and a **Custom action ID**.
## In AWS SNS: Create a topic and a Subscription
1. On the sidebar navigate to **Topics** and click on **Create topic**.
2. Select **Standard** and enter a **Name**.
3. Save the topic.
4. Now create a new Subscription for this topic.
5. Select HTTPS as **Protocol** and Enter the in ilert previously generated alert source url as **Endpoint**.
3. Click on **Create subscription**.
## In AWS EventBridge: Create an Event bus Rule
1. On the sidebar click on **Event buses** and then on **Create rule**.
2. Enter a Name for the rule.
3. Enter following Event pattern and click on **Next**:
```
{
"source": [
"aws.securityhub"
],
"resources": [
"< ARN OF THE CUSTOM ACTION CREATED IN SECURITY HUB >"
]
}
```
4. Select the previous created topic as target.
5. Click on **Create rule** to finish the setup.
## FAQ
**Will alerts in ilert be resolved automatically?**
No, but you can use the **eventType** custom attribute to resolve an incident in specified **incidentKey**.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.ilert.com/integrations/inbound-integrations/aws-security-hub-integration.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.