Skip to main content
Welcome back. In this lesson we cover AWS Security Hub: how it centralizes findings, normalizes data with ASFF, integrates with AWS and third‑party security products, supports multi‑account governance, and enables automated remediation workflows. This guide focuses on fundamentals, integration points, operational best practices, and troubleshooting — all useful for real-world operations and exam preparation. To begin, Security Hub aggregates findings from multiple security services and normalizes them into a common format so you can correlate, prioritize, and automate responses without having to chain services together.
A slide titled "AWS Security Hub: Centralizing Security Management" that shows a left-to-right flow of AWS security services: Amazon GuardDuty → AWS Inspector → AWS Firewall Manager → AWS Security Hub with red service icons and an AWS DevOps Engineer badge.
When operating across multiple accounts, findings scale quickly. Security Hub centralizes alerts so you can filter by severity, resource, compliance status, and focus on critical items first.
A slide titled "Scenario: The Security Visibility Challenge" showing a "Security Dashboard" bar with a vertical list of alert boxes. The alerts include messages like unauthorized access attempts, vulnerabilities found, firewall-blocked suspicious traffic, excessive failed logins, and inconsistent policy enforcement.

​
Security Hub fundamentals

Security Hub provides:
  • Aggregation and normalization of findings (ASFF).
  • Automated compliance checks against standards.
  • Cross‑account visibility via AWS Organizations.
  • Integration with EventBridge for automated workflows (Lambda, Systems Manager Automation, Step Functions).
  • The ability to ingest third‑party and custom findings via the BatchImportFindings API.
A presentation slide titled "AWS Security Hub Fundamentals" showing four numbered panels that list core components: security finding aggregation and normalization, compliance standard evaluation, cross-account security visibility, and automated security workflows, each with a small icon.
Key integrations include Amazon GuardDuty, Amazon Inspector, AWS Firewall Manager, AWS Config, Amazon Macie, Access Analyzer, and many third‑party providers. Security Hub normalizes findings using the AWS Security Finding Format (ASFF), which includes common fields such as Id, ProductArn, GeneratorId, AwsAccountId, Types, Severity, timestamps, Resources, Compliance, Workflow state, and user-defined fields.
ASFF (AWS Security Finding Format) is the canonical JSON structure Security Hub uses to normalize findings from diverse products. Using ASFF enables consistent querying, filtering, and automated responses across services.
Here is an example of the core ASFF structure (trimmed to relevant fields):
Because Security Hub normalizes findings, you can correlate events across services and prioritize responses based on severity, compliance impact, and affected resources.

​
Example ASFF findings (GuardDuty and Inspector)

​
Compliance standards and checks

Security Hub includes built-in standards such as:
  • AWS Foundational Security Best Practices
  • CIS AWS Foundations Benchmark
  • PCI DSS
You can enable custom standards and controls as well. Security Hub displays individual controls, categories, statuses, and severity to help prioritize remediation work.
A presentation slide titled "Security Standards and Benchmarks" showing a simple hierarchy diagram: Standards → Control Categories → Controls. Below are bullet lists naming supported standards (e.g., AWS Foundational, CIS, PCI DSS, custom) and standard components like individual controls, categories, statuses, and severities.

​
Multi-account aggregation and governance

In production, a centralized security/admin account typically acts as the Security Hub administrator (or use a delegated admin). Member accounts in an AWS Organization forward findings to that admin account so you get unified cross‑account visibility and filterable dashboards.
A flowchart titled "Multi-Account Security Governance" showing an AWS Organizations root at the top branching into two organizational units, each containing member accounts (A–D). Those member accounts feed into a central "Security Hub Findings Aggregation" box.
Best practices:
  • Automate account enrollment (Landing Zone, Control Tower, or your account factory).
  • Use delegated admin for scale, or centralized admin for small environments.
  • Apply filters and custom insights to reduce noise and focus on high‑impact findings.

​
Automated remediation with EventBridge

Route Security Hub findings to EventBridge and trigger remediation with Lambda, Systems Manager Automation, Step Functions, or third‑party systems. Use event patterns to match severity, compliance status, product source, or specific resource types. Below is a CloudFormation example that creates an EventBridge rule to match Security Hub findings and route them to a Lambda function (replace the Lambda ARN with your target):
When triggered, your remediation logic should update the finding’s workflow state in Security Hub (for example, mark as NOTIFIED or RESOLVED) to keep the central view accurate.
A slide titled "Automated Remediation With Security Hub" showing a four-step workflow: Security finding detected → EventBridge rule matches finding → Remediation logic triggered → Lambda/SSM automation executes.

​
Finding triage lifecycle

Typical lifecycle:
  1. Detection
  2. Normalization & correlation
  3. Prioritization & assignment
  4. Investigation & remediation (freeze for forensics if needed)
  5. Verification & closure
Map your playbooks to these stages and automate transitions (update Workflow.Status) where possible.
A slide titled "Finding Triage and Workflow" showing a linear lifecycle diagram with five labeled stages: Detection → Normalization & correlation → Prioritization & Assignment → Investigation & Remediation → Verification & Closure. Each stage has a small colored icon above a boxed label and arrows connecting them.

​
Integration points and outputs

You can enrich findings with context (asset owner, ticket ID, risk score), send notifications to ChatOps (Slack), create JIRA/ServiceNow tickets, or email stakeholders. After remediation, update Security Hub to reflect the new workflow state.
An architecture diagram titled "Finding Triage and Workflow" showing AWS Security Hub integrated with EventBridge, a Lambda function for transform/enrich, and outputs to ChatOps/email and a ticketing system (Jira/ServiceNow). A dashed feedback line returns to Security Hub.

​
Common targets for automated responses

​
Custom integrations and batch import

Third‑party or custom tools can submit ASFF findings using the BatchImportFindings API. Security Hub ingests them and treats them like native findings (searchable, filterable, and actionable).
A slide titled "Custom Integrations and Extensions" showing a simple architecture flow: a custom security product generates ASFF (JSON) findings, which are sent via the BatchImportFindings API to AWS Security Hub. The diagram labels the steps and notes the ASFF format and API call.
Example custom product finding (ASFF):

​
Metrics and scoring

Security Hub provides an overall security score and per‑standard scores (CIS, PCI DSS, NIST, etc.). Use score trends to measure posture improvement over time and prioritize remediation.
A security dashboard showing an overall security score of 78 with compliance breakdowns (CIS 85, PCI DSS 63, NIST 50). A drill-down panel on the right lists individual control pass/fail statuses and the AWS Security Hub logo.

​
Cost and performance considerations

Enabling more standards and integrating more products increases finding volume and cost. Consider these controls:
  • Enable only the standards and services you need.
  • Archive findings to S3 for long‑term retention and lower Security Hub storage costs.
  • Filter or deduplicate noisy findings with insights and custom actions.
A flowchart titled "Cost Optimization and Performance" outlining decision steps for enabling AWS Security Hub. It shows questions about expected finding volume, integrating AWS services and standards, and retention options (e.g., default retention or archive to S3).
Operational advice:
  • Automate enrollment using Landing Zone, Control Tower, or an account factory.
  • Choose delegated admin for larger environments.
  • Tune filters, insights, and EventBridge rules to reduce noise and focus on high‑impact findings.
A diagram titled "Cost Optimization and Performance" showing an AWS Organizations setup with a Delegated Admin Account (Security Hub Admin) managing Security Hub instances across three member accounts (A, B, C). It illustrates centralized administration and cross-account aggregation.

​
Common challenges and troubleshooting

Permissions and cross‑account setup are the most frequent causes of issues. Ensure the Security Hub admin/delegated admin has required IAM permissions and that member accounts are invited and enabled. Other failure modes:
  • Ingestion failures: API limits, permissions, or network issues.
  • ASFF schema errors: custom findings must conform to ASFF.
  • Aggregation misses: cross‑account or cross‑region misconfiguration.
Before troubleshooting automation failures, verify IAM permissions and quotas. Remediation workflows commonly fail due to missing roles, insufficient permissions, or EventBridge target misconfiguration.
A troubleshooting flowchart titled "Security Hub – Common Challenges" showing a top-down process from "Security Hub Issue Detected" to checks like IAM/resource permissions, service integrations, configurations, and cross-account setup. The diagram ends with remediation actions such as resolving IAM/resource policy issues, reconfiguring integrations, and updating configurations and standards.
If findings are missing, validate:
  • The producing service is enabled and configured to send findings.
  • The product ARN for the source is authorized to submit to Security Hub.
  • AWS Config is enabled (required for many compliance checks).
A slide titled "Security Hub – Common Challenges" showing a pipeline from finding sources (e.g., GuardDuty, Inspector) → finding ingestion → normalization (ASFF) → aggregation/correlation → dashboards/SIEM. Red error boxes under the pipeline highlight potential failure points: ingestion failures (permissions, API limits), normalization errors (ASFF schema), and aggregation misses (cross‑account config).

​
Quick troubleshooting checklist

​
Summary

AWS Security Hub centralizes and normalizes security findings with ASFF, evaluates compliance standards, and enables automated remediation via EventBridge and orchestration targets such as Lambda, SSM Automation, and Step Functions. For multi‑account environments, use AWS Organizations with a centralized or delegated admin account and automate enrollment. Tune filters and insights to reduce noise, and validate permissions and ASFF formatting when troubleshooting ingestion or aggregation issues. References and further reading:

Watch Video