Knowledge BaseRelease NotesRequest Demo

AWS Security Hub

Connecting AWS Security Hub logs to your Panther Console

Overview

Panther supports ingesting AWS Security Hub findings. You will use AWS EventBridge to forward security findings to Panther, where you can reference them in detections and search.

How to onboard AWS Security Hub findings to Panther

Step 1: Create an AWS SNS topic

  • Follow Panther's instructions for creating an AWS SNS topic.

    • In the Name field, enter something that makes it easy to identify e.g. panther-aws-security-hub.

    • Copy the topic ARN value and store it in a secure location, as you will need it in the next steps.

      • Example ARN: arn:aws:sns:us-east-2:123456789012:panther-aws-security-hub

Step 2: Create Amazon EventBridge rule

  1. Navigate to Amazon EventBrige > Buses > Rules.

  2. Click Create Rule.

  3. Enter following values for the fields:

    • Name: panther-aws-security-hub

    • Event bus: default

    • Select Enable the rule on the selected event bus.

    • Rule type: Rule with an event pattern

  4. Click Next.

  5. Enter the following values for the fields:

    • Event source: AWS events or EventBridge partner events

    • Creation method: Use pattern form

    • Event pattern:

      • Event source: AWS services

      • AWS service: Security Hub

      • Event type: Security Hub Findings - Imported

  6. Click Next.

  7. Enter following values for the fields:

    • Target types: AWS Service

    • Select a target: SNS Topic

    • Topic: Select the topic you created in Step 1, panther-aws-security-hub

  8. Click Skip to review and create.

  9. Click Create rule.

Stay logged in to the AWS console. You will navigate to the Panther Console for Step 3 and return to the AWS console for Step 4.

Step 3: Create an AWS Security Hub source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Search for "AWS Security Hub," then click its tile.

    • In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the AWS SQS Queue option.

  4. Click Start Setup.

  5. Follow Panther's instructions for configuring an SQS Source.

    • In the Allowed Source ARNs field, enter the ARN of the SNS topic you created in Step 1.

  6. Click View Log Source.

  7. Click SQS Queue ARN to copy the ARN of the SQS queue. Save it in a secure location, as you will need it in the next step.

Step 4: Create an SNS topic subscription to SQS Queue

Supported AWS Security Hub logs

AWS.SecurityFindingFormat

Learn more about the structure of a finding on the AWS Security Finding Format (ASFF) page.

PreviousAWS GuardDutyNextAmazon Security Lake

Last updated

Was this helpful?