AWS Security Hub

LAST UPDATED: SEPTEMBER 18, 2025

Overview

AWS Security Hub collects security data from across AWS accounts and services, and helps to analyze security trends to identify and prioritize the security issues across an AWS environment.

D3 SOAR is providing REST operations to function with AWS SecurityHub.

For example, Security Hub can be used to collect and centralize security events from all AWS Accounts into one single spot on AWS.

AWS SecurityHub is available for use in:

Known Limitations

Region Control

Security Hub API requests are executed only in the Amazon Web Services Region that is currently active, or in the specific Amazon Web Services Region specified in the request. Any configuration or settings change resulting from the operation is applied only to that region.

Throttling Limits

The following throttling limits apply when using Security Hub API operations:

• BatchEnableStandards

  • RateLimit of 1 request per second

  • BurstLimit of 1 request per second

• GetFindings

  • RateLimit of 3 requests per second

  • BurstLimit of 6 requests per second

• BatchImportFindings

  • RateLimit of 10 requests per second

  • BurstLimit of 30 requests per second

• BatchUpdateFindings

  • RateLimit of 10 requests per second

  • BurstLimit of 30 requests per second

• UpdateStandardsControl

  • RateLimit of 1 request per second

  • BurstLimit of 5 requests per second

• All other operations

  • RateLimit of 10 requests per second

  • BurstLimit of 30 requests per second

Refer to AWS Security Hub quotas for detailed information.

Connection

To connect to AWS SecurityHub from D3 SOAR, follow this part to collect the required information below:

Permission Requirements

Each endpoint in the AWS SecurityHub API requires a certain permission scope. The following are required scopes for the commands in this integration:

Configuring AWS SecurityHub to Work with D3 SOAR

Access Key Retrieval for Users Without Policy Configuration

If the login user does not require policy configuration, follow the steps below to retrieve the access key and secret key.

1. Sign in to the AWS console.

   

2. Click the account icon, then select Security Credentials.

   

3. Under the AWS IAM credentials tab, click the Create access key button to create a new Access Key and Secret Key.

   

READER NOTE

Contact the organization administrator if the login user lacks permission to read or create an access key.

4. Copy the Access key ID and the Secret access key to use for connecting with D3 SOAR.

   

READER NOTE

The secret access key is viewable or downloadable only once. Promptly download the .csv file and store it securely. Lost or forgotten keys cannot be recovered. To replace a lost key, create a new access key and deactivate the old one. A maximum of two access keys (active or inactive) is allowed per user.

Configuring Limited API Access

To configure limited API access for role-based access control, complete the following sections in the order presented.

Creating a Policy

1. Navigate to Services > IAM.

   

2. Navigate to Access management > Policies, then click the Create Policy button.

   

3. Select Service, then click Choose a service. Refer to the Permission Requirements for the selected service. Click Next to continue.

   

4. Search and assign using the search bar in the Actions allowed section. For example, search for GetFindings in the search box, and use the tick box underneath it to select this action. Refer to Permission Requirements for the necessary Access level (Actions). It is possible to specify multiple permissions under the same policy. Cick Next to continue.

   

5. Enter a name in the text box under Policy name, then click Create policy.

   

Creating a User

1. Locate the Users tab, then enter a user name into the User details field. Click Next.

   

2. Select the desired permissions under Permissions options. It is recommended to link directly to the created policy. Refer to Creating Policy for more information.

   Alternatively, create a role with the desired permissions. Refer to Adding a Role and Trusted Entities for creating user roles. Once the role is created, it is not required to assign the role directly to the user. Instead, assign the role through the D3 connection or D3 commands. Refer to AssumeRole - AWS Security Token Service for details.

   Click Next.

   

4. Review the details, and click Create user.

   

5. Find the newly created user, then copy the User ARN.

   

Adding a Role and Trusted Entities

1. Sign in to the AWS IAM console using administrator credentials.

2. Select Roles, then click the Create role button.

   

3. Select AWS account under Trusted entity type. Select the appropriate account under An AWS account based on the request, then click Next.

   

4. Search for the policy name, add the required permissions, then click Next.

   

5. Enter the Role name, and click Create role.

   

6. Navigate to Roles, and select the newly created role. Click Create rule.

   

7. Navigate to Roles and select the Trust relationships tab. Click Edit trust policy.

   

8. Return to Edit trust policy in another browser tab/window. Paste the following code to the trust policy, paste the copied user ARN (refer to step 5 of Creating User for retrieving the user ARN) in the "AWS" field in the code. Click Update policy.

   JSON

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "",
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::******:user/DOC_User",
           "Service": "securityhub.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

   

RESULT

The Role ARN is ready to use.

Retrieving the Access Key and Secret Key

1. Find the newly created user, then select it to access the details.

2. Under the Security credentials tab, click Create access key.

   

3. Create an access key and save the details. Click Done after saving these credentials.

   

Configuring D3 SOAR to Work with AWS SecurityHub

1. Log in to D3 SOAR.

2. Find the AWS SecurityHub integration.

   

   1. Navigate to Configuration on the top header menu.

   2. Click on the Integration icon on the left sidebar.

   3. Type AWS SecurityHub in the search box to find the integration, then click it to select it.

   4. Click + Connection, on the right side of the Connections section. A new connection window will appear.

3. Configure the following fields to create a connection to AWS SecurityHub.

   

   1. Connection Name: The desired name for the connection.

   2. Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

   3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.

   4. Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

   5. Description (Optional): The description for the connection.

   6. Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.

      

   7. Configure User Permissions: Defines which users have access to the connection.

   8. Active: The checkbox that enables the connection to be used when selected.

      

   9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.

      

      1. Choose the Default Region Name.
      2. Copy the Access Key from the AWS Console platform. Refer to step 3 of Access Key and Secret Key.
      3. Copy the Secret Key from the AWS console platform. Refer to step 3 of Access Key and Secret Key.
      4. (Optional) Define the Role ARN from the AWS Console platform. Refer to step 9 of Adding a Role and Trusted Entities.
      5. (Optional) Input the Default Role Session Name.
      6. (Optional) Input the Default Session Duration Time.

   10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.

4. Test the connection.

   

   1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

   2. Click OK to close the alert window.

   3. Click + Add to create and add the configured connection.

Commands

AWS SecurityHub includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the AWS SecurityHub API, refer to the AWS SecurityHub API reference.

READER NOTE

Certain permissions are required for each command. Refer to the Permission Requirements and Configuring AWS SecurityHub to Work with D3 SOAR for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:

1. Navigate to Configuration > Application Settings. Select Date/Time Format.

   

2. Choose the desired date and time format, then click on the Save button.

   

The selected time format will now be visible when configuring Date/Time command input parameters.

Batch Update Findings

READER NOTE

Finding IDs and Product ARN are required parameters to run this command.

• Run the Fetch Event command to obtain the Finding IDs. Finding IDs can be found in the raw data at $.Findings[*].Id.

• Run the Fetch Event command to obtain the Product ARN. Product ARNs can be found in the raw data at $.Findings[*].ProductArn.

Used by Security Hub administrators and members to update investigation details for a finding. Administrator accounts can update findings for their own account and member accounts. Member accounts can update findings only for their own account.

Input

[
  "arn:aws:securityhub:us-east-2:391*****688:subscription/aws-foundational-security-best-practices/v/1.0.0/EC2.8/finding/f143*****2d75"
]

[
  "Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices"
]

{
  "customPriority": "High",
  "customState": "Pending"
}

[
  {
    "ProductArn": "arn:aws:securityhub:us-east-2::product/aws/securityhub",
    "Id": "arn:aws:securityhub:us-east-2:391*****688:subscription/aws-foundational-security-best-practices/v/1.0.0/EC2.8/finding/da95*****16b5"
  }
]

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Fetch Event

Returns a list of findings that match the specified criteria.

Input

{
    "SeverityLabel": [
        {
            "Value": "CRITICAL",
            "Comparison": "EQUALS"
        }
    ],
    "ResourceType": [
        {
            "Value": "AwsEc2",
            "Comparison": "PREFIX"
        }
    ]
}

Output

To view the sample output data for all commands, refer to this article.

Fetch Event Field Mapping

See Field Mappings. 

The AWS SecurityHub system integration includes pre-configured field mappings for the default event source.

The Default Event Source is the default system-provided set of field mappings applied when the fetch event command is executed. It includes a Main Event JSON Path, which is the JSONPath expression that points to the base array of event objects. The source field path continues from this array to locate the required data. 

The Main Event JSON Path can be viewed by clicking on the Edit Event Source button.

• Main Event JSON Path: $.Findings
  The Findings array contains the event objects. Within each object, the key Types denotes the Event Type field. As such, the full JSONPath expression to extract the Event Type is $.Findings.Types.

The pre-configured field mappings are detailed below:

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.