Question

A financial services company aggregates AWS Security Hub findings across 40 accounts in a delegated administrator account. The security operations team wants a repeatable, auditable workflow: when an analyst reviews a HIGH or CRITICAL finding and decides it requires manual investigation, a ticket must be automatically created in their on-premises ITSM tool through its REST API, and the finding's workflow status must be updated. The solution must not automatically ticket every finding, only those an analyst explicitly selects, and it must be fully driven by infrastructure-as-code. Which approach meets these requirements with the least custom code?

Accepted Answer

Create a Security Hub custom action, define an EventBridge rule matching the custom action ARN, and target a Lambda function that calls the ITSM REST API and updates the finding's workflow status via the Security Hub API.

Answer

Enable a Security Hub automation rule that matches HIGH and CRITICAL findings and configure it to invoke a Lambda function that creates the ITSM ticket for every matching finding.

Answer

Create an EventBridge rule that matches all Security Hub findings with severity HIGH or CRITICAL and route them to an SQS queue polled by an EC2 worker that creates ITSM tickets.

Answer

Configure a Security Hub finding aggregation region and use an EventBridge scheduled rule to run a Lambda every 15 minutes that scans for new HIGH/CRITICAL findings and creates ITSM tickets.