Question

A security team uses AWS Security Hub as the aggregation point for findings from GuardDuty, Amazon Inspector, and third-party partner products across a multi-account AWS Organizations environment. They want any finding with a severity label of CRITICAL to automatically create an incident ticket in their external ITSM system, while all other findings continue to be reviewed manually in the console. The solution must be fully event-driven, require no polling, and add no custom code to normalize the different finding formats from each source. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching the Security Hub Findings - Imported event pattern filtered on Severity.Label equal to CRITICAL, and target a Lambda function that calls the ITSM API.

Answer

Enable a scheduled Lambda function that calls the Security Hub GetFindings API every five minutes, filters for CRITICAL findings, and posts matching results to the ITSM system.

Answer

Configure each source service (GuardDuty, Inspector, and the partner product) to send its native findings directly to EventBridge and build separate rules per source to route CRITICAL items.

Answer

Create an SNS topic subscribed by the ITSM system and configure Security Hub custom actions so analysts can manually forward CRITICAL findings to the topic.