Question

A security engineer manages a Security Hub administrator account that aggregates findings from 40 member accounts across an AWS Organization. The security operations team is overwhelmed by low-severity findings, and they want findings from a specific set of sandbox accounts to be automatically set to a workflow status of SUPPRESSED, while findings with a severity of CRITICAL from production accounts should have their severity label elevated and be routed for immediate triage. The team wants this handled centrally and consistently without writing custom Lambda functions. Which approach best meets these requirements?

Accepted Answer

Create Security Hub automation rules in the administrator account that match on account ID and severity criteria to automatically update the workflow status and severity of incoming findings.

Answer

Create an Amazon EventBridge rule in each member account that filters findings and invokes a Lambda function to update the workflow status through the Security Hub API.

Answer

Configure GuardDuty suppression rules in the administrator account to filter out sandbox findings before they reach Security Hub.

Answer

Enable Security Hub insights to group findings by account and manually update the workflow status for sandbox accounts each day.