Question

A security team manages a single AWS account that runs EC2 instances and container workloads. They have enabled Amazon Inspector for vulnerability scanning and AWS Config with several managed rules for misconfiguration detection. Leadership wants a single dashboard that ingests both the Inspector vulnerability findings and the Config compliance results, normalizes them into a common format, and lets the team assign a severity-based priority for remediation. Which approach best meets these requirements with the least custom development?

Accepted Answer

Enable AWS Security Hub, which automatically consumes findings from Amazon Inspector and AWS Config, normalizes them to the AWS Security Finding Format (ASFF), and provides severity-based prioritization and consolidated dashboards.

Answer

Enable Amazon Detective and configure it to ingest Inspector and Config findings, then use Detective's behavior graph to rank findings by severity.

Answer

Build an Amazon EventBridge rule that forwards Inspector and Config events to a Lambda function that writes normalized records to an Amazon OpenSearch dashboard for prioritization.

Answer

Enable Amazon GuardDuty and turn on the Inspector and Config integrations so all findings are aggregated in the GuardDuty console with a prioritized severity view.