Question

A security team has enabled AWS Security Hub as the delegated administrator across an AWS Organization. The team wants only CRITICAL and HIGH severity findings to automatically trigger a notification to their incident response channel in near real time, while lower-severity findings remain visible in the console but generate no alerts. They must avoid polling the Security Hub API on a schedule. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the Security Hub Findings - Imported event with a filter on the severity label for CRITICAL and HIGH, targeting an Amazon SNS topic subscribed by the incident response channel.

Answer

Configure an AWS Lambda function on a 5-minute EventBridge scheduled rule to call the Security Hub GetFindings API and filter for CRITICAL and HIGH findings, then publish to Amazon SNS.

Answer

Enable Security Hub finding aggregation and configure a CloudWatch metric filter on the Security Hub log group to alarm when severity is CRITICAL or HIGH.

Answer

Create a Security Hub automation rule that changes the workflow status of CRITICAL and HIGH findings to NOTIFIED, which automatically pushes them to Amazon SNS.