Question

A security team runs a custom, in-house vulnerability scanner that produces JSON reports for their EC2 fleet. They want these scanner results to appear alongside GuardDuty and Inspector findings in AWS Security Hub so analysts can triage everything from a single console and apply the same automation rules. What is the correct approach to bring the custom scanner's results into Security Hub?

Accepted Answer

Transform the scanner output into the AWS Security Finding Format (ASFF) and send it to Security Hub using the BatchImportFindings API from a registered product integration.

Answer

Upload the raw JSON reports to an S3 bucket and enable Security Hub S3 ingestion to automatically parse and normalize the findings.

Answer

Configure the scanner to write findings to CloudWatch Logs and create a subscription filter that forwards log events directly into Security Hub.

Answer

Enable Amazon Inspector integration and point it at the custom scanner endpoint so Inspector republishes the results as its own findings.