Visualize AWS Security Hub Findings using Analytics and Business Intelligence Tools
AWS Architecture BlogVisualize AWS Security Hub Findings using Analytics and Business Intelligence Toolsby Sujatha Kuppuraju, Muthu Pitchaimani, Christopher Sharkey, and Siva Rajamani | on01 SEP 2021| inAmazon Athena,Amazon OpenSearch Service,Amazon QuickSight,Architecture,AWS Security Hub|Permalink|ShareSeptember 8, 2021: Amazon Elasticsearch Service has been renamed to Amazon OpenSearch Service.See details.To improve the security posture in your organization, you first must have a comprehensive view of your security, operations, and compliance data.AWS Security Hubgives you a thorough view of your security alerts and security posture across all your AWS accounts. This is shown as Security Hub findings, which are generated from different AWS services and partner products. Security Hub also provides the capability to filter, aggregate, and visualize these findings asSecurity Hub insights.Organizations have additional requirements to centralize the Security Hub findings into their existing operational store. They also must connect the findings with other operational data. In this blog, we share two architecture design options, which collect Security Hub findings across Regions. You can make these findings searchable, and build multiple visualization dashboards using analytics and BI Tools in order to gain insights.Some of the benefits of these architectures:Ability to combine Security Hub findings across Regions and generate a single dashboard viewAbility to combine the various security and compliance data into a single centralized dashboardAbility to correlate security and compliance findings with operational data. This can beAWS CloudTraillogs and customer logs for deeper analysis and insightsAbility to build a security and compliance scorecard across various dimensions. This is achieved by combining the Security Hub findings and AWS resource inventory generated using an enterprise-wide tagging strategyApproach to visualize Security Hub findings in multi-account environmentsThere are four steps involved in this approach, as shown in Figure 1:Figure 1. Steps involved in improving the visibility of AWS Security Hub findingsSet up your AWS Security Hub administrator account.Designate one of the AWS accounts within yourAWS Organizationsto be a delegated administrator for Security Hub. This account can manage and receive and findings acrossmember accounts.Enable AWS Security Hub in member accounts.Enable required security standards, AWS native service integration, and partner integrations in all the member accounts across your AWS Regions.Export and consolidate findings.For each Region you operate in, collect findings and consolidate across Regions by ingesting the findings to a centralized repository.Query and visualize insights.Query the findings from the centralized findings repository and build dashboards for visualizations.Design option one: View Security Hub findings using AWS serverless analytics servicesThis option, shown in Figure 2, usesAmazon Athena, a serverless, interactive, query service that analyzes data inAmazon Simple Storage Service (S3)using standard SQL.AWS Glue, a serverless, data integration service discovers, prepares, and combines data for analytics, machine learning (ML), and application development is also used.Amazon QuickSight, a scalable, serverless, embeddable, ML-powered, business intelligence (BI) service is used to search and visualize Security Hub findings from multiple accounts and Regions.Figure 2. Architecture to view Security Hub findings using AWS serverless analytics servicesArchitecture overviewDesignate an AWS account in your AWS Organization as a delegated administrator for Security Hub. This account willpublish eventstoAmazon EventBridgefor its own findings, in addition to findings received from member accounts.Configure the EventBridge rule to deliver the Security Hub finding event type intoAmazon Kinesis Data Firehose. If you are operating in multiple Regions set up an EventBridge rule and Kinesis Data Firehose in each of those Regions.Set up Kinesis Data Firehose in multiple Regions to deliver data into a Single S3 bucket, which helps to consolidate findings across multiple Regions.Partition the data in your S3-based by account number, Region, date, and other preferred parameters.Use AWS Glue to crawl the S3 bucket and build the schema of the Security Hub findings. This is used by Amazon Athena to query the data. You can create aviewin Athena to flatten some of the nested attributes in the Security Hub findings.Build your Amazon QuickSight dashboard using the view created in Athena.Figure 3 shows a sample dashboard created in QuickSight to view consolidated Security Hub findings across accounts and Regions.Figure 3. Sample Security Hub findings dashboard created using Amazon QuickSightDesign option two: View Security Hub findings using a managed Amazon ES cluster and KibanaThis option, shown in Figure 4, uses a managedAmazon Elasticsearch Servicecluster to ingest the findings, and Kibana to search and visualize the findings. Amazon Elasticsearch Service is a fully managed service that allows you to deploy, secure, and run Elasticsearch cost-effectively, and at scale.Figure 4. Architecture to view Security Hub findings using Amazon ES cluster and KibanaArchitecture overviewSimilar to the previous design option, the Security Hub administrator accountpublishes eventstoAmazon EventBridgefor findings.Configure the EventBridge rule to deliver the Security Hub finding event type intoAmazon Kinesis Data Firehose. If you are operating in multiple Regions, then you must set up an EventBridge rule and Kinesis Data Firehose in each of those Regions.It’s recommended that you set up Kinesis Data Firehose in multiple Regions to deliver data into a central Amazon ES cluster. This serves as a single pane of glass for security findings across these different Regions.UseKibana, a popular open source visualization tool designed to work with Elasticsearch. You’ll be able to create visualizations and dashboards to analyze and share your findings.Amazon ES can help you configure rules on the findings to send specialized alerts. When coupled withanomaly detection, Amazon ES can automatically detect anomalies in your findings data using unsupervised machine learning algorithm and alert you in near-real.Figure 5 shows a sample dashboard created in Kibana to view consolidated Security Hub findings across accounts and Regions in an Elasticsearch cluster.Figure 5. Sample Security Hub findings dashboard created in KibanaConclusionIn this post, we showed you two architectural design options to collect AWS Security Hub findings across multiple AWS Regions in a multi-account AWS environment. These approaches allow you to connect the AWS Security Hub findings with other operational data. This makes it searchable, and will allow you to draw insights and achieve an improved organization-wide security posture. These options use AWS managed and serverless services, which are scalable and configurable for high availability and performance. Make your design choice based on your enterprise needs for search, analytics, and insights visualization options.Further Reading:Accessing and visualizing data from multiple data sources with Amazon Athena and Amazon QuickSightAWS Security Finding Format (ASFF)AWS Security Hub Automated Response and RemediationSujatha KuppurajuSujatha Kuppuraju is a Senior Solutions Architect at Amazon Web Services (AWS). She engages with customers to create innovative solutions that address customer business problems and accelerate the adoption of AWS services.Muthu PitchaimaniMuthu Pitchaimani is a Search Specialist. He helps build applications and solutions that need searching for large scale data. Muthu is based out of Austin, Texas.Christopher SharkeyChris is an Analytics Specialist Solution Architect. He helps build and architect solutions with AWS analytics products. Chris is based out of Boston, MA.Siva RajamaniSiva Rajamani is a Boston-based Enterprise Solutions Architect at AWS. He enjoys working closely with customers and supporting their digital transformation and AWS adoption journey. His core areas of focus are Serverless, Application Integration, and Security.
September 8, 2021: Amazon Elasticsearch Service has been renamed to Amazon OpenSearch Service. See details. To improve the security posture in your organization, you first must have a comprehensive view of your security, operations, and compliance data. AWS Security Hub gives you a thorough view of your security alerts and security posture across all your […]
Sujatha Kuppuraju
Amazon Athena Amazon OpenSearch Service Amazon QuickSight Architecture AWS Security Hub