[aws_securityhub] Initial release of AWS Security Hub by brijesh-elastic · Pull Request #15932 · elastic/integrations

brijesh-elastic · 2025-11-11T11:18:04Z

Proposed commit message

aws_securityhub: Initial release of AWS Security Hub

the integration collects findings in OCSF format using GetFindingsV2 API, it supports
OCSF v1.5 classes(2002, 2003, 2004, 2006).

ECS mapping and transforms have also been added to facilitate with the
Cloud Native Vulnerability Management (CNVM)[1] workflow.

[1] https://www.elastic.co/guide/en/security/current/vuln-management-overview.html

Note

To Reviewers:

Please refer to this guide: https://docs.elastic.dev/security-solution/cloud-security/cdr/3p-dev-guide which was used for proposed changes.
OCSF to ECS Mapping Analysis Document

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/aws_securityhub directory.
Run the following command to run tests.

elastic-package test

Related issues

…issions (#137866) Adding logs-aws_securityhub.finding-* data stream indices to the kibana_system privileges. This is required for the latest transform to work. Related: elastic/integrations#15932

elasticmachine · 2025-12-02T04:12:40Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

elastic-vault-github-plugin-prod · 2025-12-02T13:51:10Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

packages/aws_securityhub/_dev/build/docs/README.md

packages/aws_securityhub/data_stream/finding/agent/stream/cel.yml.hbs

...aws_securityhub/data_stream/finding/elasticsearch/ingest_pipeline/pipeline_object_device.yml

packages/aws_securityhub/data_stream/finding/elasticsearch/ingest_pipeline/default.yml

...ityhub/data_stream/finding/elasticsearch/ingest_pipeline/pipeline_object_vulnerabilities.yml

packages/aws_securityhub/data_stream/finding/fields/ecs.yml

packages/aws_securityhub/data_stream/finding/fields/fields.yml

packages/aws_securityhub/elasticsearch/transform/latest_cdr_vulnerabilities/fields/fields.yml

packages/aws_securityhub/elasticsearch/transform/latest_findings/fields/fields.yml

efd6 · 2025-12-03T02:56:56Z

I think also that the document that forms the basis of the OCSF to ECS mapping should be made public and linked in the commit message.

packages/aws_securityhub/_dev/build/docs/README.md

maxcold · 2025-12-03T11:00:47Z

@kcreddy @brijesh-elastic Tested the env with data ingested. All good except missing host.name . In the mapping sheet we discussed that we want to provide the instance id in the host.name. Did we miss this requirement or were there any technical challenges doing so?

brijesh-elastic · 2025-12-03T12:14:28Z

@kcreddy @brijesh-elastic Tested the env with data ingested. All good except missing host.name . In the mapping sheet we discussed that we want to provide the instance id in the host.name. Did we miss this requirement or were there any technical challenges doing so?

It looks like I missed it. I’ll update this in the next commit, along with the cluster.

kcreddy

To be merged after #16195

packages/aws_securityhub/_dev/build/docs/README.md

packages/aws_securityhub/data_stream/finding/_dev/test/pipeline/test-common-config.yml

packages/aws_securityhub/_dev/deploy/docker/files/config.yml

packages/aws_securityhub/data_stream/finding/manifest.yml

packages/aws_securityhub/data_stream/finding/elasticsearch/ingest_pipeline/default.yml

brijesh-elastic · 2025-12-05T03:23:02Z

I think also that the document that forms the basis of the OCSF to ECS mapping should be made public and linked in the commit message.

@kcreddy @ShourieG, should we make the CDR mapping sheet and RFC document for OCSF to ECS public?

kcreddy · 2025-12-05T04:13:12Z

CDR mapping sheet

@brijesh-elastic, spreadsheet permissions already there. You can share the link with reviewers, but Dan's point is on OCSF to ECS.

ShourieG · 2025-12-08T05:59:12Z

I think also that the document that forms the basis of the OCSF to ECS mapping should be made public and linked in the commit message.

@kcreddy @ShourieG, should we make the CDR mapping sheet and RFC document for OCSF to ECS public?

Yes, I agree with making the OCSF to ECS mapping documents public, we can link it in the PR description

maxcold

tested on provided environment, everything working as expected from our flows perspective

packages/aws_securityhub/manifest.yml

packages/aws_securityhub/data_stream/finding/manifest.yml

packages/aws_securityhub/data_stream/finding/elasticsearch/ingest_pipeline/default.yml

kcreddy

LGTM. Thanks @brijesh-elastic

elasticmachine · 2025-12-12T06:37:52Z

💚 Build Succeeded

Buildkite Build
Commit: 55b23f9

History

💚 Build #35355 succeeded 0c68cf2
💚 Build #35336 succeeded 2cc447b
💚 Build #35113 succeeded 72e4968
💔 Build #35111 failed f238280
💚 Build #35109 succeeded 6ed2466
💚 Build #34955 succeeded aeebca9

cc @brijesh-elastic

ShourieG

LGTM

elastic-vault-github-plugin-prod · 2025-12-15T13:33:27Z

Package aws_securityhub - 0.1.0 containing this change is available at https://epr.elastic.co/package/aws_securityhub/0.1.0/

Initial release

0e62d7d

brijesh-elastic self-assigned this Nov 11, 2025

Update changelog entry and codeowners

be3cd17

brijesh-elastic mentioned this pull request Nov 11, 2025

Add aws_securityhub.finding source indices to kibana_system role permissions elastic/elasticsearch#137866

Merged

andrewkroh added the New Integration Issue or pull request for creating a new integration package. label Nov 11, 2025

brijesh-elastic and others added 2 commits November 21, 2025 13:12

Merge branch 'main' into package-aws_securityhub

5d9dd72

Fix bugs and add transform for latest findings

60d0198

brijesh-elastic marked this pull request as ready for review December 2, 2025 04:12

brijesh-elastic requested a review from a team as a code owner December 2, 2025 04:12

Resolve build failure

aeebca9

efd6 reviewed Dec 2, 2025

View reviewed changes

kcreddy reviewed Dec 3, 2025

View reviewed changes

packages/aws_securityhub/_dev/build/docs/README.md Outdated Show resolved Hide resolved

packages/aws_securityhub/_dev/build/docs/README.md Outdated Show resolved Hide resolved

packages/aws_securityhub/_dev/build/docs/README.md Outdated Show resolved Hide resolved

kcreddy reviewed Dec 3, 2025

View reviewed changes

address pr comment

6ed2466

add optional parameters of aws.auth

f238280

brijesh-elastic added 2 commits December 5, 2025 09:51

update readme

6ca5550

resolve pipeline test failure

72e4968

brijesh-elastic requested review from efd6 and kcreddy December 5, 2025 05:40

maxcold self-requested a review December 8, 2025 15:32

maxcold approved these changes Dec 8, 2025

View reviewed changes

kcreddy reviewed Dec 9, 2025

View reviewed changes

packages/aws_securityhub/manifest.yml Show resolved Hide resolved

packages/aws_securityhub/data_stream/finding/manifest.yml Show resolved Hide resolved

packages/aws_securityhub/data_stream/finding/elasticsearch/ingest_pipeline/default.yml Show resolved Hide resolved

brijesh-elastic added 2 commits December 10, 2025 09:55

implement dashboard

2cc447b

update min_value and max_value for assume_role_duration

0c68cf2

kcreddy approved these changes Dec 10, 2025

View reviewed changes

andrewkroh added the dashboard Relates to a Kibana dashboard bug, enhancement, or modification. label Dec 10, 2025

Use LF in constructing rule.remediation

55b23f9

ShourieG approved these changes Dec 15, 2025

View reviewed changes

brijesh-elastic merged commit 4fe1f8c into elastic:main Dec 15, 2025
8 checks passed

nick-alayil mentioned this pull request Dec 17, 2025

[Internal]: Rebrand AWS Security Hub as AWS Security Hub CSPM elastic/docs-content#4382

Closed

andrewkroh added the Integration:aws_securityhub AWS Security Hub label Jan 8, 2026

Comments

Conversation

brijesh-elastic commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related issues

Uh oh!

elasticmachine commented Dec 2, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Dec 2, 2025

🚀 Benchmarks report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

efd6 commented Dec 3, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

maxcold commented Dec 3, 2025

Uh oh!

brijesh-elastic commented Dec 3, 2025

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

brijesh-elastic commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kcreddy commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ShourieG commented Dec 8, 2025

Uh oh!

maxcold left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Dec 12, 2025

💚 Build Succeeded

History

Uh oh!

ShourieG left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Dec 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

brijesh-elastic commented Nov 11, 2025 •

edited

Loading

brijesh-elastic commented Dec 5, 2025 •

edited

Loading

kcreddy commented Dec 5, 2025 •

edited

Loading