AWS Security Hub CSPM

Enabling Security Hub CSPM

Security Hub CSPM uses AWS Config to run the checks of its security standards. Enable AWS Config resource recording in every account and region where you enable Security Hub CSPM before you enable it. For more information, see Enabling and configuring AWS Config for Security Hub CSPM.

On your AWS console, search for security hub in the search bar to determine the best method for your environment. There are two ways to enable AWS Security Hub CSPM:

• Manual integration: We recommend this method for standalone accounts that aren't part of AWS Organizations. The screenshot below shows how to enable AWS Security Hub CSPM using the AWS Security Hub CSPM console. Follow the enabling Security Hub CSPM manually guideline to find other methods to enable the AWS Security Hub CSPM.

  

• Organizations integration: We recommend this method for multi-account and multi-region environments. Your organization must have a delegated administrator account. Follow the enabling Security Hub CSPM with organizations integration guidelines to set your AWS Security Hub CSPM using this method.

Creating a Firehose stream

The Amazon Data Firehose stream serves as the channel for sending the AWS Security Hub CSPM logs to the S3 bucket. Follow the steps below to create an Amazon Data Firehose stream for your AWS Security Hub CSPM logs.

1. Create a new S3 bucket, or skip this step to use an existing bucket.

2. On your AWS console, search for amazon data firehose in the search bar or go to Services > Analytics > Amazon Data Firehose.

   

3. Click Create Firehose stream.

   

4. Select Direct PUT and Amazon S3 as the desired Source and Destination, respectively, and choose an appropriate Firehose stream name.

   

5. Select the desired S3 bucket as the destination. It is possible to specify a custom prefix to alter the path where AWS stores the logs. Amazon Data Firehose creates a file structure YYYY/MM/DD/HH. If you use a prefix, the file structure is prefix-name/YYYY/MM/DD/HH. You don't need to set the prefix in Wazuh, because the Wazuh module for AWS gets the object keys from the SQS notifications. Select GZIP or ZIP compression to match the formats that the Wazuh module for AWS supports.

   

6. Create or choose an existing IAM role to be used by Amazon Data Firehose in the Advanced settings section.

   

7. Click Create Firehose stream at the end of the page.

   

Integrating Security Hub CSPM with EventBridge

Integrating Security Hub CSPM with EventBridge enables the storage of Security Hub CSPM events in S3 buckets.

There are three types of events available, each using a specific EventBridge event format. The Wazuh module for AWS takes every relevant detail and detail-type value from them.

• Security Hub Findings - Imported: Security Hub CSPM automatically sends events of this type to EventBridge. They include new findings and updates to existing findings, each containing a single finding.

• Security Hub Findings - Custom Action: When you trigger custom actions, Security Hub CSPM sends these events to EventBridge. The custom actions associate the events with their findings.

• Security Hub Insight Results: This event processes the Security Hub CSPM Insights. You can use custom actions to send sets of insight results to EventBridge. Insight results are the resources that match an insight.

To send the last two types of events to EventBridge, you need to create a custom action in Security Hub CSPM. Refer to the AWS Security Hub CSPM documentation to achieve this. Find more information about the types of Security Hub CSPM integration with EventBridge.

To integrate Security Hub CSPM with EventBridge, you must create an event rule in EventBridge.

1. On your AWS console, search for eventbridge in the search bar or go to Services > Application Integration > Amazon EventBridge.

   

2. Select Event buses, under Default event bus, click default, then click Create rule.

   

   On the default event bus page, click Create rule.

   

3. Select Advanced builder, assign a name to the EventBridge rule, and click Next.

   

4. In the Build event pattern section, choose AWS events or EventBridge partner events as Event source.

   

5. In the Event pattern section choose AWS services as Event source, Security Hub as AWS service, and All Events as Event type. Click Next to apply the configuration.

   

6. Under Select a target, choose Firehose stream and select the stream created previously. Also, create a new role to access the delivery stream. Click Next to apply the configuration.

   

7. Review the configuration and click Create rule.

   

The AWS documentation provides steps to configure an EventBridge rule for AWS Security Hub CSPM.

• Creating an event rule for automatically sent findings

• Defining a rule for using custom actions to send findings and insight results

Amazon S3 bucket with event notifications

Follow the steps below to configure an S3 bucket that reports the creation of events.

1. Configure an S3 bucket as defined in the configure an AWS S3 bucket section. Use the bucket that you selected as the destination of the Firehose stream.

2. Go to Event notifications inside the Properties tab, then click Create event notification.

3. Select All object create events in Event Types. The bucket then sends a notification for every event that creates an object in it.

4. Select SQS queue in the Destination section.

5. Select Choose from your SQS queues, then choose the queue you created previously.

Amazon Simple Queue Service

Amazon Simple Queue Service is a fully managed message queuing service that makes it easy to decouple and scale microservices, distributed systems, and serverless applications.

In this case, the queue receives the S3 notifications for new objects. The Wazuh module for AWS polls the queue to find the objects to pull from the S3 bucket.

1. Set up a Standard type SQS queue in the Amazon SQS console with the default configurations. You can apply an access policy similar to the following example. Replace <REGION>, <ACCOUNT_ID>, <S3_BUCKET>, <SQS_NAME> with your region, account ID, S3 bucket name, and SQS queue name.

   {
   "Version": "2012-10-17",
   "Id": "SecurityHub-ID",
   "Statement": [
     {
       "Sid": "example-access-policy",
       "Effect": "Allow",
       "Principal": {
         "Service": "s3.amazonaws.com"
       },
       "Action": "SQS:SendMessage",
       "Resource": "arn:aws:sqs:<REGION>:<ACCOUNT_ID>:<SQS_NAME>",
       "Condition": {
         "StringEquals": {
           "aws:SourceAccount": "<ACCOUNT_ID>"
         },
         "ArnLike": {
           "aws:SourceArn": "arn:aws:s3:*:*:<S3_BUCKET>"
         }
       }
     }
   ]
   }
   

   The other settings related to this configuration are:

   • "Version" specifies the version of the policy language being used, in this case, the version from 2012-10-17.

   • "Id" is a unique identifier for this policy.

   • "Statement" is an array that contains the individual permission statements for this policy.

   • "Sid" is an optional identifier that provides a way to give the statement a unique name.

   • "Effect" defines whether the statement results in an "Allow" or "Deny" for the specified actions.

   • "Principal" specifies the AWS service or account allowed to access the resource, in this case, the "s3.amazonaws.com" service.

   • "Action" specifies the action that is allowed or denied, in this case, "SQS:SendMessage", which allows sending messages to an SQS queue.

   • "Condition" specifies conditional elements that must be met for the policy to take effect.

   • "Resource" is the ARN of your SQS queue.

   • "aws:SourceAccount" is your AWS account ID.

   • "aws:SourceArn" is the ARN of the Amazon S3 bucket created for your AWS Security Hub CSPM logs.

You can also set your access policy to accept S3 notifications from different account IDs and apply different conditions. For more information, see managing access in Amazon SQS.

Policy configuration

Follow the creating an AWS policy guide to create a policy using the Amazon Web Services console. Attach a policy like the following to the AWS identity that the Wazuh module for AWS uses. Replace <REGION>, <ACCOUNT_ID>, <SQS_NAME>, and <S3_BUCKET> with your values.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ReadNotificationQueue",
            "Effect": "Allow",
            "Action": [
                "sqs:GetQueueUrl",
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage"
            ],
            "Resource": "arn:aws:sqs:<REGION>:<ACCOUNT_ID>:<SQS_NAME>"
        },
        {
            "Sid": "ReadLogBucket",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<S3_BUCKET>",
                "arn:aws:s3:::<S3_BUCKET>/*"
            ]
        }
    ]
}

Authentication

The available authentication methods are the following:

• IAM roles

• Profiles

These authentication methods require providing credentials using the /root/.aws/credentials file. For more information, see the Configure AWS credentials section.

Configuration

1. Make sure that the AWS integrations are enabled on the Wazuh dashboard, as described in Enable AWS integration on the Wazuh dashboard.

2. Add the SQS queue name to the <sqs_name> tag in the /var/ossec/etc/ossec.conf file, as in the following example. If the file already has a <wodle name="aws-s3"> block, add only the <subscriber> section to it:

   <wodle name="aws-s3">
       <disabled>no</disabled>
       <interval>1h</interval>
       <run_on_start>yes</run_on_start>
       <subscriber type="security_hub">
           <sqs_name><SQS_NAME></sqs_name>
           <aws_profile><PROFILE></aws_profile>
       </subscriber>
   </wodle>
   

   Where:

   • <interval> is the time taken between each log pull.

   • <run_on_start> pulls AWS Security Hub CSPM logs each time the Wazuh agent starts.

   • <subscriber type="security_hub"> are the added tags to obtain AWS Security Hub CSPM logs.

   • <sqs_name> is the name of the Amazon SQS queue created in the previous section.

   Optional

   • <service_endpoint> – The AWS S3 endpoint URL for data downloading from the bucket. Check Using VPC and FIPS endpoints for more information about VPC and FIPS endpoints.

3. Restart the Wazuh agent to apply the changes.

   # systemctl restart wazuh-agent
   

Check the Wazuh module for AWS reference to learn more about the available settings. For more information about the queue settings, check the subscribers reference.