AWS Security Hub

Enabling Security Hub

Search for the “Security Hub” using the AWS console search bar to determine the best method that suits your environment. There are two ways to enable AWS Security Hub:

• Manual Integration: We recommend this method for standalone accounts with a single organization. The screenshot below shows how to enable AWS Security Hub using the AWS Security Hub console. Please follow the enabling Security Hub manually guideline to find other methods to enable the AWS Security Hub.

  

• Organizations integration: We recommend this method for multi-account and multi-region environments. Your organization must have a delegated administrator account. Please follow the enabling Security Hub with organizations integration guidelines to set your AWS Security Hub using this method.

Creating a Firehose stream

The Amazon Firehose stream serves as the channel for sending the AWS Security Hub logs to the S3 bucket. Follow the steps below to create an Amazon Firehose stream for your Amazon Security Hub logs.

1. Go to the Amazon Data Firehose service and click Create Firehose stream.

   

2. Select Direct PUT as the source and Amazon S3 as the destination.

   

3. Choose or create your proposed Amazon S3 bucket. You can use an Amazon S3 bucket prefix, but this is optional.

   

4. Click Create Firehose stream.

Integrating Security Hub with EventBridge

Integrating Security Hub with EventBridge enables the storage of Security Hub events in S3 buckets.

There are three types of events available, each using a specific Eventbridge event format. The Wazuh integration takes every relevant detail and detail-type value from them.

• Security Hub Findings - Imported: Security Hub automatically sends events of this type to EventBridge. They include new findings and updates to existing findings, each containing a single finding.

• Security Hub Findings - Custom Action: When you trigger custom actions, Security Hub sends these events to EventBridge. The custom actions associate the events with their findings.

• Security Hub Insight Results: This event processes the Security Hub Insights. You can use custom actions to send sets of insight results to EventBridge. Insight results are the resources that match an insight.

To send the last two types of events to EventBridge, you need to create a custom action in Security Hub. Please refer to the Amazon Security Hub documentation to achieve this. Find more information about the types of Security Hub integration with EventBridge.

To integrate Security Hub with EventBridge, you must create an event rule in EventBridge.

1. Go to the Amazon EventBridge and create a new EventBridge rule.

   

2. Enter a name for the rule and select Rule with an event pattern. Then click on Next.

   

3. Scroll down to Event pattern. Select Security Hub as the AWS service and All Events in the Event type. Then click on Next.

   

4. Select Firehose stream as the target, and use the Firehose stream you created in the previous section. Click on Next.

   

5. Leave the other default options and create the EventBridge rule.

The AWS documentation provides steps to configure an EventBridge rule for AWS Security Hub.

• Creating an event rule for automatically sent findings

• Defining a rule for using custom actions to send findings and insight results

Amazon S3 bucket with event notifications

Follow the steps below to configure an S3 bucket that reports the creation of events.

1. Configure an S3 bucket as defined in the configuring an AWS S3 Bucket section. Provide the name you decided in the previous section.

2. Go to Event notifications inside the Properties tab. Select Create event notification.

3. Select All object create events in Event Types. This generates notifications for any event that creates an object in the bucket.

4. Select SQS queue in the Destination section.

5. Select Choose from your SQS queues. Then, choose the queue you created previously.

Amazon Simple Queue Service

Amazon Simple Queue Service is a fully managed message queuing service that makes it easy to decouple and scale microservices, distributed systems, and serverless applications.

In this case, it acknowledges new events to pull from the S3 bucket.

1. Set up a Standard type SQS Queue with the default configurations. You can apply an access policy similar to the following example, where <REGION>, <AWS_ACCOUNT_ID>, <S3_BUCKET>, <YOUR_SQS_QUEUE_NAME> are your region, account ID, S3 bucket name, and SQS queue name.

   {
   "Version": "2012-10-17",
   "Id": "SecurityHub-ID",
   "Statement": [
     {
       "Sid": "example-access-policy",
       "Effect": "Allow",
       "Principal": {
         "Service": "s3.amazonaws.com"
       },
       "Action": "SQS:SendMessage",
       "Resource": "arn:aws:sqs:<REGION>:<AWS_ACCOUNT_ID>:<AWS_ACCOUNT_ID>:<YOUR_SQS_QUEUE_NAME>",
       "Condition": {
         "StringEquals": {
           "aws:SourceAccount": "<AWS_ACCOUNT_ID>"
         },
         "ArnLike": {
           "aws:SourceArn": "arn:aws:s3:*:*:<S3_BUCKET>"
         }
       }
     }
   ]
   }
   

   The other settings related to this configuration are:

   • "Version" specifies the version of the policy language being used, in this case, the version from 2012-10-17.

   • "Id" is a unique identifier for this policy.

   • "Statement" is an array that contains the individual permission statements for this policy.

   • "Sid" is an optional identifier that provides a way to give the statement a unique name.

   • "Effect" defines whether the statement results in an "Allow" or "Deny" for the specified actions.

   • "Principal" specifies the AWS service or account allowed to access the resource, in this case, the "s3.amazonaws.com" service.

   • "Action" specifies the action that is allowed or denied, in this case, "SQS", which allows sending messages to an SQS queue.

   • "Condition" specifies conditional elements that must be met for the policy to take effect.

   • "Resource" is the ARN of your SQS queue.

   • "aws:SourceAccount" is your AWS account ID.

   • "aws:SourceArn" is the ARN of the Amazon S3 bucket created for your Amazon Security Hub logs.

2. You can set your access policy to accept S3 notifications from different account IDs and apply different conditions. For more information, see managing access in Amazon SQS.

Authentication

The available authentication methods are the following:

• IAM Roles

• Profiles

These authentication methods require providing credentials using the /root/.aws/credentials file. For more information, see configuring AWS credentials.

Configuration

You can perform the following configuration on the Wazuh server or Linux-based Wazuh agent.

1. Edit the /var/ossec/etc/ossec.conf file. Add the SQS name within the <sqs_name> tag. For example:

   <wodle name="aws-s3">
       <disabled>no</disabled>
       <interval>1h</interval>
       <run_on_start>yes</run_on_start>
       <subscriber type="security_hub">
          <sqs_name>YOUR_SQS_QUEUE_NAME</sqs_name>
          <aws_profile>YOUR_AWS_CREDENTIAL_PROFILE</aws_profile>
      </subscriber>
   </wodle>
   

   Where:

   • <interval> is the time taken between each log pull.

   • <run_on_start> pulls AWS Security Hub logs each time the Wazuh server starts.

   • <subscriber type="security_hub"> are the added tags to obtain AWS Security Hub logs.

   • <sqs_name> is the name of the Amazon SQS queue created in the previous section.

   Optional

   • <service_endpoint> – The AWS S3 endpoint URL for data downloading from the bucket. Check using non-default AWS endpoints for more information about VPC and FIPS endpoints.

2. Restart the Wazuh server or agent to apply the changes.

   • Wazuh server:

     # systemctl restart wazuh-manager
     

   • Wazuh agent:

     # Systemctl restart Wazuh-agent
     

Check the AWS S3 module reference to learn more about the available settings. Configure the following fields to set the queue and authentication configuration. For more information, check the subscriber’s reference.

Visualizing the events

You can view these logs via the Threat Hunting dashboard of the agent you configured your Wazuh module for AWS.

The following dashboard shows the top 5 AWS Security Hub alerts discovered within 90 days.

The image below shows an event with a high severity.