Skip to content

Commit

Permalink
Merge pull request #868 from hlxsites/an-cc-9-1
Browse files Browse the repository at this point in the history
[CSPM Content Collections] AWS Security Hub Integration updates (new PR)
  • Loading branch information
Aishbn authored Sep 5, 2024
2 parents 5ab5084 + dc69026 commit ff530f5
Show file tree
Hide file tree
Showing 5 changed files with 19 additions and 21 deletions.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
Expand Up @@ -4,21 +4,19 @@
== Integrate Prisma Cloud with AWS Security Hub
Learn how to integrate Prisma® Cloud with AWS Security Hub so that you can view and monitor your security posture on AWS Security Hub.

You can use AWS Security Hub as a central console to view and monitor the security posture of your cloud assets on AWS Security Hub.

Integrate Prisma® Cloud with AWS Security Hub for centralized visibility into security and compliance risks associated with your cloud assets on the AWS Security Hub console.

As part of the integration, Prisma Cloud monitors your assets on your AWS cloud and sends alerts about resource misconfigurations, compliance violations, network security risks, and anomalous user activities directly to the AWS Security Hub console so that you have a comprehensive view of the cloud assets deployed on your AWS accounts.

As a part of the integration, Prisma Cloud monitors your AWS cloud assets. It sends alerts about resource misconfigurations, compliance violations, network security risks, and anomalous user activities directly to the AWS Security Hub console providing a centralized and comprehensive view of the cloud assets deployed on your AWS accounts.

NOTE: Prisma Cloud integration with AWS Security Hub is not supported for US Gov Cloud regions.


[.procedure]
. Attach an AWS Security Hub read-only policy to your AWS role to enable this integration on the AWS console.
+
.. Log in to the AWS console and select IAM.

.. Select *Roles* and search for the role name which you had used for onboarding your account on Prisma Cloud.
.. Select *Roles* and search for the role name used to onboard your account on Prisma Cloud.

.. Click on that role name and *Add permissions > Attach Policies*.
+
Expand Down Expand Up @@ -48,41 +46,41 @@ image::administration/securityhub-enabled-prisma-cloud.png[]

. Set up the AWS Security Hub Integration on Prisma Cloud.
+
Set up the AWS Security Hub as an integration channel on Prisma Cloud so that you can view security alerts and compliance status for all your AWS services from the AWS console.
Set up the AWS Security Hub as an integration channel on Prisma Cloud so that you can view security alerts and compliance status for all your AWS services from the AWS console.
+
.. Log in to Prisma Cloud.

.. Select *Settings > Integrations*.
.. Select *Settings > Integrations & Notifications*.

.. *Add Integration > AWS Security Hub*. A modal wizard opens where you can add the AWS Security Hub integration.
+
image::administration/amazon-s3-int-1.png[]
.. *Add Integration > AWS Security Hub*. A modal wizard will open, allowing you to add the details for the AWS Security Hub integration.

.. Set the *Integration Name* to the AWS account to which you assigned AWS Security Hub read-only access.
.. Set the *Integration Name* to the AWS account to which you assigned AWS Security Hub read-only access.

.. Enter a *Description* and select a *Region*.
.. Enter an optional *Description* and select a *Region*.
+
You select regions only if you enabled Prisma Cloud on AWS Security Hub for your cloud account.
Make sure to select the region where Prisma Cloud on AWS Security Hub is enabled for your cloud account, or else you will receive an error while testing the integration.
+
image::administration/aws-security-hub-int-1.png[]
image::administration/aws-security-hub-integrate-1.png[]

.. *Next*. Review the *Summary* and either *edit* to make changes or *Test*.
.. Click *Next*, review the *Summary*, and then *Test Integration*.
+
image::administration/aws-security-hub-int-2.png[]
image::administration/aws-security-hub-integrate-2.png[]

.. *Save* the integration.
.. *Save Integration* if the test is successful.
+
image::administration/aws-security-hub-integrate-3.png[]
+
After you set up the integration successfully, you can use the Get Status link in *Settings > Integrations* to periodically check the integration status.
Once you successfully set up the integration, you will find it listed on the Integrations page. You can *View*, *Edit*, or *Delete* the integration from the *Actions* panel. You can also check the integration status periodically by clicking on the *Get Status* link.
+
image::administration/get-status.png[]
image::administration/aws-security-hub-integrate-4.png[]



. Modify an existing alert rule or create a new alert rule to specify when to xref:../../alerts/send-prisma-cloud-alert-notifications-to-third-party-tools.adoc[send alert notifications].
+
[NOTE]
====
If you have integrated an AWS Organization account with Security Hub on Prisma Cloud, it is considered as a standalone account. This means you will only receive alerts for the master account on Security Hub, not its child accounts. If you want to receive alerts for every child account linked to that master account, you must repeat Steps 1 through 3 and then configure alert rules for each account.
If you have integrated an AWS Organization account with Security Hub on Prisma Cloud, it is considered a standalone account. This means you will only receive alerts for the master account on Security Hub, not its child accounts. To receive alerts for every child account linked to that master account, you must repeat Steps 1 through 3 and then configure alert rules for each account.
====

. View Prisma Cloud alerts on AWS Security Hub.
Expand All @@ -91,7 +89,7 @@ If you have integrated an AWS Organization account with Security Hub on Prisma C

.. Click *Findings* to view the alerts.

.. Select the *Title* to view details the alert description.
.. Select the *Title* to view details of the alert description.
+
image::administration/securityhub-findings-details.png[]

Expand Down

0 comments on commit ff530f5

Please sign in to comment.