- [Sujatha] Hello, everyone.
I'm Sujatha Kuppuraju, solutions architect with AWS.
I'm joining with my peers Siva Rajamani
and Christopher Sharkey to talk about the approach
to visualize AWS Security Hub findings
using Amazon QuickSight.
AWS Security Hub provides you with a comprehensive view
of your security state within AWS, and your compliance
with security standards and best practices.
Security Hub, centralizes, and prioritizes security findings
from across AWS accounts, services,
and supported third-party partners
to help you analyze your security trends and identify
the highest priority security issues.
Findings are summarized
on integrated dashboards with graphs, charts,
and tables to help you easily identify potential issues
and take the necessary next steps.
In addition to built-in dashboards,
customers like to connect Security Hub findings
with their existing operational data store
and build visualizations using Amazon QuickSight to
make data-driven decisions.
A couple of use cases are connecting Security Hub findings
with AWS CloudTrail logs to get deeper insights,
and even connecting AWS resources
meta data with Security Hub findings
and build security and compliance scorecard.
There are four main strips involved to
view Security Hub findings with Amazon QuickSight.
Initial two strips are setting
up Security Hub administrator account
and enabling Security Hub in member accounts.
Let us see how to do that.
Connect to a management account
and set up a delegated administrator for Security Hub.
This account is granted access to view findings
for associated member accounts.
From your Security Hub administrator account,
choose member accounts and select the aggregations region.
This is the region in which you can manage,
view, and manage findings.
Make sure to enable Security Hub in your member accounts
for regions you are operating.
Once Security Hub is enabled in member accounts
and findings are gathered,
you can view the consolidated findings from the admin
account and aggregation region.
Now let me hand over to Siva
to explain the approach to export consolidated findings.
- [Siva] Now that you have Security Hub configured
with an administrator account
and an aggregation region to consolidate your findings,
the next step is to export the findings
into a central location for dashboarding and visualization.
AWS Security Hub automatically sends all new findings
and all updates to existing findings
to EventBridge as EventBridge events.
Each event contains a single finding.
You can define rules
in EventBridge that automatically routes findings
to a Amazon S3 Bucket.
The solution approach creates an EventBridge rule
in the Security Hub administrator account and
in the aggregation region with Amazon Kinesis Data Firehose
as a target for the EventBridge rule to automatically
deliver the Security Hub findings to a S3 Bucket.
Amazon Kinesis Data Firehose is a fully-managed service
for delivering data into data stores,
data lakes, and analytic tools.
With Kinesis Data Firehose,
you configure your data producers to send data
to Kinesis Data Firehose
and it automatically delivers the data
to the destination that you specify.
Tn this case, the S3 Bucket.
Let us see how to configure the EventBridge rule
with Amazon Kinesis Data Firehose
as target to export the findings
into S three Bucket within AWS management console.
I have already created the Amazon S3 Bucket
and also the IAM role with permissions
for Kinesis Data Firehose to ride to the S3 Bucket.
Let's now navigate to Kinesis Console
to create the Firehose delivery stream.
For source, choose Direct PUT.
For destination, Amazon S3.
Provide a name for the delivery stream.
Keep the settings default for transform and convert records.
Under the destination settings, choose S3 Bucket created
for storing the security of findings by clicking
on the browse button and searching for the bucket name.
Under the advanced settings, for the permissions,
I have chosen the existing IAM role
that I have created already.
Create the delivery stream.
It can take up to five minutes
for the creative delivery stream to be available.
The status will show us active once created.
The next step is to create an EventBridge rule
for the security of findings.
For this, let's navigate to the EventBridge console.
Provide a name for the rule.
Under the defined pattern section,
choose event pattern.
For the event matching pattern,
choose predefined pattern by service.
The service provided to be AWS, service name as Security Hub
and event type as Security Hub findings imported.
Under the target section,
choose Firehose delivery stream and choose
the stream that was created in the previous step.
Create the rule.
Now that the EventBridge rule is created
after a few minutes, you can validate the security
of findings are exported to the S3 Bucket
by checking the contents of the S3 Bucket.
With the security of findings now available in S3 Bucket,
the next step is to create dashboards for visualization.
For that, I will turn this
over to Chris to cover the steps involved.
- [Chris] Let's look at how we can visualize the results
and insights that are generated by AWS Security Hub.
As Siva showed you, the finding
that Security Hub have are stored
in Amazon S3 as a GZ JSON file.
Our end goal is to be able to build dashboards
against the data that's inside of S3.
We build these dashboards using Amazon QuickSight
QuickSight, however, has a few pieces
before it that help it process this JSON data.
Specifically, we use Amazon Athena in combination
with the Glue Data Catalog and the Glue Crawler to
be able to easily consume the insights that are generated
by AWS Security Hub and are placed
in our S3 Bucket by Kinesis Data Firehose.
Let's take a look at the in the AWS console.
I'm now with the AWS console.
Siva showed us in the previous slide that we had JSON data
in our S3 Bucket, and that those were the findings
from our Security Hub.
We can begin our process
by going to AWS Glue.
Within Glue, I've created a crawler.
We can view the details of the crawler here.
And this crawler's set to crawl
or look at the log data that's been generated.
The crawler generates a glued metadata table,
which you can see here.
The primary benefit of running the crawler is the generation
of this metadata, or essentially the specifics of the schema
of the insights that are generated by Security Hub.
You could notice in particular
we have this detail column and within that
there's a more complex JSON structure that has lots
of useful information.
Generating this Glue data catalog table from that crawler
which I showed you allows us to come to AWS Athena.
Athena gives us the ability to easily query data within S3.
You could see that I have here the table that was generated
by the crawler.
We can run a query
on that table and take a look at the data.
You'll see that we have useful information,
such as the account, time, the region.
However, we have this one field in particular, resource,
which has a lot of submit-properties
to it and lots of useful information.
Ideally, we want to flatten this JSON array
into a structure that's easier to query.
There's multiple ways to do this,
including, in the case of Data Firehose,
a Lambda function that can automatic do this, or in my case
what I've done is I've used some built-in functions
in Athena for processing JSON to flatten that structure.
I've used SQL and created a view here.
You could see the view present here.
I've named it Security Hub.
When I query this view,
what you'll see is we have all the columns from before,
but in addition, we have many extra columns,
such as product ARN, types, so on and so forth.
And again, what this is is the SQL query
inside of the view is breaking down
that JSON in the details column of the original table.
Now that data's easy to query, we can come to QuickSight.
I have already created a data setting
QuickSight that's connected to that Athena table,
or view, I should say, that I just showed you.
And really from here
it's quite straightforward to build a nice dashboard
where we can take a look at all different kinds of insights.
You'll see here, I have all
of these different columns available.
These are the columns that I parsed out in the view.
And just to give you an example, I have some filters up top.
I can filter on resource, type, region, account.
And as an example, here, I have findings by severity.
We can see that we have 38 high severity, 28 medium.
From this point on, QuickSight can be used
to easily generate all kinds of visuals.
- [Sujatha] The approach that we showed here
uses multiple AWS services,
such as Amazon EventBridge, Amazon S3,
Amazon Kinesis Data Firehose, AWS Glue, and Amazon Athena,
along with AWS Security Hub and Amazon QuickSight.
So when you perform cost estimation to build
this solution, consider pricing factors
and price calculation for all services included
in this design.
In this video, we showed you an approach to visualize AWS
Security Hub findings using Amazon QuickSight.
Exporting Security Hub findings to centralized repository,
connecting with operational data and making them
searchable will allow you to draw meaningful insights,
which in turn help you achieve an improved
organization-wide security posture.
Thank you.