AWS securityhub documentation change
Summary
Updated documentation to reflect rebranding from 'Security Hub' to 'Security Hub CSPM' (Cloud Security Posture Management) throughout the file, including updated integration descriptions and service references.
Security assessment
The changes emphasize CSPM (Cloud Security Posture Management) capabilities, which are security-focused, but there is no evidence of addressing a specific vulnerability or security incident. The updates primarily clarify security posture management features rather than patching vulnerabilities.
Diff
diff --git a/securityhub/latest/userguide/securityhub-internal-providers.md b/securityhub/latest/userguide/securityhub-internal-providers.md index 24d572beb..c5df73bb3 100644 --- a//securityhub/latest/userguide/securityhub-internal-providers.md +++ b//securityhub/latest/userguide/securityhub-internal-providers.md @@ -3 +3 @@ -[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[User Guide](what-is-securityhub.html) +[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[ User Guide ](what-is-security-hub-adv.html) @@ -5 +5 @@ -Overview of AWS service integrations with Security HubAWS services that send findings to Security HubAWS services that receive findings from Security Hub +Overview of AWS service integrations with Security Hub CSPMAWS services that send findings to Security Hub CSPMAWS services that receive findings from Security Hub CSPM @@ -7 +7 @@ Overview of AWS service integrations with Security HubAWS services that send fin -# AWS service integrations with Security Hub +# AWS service integrations with Security Hub CSPM @@ -9 +9 @@ Overview of AWS service integrations with Security HubAWS services that send fin -AWS Security Hub supports integrations with several other AWS services. +AWS Security Hub Cloud Security Posture Management (CSPM) supports integrations with several other AWS services. @@ -17 +17 @@ For a list of integrations that are available in the China Regions and AWS GovCl -Unless indicated below, AWS service integrations that send findings to Security Hub are automatically activated after you enable Security Hub and the other service. Integrations that receive Security Hub findings may require additional steps for activation. Review the information about each integration to learn more. +Unless indicated below, AWS service integrations that send findings to Security Hub CSPM are automatically activated after you enable Security Hub CSPM and the other service. Integrations that receive Security Hub CSPM findings may require additional steps for activation. Review the information about each integration to learn more. @@ -19 +19 @@ Unless indicated below, AWS service integrations that send findings to Security -## Overview of AWS service integrations with Security Hub +## Overview of AWS service integrations with Security Hub CSPM @@ -21 +21 @@ Unless indicated below, AWS service integrations that send findings to Security -Here is an overview of AWS services that send findings to Security Hub or receive findings from Security Hub. +Here is an overview of AWS services that send findings to Security Hub CSPM or receive findings from Security Hub CSPM. @@ -41 +41 @@ AWS Trusted Advisor | Receives findings -## AWS services that send findings to Security Hub +## AWS services that send findings to Security Hub CSPM @@ -43 +43 @@ AWS Trusted Advisor | Receives findings -The following AWS services integrate with Security Hub by sending findings to Security Hub. Security Hub converts the findings into the [AWS Security Finding Format](./securityhub-findings-format.html). +The following AWS services integrate with Security Hub CSPM by sending findings to Security Hub CSPM. Security Hub CSPM converts the findings into the [AWS Security Finding Format](./securityhub-findings-format.html). @@ -49 +49 @@ AWS Config is a service that allows you to assess, audit, and evaluate the confi -By using the integration with AWS Config, you can see the results of AWS Config managed and custom rule evaluations as findings in Security Hub. These findings can be viewed alongside other Security Hub findings, providing a comprehensive overview of your security posture. +By using the integration with AWS Config, you can see the results of AWS Config managed and custom rule evaluations as findings in Security Hub CSPM. These findings can be viewed alongside other Security Hub CSPM findings, providing a comprehensive overview of your security posture. @@ -51 +51 @@ By using the integration with AWS Config, you can see the results of AWS Config -AWS Config uses Amazon EventBridge to send AWS Config rule evaluations to Security Hub. Security Hub transforms the rule evaluations into findings that follow the [AWS Security Finding Format](./securityhub-findings-format.html). Security Hub then enriches the findings on a best effort basis by getting more information about the impacted resources, such as the Amazon Resource Name (ARN), resource tags, and creation date. +AWS Config uses Amazon EventBridge to send AWS Config rule evaluations to Security Hub CSPM. Security Hub CSPM transforms the rule evaluations into findings that follow the [AWS Security Finding Format](./securityhub-findings-format.html). Security Hub CSPM then enriches the findings on a best effort basis by getting more information about the impacted resources, such as the Amazon Resource Name (ARN), resource tags, and creation date. @@ -55 +55 @@ For more information about this integration, see the following sections. -All findings in Security Hub use the standard JSON format of ASFF. ASFF includes details about the origin of the finding, the affected resource, and the current status of the finding. AWS Config sends managed and custom rule evaluations to Security Hub via EventBridge. Security Hub transforms the rule evaluations into findings that follow ASFF and enriches the findings on a best effort basis. +All findings in Security Hub CSPM use the standard JSON format of ASFF. ASFF includes details about the origin of the finding, the affected resource, and the current status of the finding. AWS Config sends managed and custom rule evaluations to Security Hub CSPM via EventBridge. Security Hub CSPM transforms the rule evaluations into findings that follow ASFF and enriches the findings on a best effort basis. @@ -57 +57 @@ All findings in Security Hub use the standard JSON format of ASFF. ASFF includes -##### Types of findings that AWS Config sends to Security Hub +##### Types of findings that AWS Config sends to Security Hub CSPM @@ -59 +59 @@ All findings in Security Hub use the standard JSON format of ASFF. ASFF includes -After the integration is activated, AWS Config sends evaluations of all AWS Config managed rules and custom rules to Security Hub. Only evaluations that were performed after Security Hub was enabled are sent. For example, suppose that an AWS Config rule evaluation reveals five failed resources. If I enable Security Hub after that, and the rule then reveals a sixth failed resource, AWS Config sends only the sixth resource evaluation to Security Hub. +After the integration is activated, AWS Config sends evaluations of all AWS Config managed rules and custom rules to Security Hub CSPM. Only evaluations that were performed after Security Hub CSPM was enabled are sent. For example, suppose that an AWS Config rule evaluation reveals five failed resources. If I enable Security Hub CSPM after that, and the rule then reveals a sixth failed resource, AWS Config sends only the sixth resource evaluation to Security Hub CSPM. @@ -61 +61 @@ After the integration is activated, AWS Config sends evaluations of all AWS Conf -Evaluations from [service-linked AWS Config rules](./securityhub-setup-prereqs.html), such as those used to run checks on Security Hub controls, are excluded. +Evaluations from [service-linked AWS Config rules](./securityhub-setup-prereqs.html), such as those used to run checks on Security Hub CSPM controls, are excluded. @@ -63 +63 @@ Evaluations from [service-linked AWS Config rules](./securityhub-setup-prereqs.h -##### Sending AWS Config findings to Security Hub +##### Sending AWS Config findings to Security Hub CSPM @@ -65 +65 @@ Evaluations from [service-linked AWS Config rules](./securityhub-setup-prereqs.h -When the integration is activated, Security Hub will automatically assign the permissions necessary to receive findings from AWS Config. Security Hub uses service-to-service level permissions that provide you with a safe way to activate this integration and import findings from AWS Config via Amazon EventBridge. +When the integration is activated, Security Hub CSPM will automatically assign the permissions necessary to receive findings from AWS Config. Security Hub CSPM uses service-to-service level permissions that provide you with a safe way to activate this integration and import findings from AWS Config via Amazon EventBridge. @@ -69 +69 @@ When the integration is activated, Security Hub will automatically assign the pe -When AWS Config creates a new finding, you can usually view the finding in Security Hub within five minutes. +When AWS Config creates a new finding, you can usually view the finding in Security Hub CSPM within five minutes. @@ -71 +71 @@ When AWS Config creates a new finding, you can usually view the finding in Secur -##### Retrying when Security Hub is not available +##### Retrying when Security Hub CSPM is not available @@ -73 +73 @@ When AWS Config creates a new finding, you can usually view the finding in Secur -AWS Config sends findings to Security Hub on a best-effort basis through EventBridge. When an event isn't successfully delivered to Security Hub, EventBridge retries delivery for up to 24 hours or 185 times, whichever comes first. +AWS Config sends findings to Security Hub CSPM on a best-effort basis through EventBridge. When an event isn't successfully delivered to Security Hub CSPM, EventBridge retries delivery for up to 24 hours or 185 times, whichever comes first. @@ -75 +75 @@ AWS Config sends findings to Security Hub on a best-effort basis through EventBr -##### Updating existing AWS Config findings in Security Hub +##### Updating existing AWS Config findings in Security Hub CSPM @@ -77 +77 @@ AWS Config sends findings to Security Hub on a best-effort basis through EventBr -After AWS Config sends a finding to Security Hub, it can send updates to the same finding to Security Hub to reflect additional observations of the finding activity. Updates are only sent for `ComplianceChangeNotification` events. If no compliance change occurs, updates aren't sent to Security Hub. Security Hub deletes findings 90 days after the most recent update or 90 days after creation if no update occurs. +After AWS Config sends a finding to Security Hub CSPM, it can send updates to the same finding to Security Hub CSPM to reflect additional observations of the finding activity. Updates are only sent for `ComplianceChangeNotification` events. If no compliance change occurs, updates aren't sent to Security Hub CSPM. Security Hub CSPM deletes findings 90 days after the most recent update or 90 days after creation if no update occurs. @@ -79 +79 @@ After AWS Config sends a finding to Security Hub, it can send updates to the sam -Security Hub doesn't archive findings that are sent from AWS Config even if you delete the associated resource. +Security Hub CSPM doesn't archive findings that are sent from AWS Config even if you delete the associated resource. @@ -83 +83 @@ Security Hub doesn't archive findings that are sent from AWS Config even if you -AWS Config findings occur on a Regional basis. AWS Config sends findings to Security Hub in the same Region or Regions where the findings occur. +AWS Config findings occur on a Regional basis. AWS Config sends findings to Security Hub CSPM in the same Region or Regions where the findings occur. @@ -85 +85 @@ AWS Config findings occur on a Regional basis. AWS Config sends findings to Secu -To view your AWS Config findings, choose **Findings** from the Security Hub navigation pane. To filter the findings to display only AWS Config findings, choose **Product name** in the search bar drop down. Enter **Config** , and choose **Apply**. +To view your AWS Config findings, choose **Findings** from the Security Hub CSPM navigation pane. To filter the findings to display only AWS Config findings, choose **Product name** in the search bar drop down. Enter **Config** , and choose **Apply**. @@ -87 +87 @@ To view your AWS Config findings, choose **Findings** from the Security Hub navi -#### Interpreting AWS Config finding names in Security Hub +#### Interpreting AWS Config finding names in Security Hub CSPM @@ -89 +89 @@ To view your AWS Config findings, choose **Findings** from the Security Hub navi -Security Hub transforms AWS Config rule evaluations into findings that follow the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). AWS Config rule evaluations use a different event pattern compared to ASFF. The following table maps the AWS Config rule evaluation fields with their ASFF counterpart as they appear in Security Hub. +Security Hub CSPM transforms AWS Config rule evaluations into findings that follow the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). AWS Config rule evaluations use a different event pattern compared to ASFF. The following table maps the AWS Config rule evaluation fields with their ASFF counterpart as they appear in Security Hub CSPM. @@ -104 +104 @@ detail.configRuleName | Description | "This finding is created for a resource co -Configuration Item "ARN" or Security Hub computed ARN | Resources[i].id | +Configuration Item "ARN" or Security Hub CSPM computed ARN | Resources[i].id | @@ -121 +121 @@ All findings from AWS Config rule evaluations have a default severity label of * -Security Hub transforms AWS Config rule evaluations into findings that follow the ASFF. The following is an example of a typical finding from AWS Config in the ASFF. +Security Hub CSPM transforms AWS Config rule evaluations into findings that follow the ASFF. The following is an example of a typical finding from AWS Config in the ASFF. @@ -186 +186 @@ If the description is more than 1024 characters, it will be truncated to 1024 ch -After you enable Security Hub, this integration is activated automatically. AWS Config immediately begins to send findings to Security Hub. +After you enable Security Hub CSPM, this integration is activated automatically. AWS Config immediately begins to send findings to Security Hub CSPM. @@ -188 +188 @@ After you enable Security Hub, this integration is activated automatically. AWS -To stop sending findings to Security Hub, you can use the Security Hub console or Security Hub API. +To stop sending findings to Security Hub CSPM, you can use the Security Hub CSPM console or Security Hub CSPM API. @@ -190 +190 @@ To stop sending findings to Security Hub, you can use the Security Hub console o -For instructions on stopping the flow of findings, see [Enabling the flow of findings from an integration](./securityhub-integration-enable.html). +For instructions on stopping the flow of findings, see [Enabling the flow of findings from a Security Hub CSPM integration](./securityhub-integration-enable.html). @@ -194 +194 @@ For instructions on stopping the flow of findings, see [Enabling the flow of fin -Firewall Manager sends findings to Security Hub when a web application firewall (WAF) policy for resources or a web access control list (web ACL) rule is not in compliance. Firewall Manager also sends findings when AWS Shield Advanced is not protecting resources, or when an attack is identified. +Firewall Manager sends findings to Security Hub CSPM when a web application firewall (WAF) policy for resources or a web access control list (web ACL) rule is not in compliance. Firewall Manager also sends findings when AWS Shield Advanced is not protecting resources, or when an attack is identified. @@ -196 +196 @@ Firewall Manager sends findings to Security Hub when a web application firewall -After you enable Security Hub, this integration is automatically activated. Firewall Manager immediately begins to send findings to Security Hub. +After you enable Security Hub CSPM, this integration is automatically activated. Firewall Manager immediately begins to send findings to Security Hub CSPM. @@ -198 +198 @@ After you enable Security Hub, this integration is automatically activated. Fire -To learn more about the integration, view the **Integrations** page in the Security Hub console. +To learn more about the integration, view the **Integrations** page in the Security Hub CSPM console. @@ -204 +204 @@ To learn more about Firewall Manager, see the [_AWS WAF Developer Guide_](https: -GuardDuty sends all of the finding types that it generates to Security Hub. Some finding types have prerequisites, enablement requirements, or Regional limitations. For more information, see [GuardDuty finding types](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html) in the _Amazon GuardDuty User Guide_. +GuardDuty sends all of the finding types that it generates to Security Hub CSPM. Some finding types have prerequisites, enablement requirements, or Regional limitations. For more information, see [GuardDuty finding types](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html) in the _Amazon GuardDuty User Guide_. @@ -206 +206 @@ GuardDuty sends all of the finding types that it generates to Security Hub. Some -New findings from GuardDuty are sent to Security Hub within five minutes. Updates to findings are sent based on the **Updated findings** setting for Amazon EventBridge in GuardDuty settings. +New findings from GuardDuty are sent to Security Hub CSPM within five minutes. Updates to findings are sent based on the **Updated findings** setting for Amazon EventBridge in GuardDuty settings. @@ -208 +208 @@ New findings from GuardDuty are sent to Security Hub within five minutes. Update -When you generate GuardDuty sample findings using the GuardDuty **Settings** page, Security Hub receives the sample findings and omits the prefix `[Sample]` in the finding type. For example, the sample finding type in GuardDuty `[SAMPLE] Recon:IAMUser/ResourcePermissions` is displayed as `Recon:IAMUser/ResourcePermissions` in Security Hub. +When you generate GuardDuty sample findings using the GuardDuty **Settings** page, Security Hub CSPM receives the sample findings and omits the prefix `[Sample]` in the finding type. For example, the sample finding type in GuardDuty `[SAMPLE] Recon:IAMUser/ResourcePermissions` is displayed as `Recon:IAMUser/ResourcePermissions` in Security Hub CSPM. @@ -210 +210 @@ When you generate GuardDuty sample findings using the GuardDuty **Settings** pag -After you enable Security Hub, this integration is automatically activated. GuardDuty immediately begins to send findings to Security Hub. +After you enable Security Hub CSPM, this integration is automatically activated. GuardDuty immediately begins to send findings to Security Hub CSPM. @@ -212 +212 @@ After you enable Security Hub, this integration is automatically activated. Guar -For more information about the GuardDuty integration, see [Integrating with AWS Security Hub](https://docs.aws.amazon.com/guardduty/latest/ug/securityhub-integration.html) in the _Amazon GuardDuty User Guide_. +For more information about the GuardDuty integration, see [Integrating with AWS Security Hub Cloud Security Posture Management (CSPM)](https://docs.aws.amazon.com/guardduty/latest/ug/securityhub-integration.html) in the _Amazon GuardDuty User Guide_. @@ -218 +218 @@ AWS Health provides ongoing visibility into your resource performance and the av -The integration with AWS Health does not use `BatchImportFindings`. Instead, AWS Health uses service-to-service event messaging to send findings to Security Hub. +The integration with AWS Health does not use `BatchImportFindings`. Instead, AWS Health uses service-to-service event messaging to send findings to Security Hub CSPM. @@ -222 +222 @@ For more information about the integration, see the following sections. -In Security Hub, security issues are tracked as findings. Some findings come from issues that are detected by other AWS services or by third-party partners. Security Hub also has a set of rules that it uses to detect security issues and generate findings. +In Security Hub CSPM, security issues are tracked as findings. Some findings come from issues that are detected by other AWS services or by third-party partners. Security Hub CSPM also has a set of rules that it uses to detect security issues and generate findings. @@ -224 +224 @@ In Security Hub, security issues are tracked as findings. Some findings come fro -Security Hub provides tools to manage findings from across all of these sources. You can view and filter lists of findings and view details for a finding. See [Reviewing finding details and finding history in Security Hub](./securityhub-findings-viewing.html). You can also track the status of an investigation into a finding. See [Setting the workflow status of Security Hub findings](./findings-workflow-status.html). +Security Hub CSPM provides tools to manage findings from across all of these sources. You can view and filter lists of findings and view details for a finding. See [Reviewing finding details and history in Security Hub CSPM](./securityhub-findings-viewing.html). You can also track the status of an investigation into a finding. See [Setting the workflow status of findings in Security Hub CSPM](./findings-workflow-status.html). @@ -226 +226 @@ Security Hub provides tools to manage findings from across all of these sources. -All findings in Security Hub use a standard JSON format called the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). ASFF includes details about the source of the issue, the affected resources, and the current status of the finding. +All findings in Security Hub CSPM use a standard JSON format called the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). ASFF includes details about the source of the issue, the affected resources, and the current status of the finding. @@ -228 +228 @@ All findings in Security Hub use a standard JSON format called the [AWS Security -AWS Health is one of the AWS services that sends findings to Security Hub. +AWS Health is one of the AWS services that sends findings to Security Hub CSPM. @@ -230 +230 @@ AWS Health is one of the AWS services that sends findings to Security Hub. -##### Types of findings that AWS Health sends to Security Hub +##### Types of findings that AWS Health sends to Security Hub CSPM @@ -232 +232 @@ AWS Health is one of the AWS services that sends findings to Security Hub. -After the integration is enabled, AWS Health sends findings that meet one or more of the listed specifications to Security Hub. Security Hub ingests the findings in the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). +After the integration is enabled, AWS Health sends findings that meet one or more of the listed specifications to Security Hub CSPM. Security Hub CSPM ingests the findings in the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). @@ -317 +317 @@ After the integration is enabled, AWS Health sends findings that meet one or mor -##### Sending AWS Health findings to Security Hub +##### Sending AWS Health findings to Security Hub CSPM @@ -319 +319 @@ After the integration is enabled, AWS Health sends findings that meet one or mor -When you choose to accept findings from AWS Health, Security Hub will automatically assign the permissions necessary to receive the findings from AWS Health. Security Hub uses service-to-service level permissions that provide you with a safe, easy way to enable this integration and import findings from AWS Health via Amazon EventBridge on your behalf. Choosing **Accept Findings** grants Security Hub permission to consume findings from AWS Health. +When you choose to accept findings from AWS Health, Security Hub CSPM will automatically assign the permissions necessary to receive the findings from AWS Health. Security Hub CSPM uses service-to-service level permissions that provide you with a safe, easy way to enable this integration and import findings from AWS Health via Amazon EventBridge on your behalf. Choosing **Accept Findings** grants Security Hub CSPM permission to consume findings from AWS Health. @@ -323 +323 @@ When you choose to accept findings from AWS Health, Security Hub will automatica -When AWS Health creates a new finding, it is usually sent to Security Hub within five minutes. +When AWS Health creates a new finding, it is usually sent to Security Hub CSPM within five minutes. @@ -325 +325 @@ When AWS Health creates a new finding, it is usually sent to Security Hub within -##### Retrying when Security Hub is not available +##### Retrying when Security Hub CSPM is not available @@ -327 +327 @@ When AWS Health creates a new finding, it is usually sent to Security Hub within -AWS Health sends findings to Security Hub on a best-effort basis through EventBridge. When an event isn't successfully delivered to Security Hub, EventBridge retries sending the event for 24 hours. +AWS Health sends findings to Security Hub CSPM on a best-effort basis through EventBridge. When an event isn't successfully delivered to Security Hub CSPM, EventBridge retries sending the event for 24 hours. @@ -329 +329 @@ AWS Health sends findings to Security Hub on a best-effort basis through EventBr -##### Updating existing findings in Security Hub +##### Updating existing findings in Security Hub CSPM @@ -331 +331 @@ AWS Health sends findings to Security Hub on a best-effort basis through EventBr -After AWS Health sends a finding to Security Hub, it can send updates to the same finding to reflect additional observations of the finding activity to Security Hub. +After AWS Health sends a finding to Security Hub CSPM, it can send updates to the same finding to reflect additional observations of the finding activity to Security Hub CSPM. @@ -335 +335 @@ After AWS Health sends a finding to Security Hub, it can send updates to the sam -For global events, AWS Health sends findings to Security Hub in us-east-1 (AWS partition), cn-northwest-1 (China partition), and gov-us-west-1 (GovCloud partition). AWS Health sends Region-specific events to Security Hub in the same Region or Regions where the events occur. +For global events, AWS Health sends findings to Security Hub CSPM in us-east-1 (AWS partition), cn-northwest-1 (China partition), and gov-us-west-1 (GovCloud partition). AWS Health sends Region-specific events to Security Hub CSPM in the same Region or Regions where the events occur. @@ -337 +337 @@ For global events, AWS Health sends findings to Security Hub in us-east-1 (AWS p -To view your AWS Health findings in Security Hub, choose **Findings** from the navigation panel. To filter the findings to display only AWS Health findings, choose **Health** from the **Product name** field. +To view your AWS Health findings in Security Hub CSPM, choose **Findings** from the navigation panel. To filter the findings to display only AWS Health findings, choose **Health** from the **Product name** field. @@ -339 +339 @@ To view your AWS Health findings in Security Hub, choose **Findings** from the n -##### Interpreting AWS Health finding names in Security Hub +##### Interpreting AWS Health finding names in Security Hub CSPM @@ -341 +341 @@ To view your AWS Health findings in Security Hub, choose **Findings** from the n -AWS Health sends the findings to Security Hub using the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). AWS Health finding uses a different event pattern compared to Security Hub ASFF format. The table below details all the AWS Health finding fields with their ASFF counterpart as they appear in Security Hub. +AWS Health sends the findings to Security Hub CSPM using the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). AWS Health finding uses a different event pattern compared to Security Hub CSPM ASFF format. The table below details all the AWS Health finding fields with their ASFF counterpart as they appear in Security Hub CSPM. @@ -395 +395 @@ Severity **MEDIUM** if: -AWS Health sends findings to Security Hub using the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). The following is an example of a typical finding from AWS Health. +AWS Health sends findings to Security Hub CSPM using the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). The following is an example of a typical finding from AWS Health. @@ -448 +448 @@ If the description is more than 1024 characters, it will be truncated to 1024 ch -After you enable Security Hub, this integration is automatically activated. AWS Health immediately begins to send findings to Security Hub. +After you enable Security Hub CSPM, this integration is automatically activated. AWS Health immediately begins to send findings to Security Hub CSPM. @@ -450 +450 @@ After you enable Security Hub, this integration is automatically activated. AWS -To stop sending findings to Security Hub, you can use the Security Hub console or Security Hub API. +To stop sending findings to Security Hub CSPM, you can use the Security Hub CSPM console or Security Hub CSPM API. @@ -452 +452 @@ To stop sending findings to Security Hub, you can use the Security Hub console o -For instructions on stopping the flow of findings, see [Enabling the flow of findings from an integration](./securityhub-integration-enable.html). +For instructions on stopping the flow of findings, see [Enabling the flow of findings from a Security Hub CSPM integration](./securityhub-integration-enable.html). @@ -456 +456 @@ For instructions on stopping the flow of findings, see [Enabling the flow of fin -With IAM Access Analyzer, all findings are sent to Security Hub. +With IAM Access Analyzer, all findings are sent to Security Hub CSPM. @@ -460 +460 @@ IAM Access Analyzer uses logic-based reasoning to analyze resource-based policie -In IAM Access Analyzer, only the administrator account can see findings for analyzers that apply to an organization. For organization analyzers, the `AwsAccountId` ASFF field reflects the administrator account ID. Under `ProductFields`, the `ResourceOwnerAccount` field indicates the account in which the finding was discovered. If you enable analyzers individually for each account, Security Hub generates multiple findings, one that identifies the administrator account ID and one that identifies the resource account ID. +In IAM Access Analyzer, only the administrator account can see findings for analyzers that apply to an organization. For organization analyzers, the `AwsAccountId` ASFF field reflects the administrator account ID. Under `ProductFields`, the `ResourceOwnerAccount` field indicates the account in which the finding was discovered. If you enable analyzers individually for each account, Security Hub CSPM generates multiple findings, one that identifies the administrator account ID and one that identifies the resource account ID. @@ -462 +462 @@ In IAM Access Analyzer, only the administrator account can see findings for anal -For more information, see [Integration with AWS Security Hub](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-securityhub-integration.html) in the _IAM User Guide_. +For more information, see [Integration with AWS Security Hub Cloud Security Posture Management (CSPM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-securityhub-integration.html) in the _IAM User Guide_. @@ -468 +468 @@ Amazon Inspector is a vulnerability management service that continuously scans y