AWS securityhub documentation change
Summary
Major restructuring of dashboard documentation with added sections for considerations, available widgets, filters, and expanded operational details. Adds data retention policies, widget configuration guidance, and explicit security best practices.
Security assessment
The changes add security documentation about data retention policies (1 year retention with scrubbing of terminated accounts) and explicitly warn against including sensitive information in filter sets. However, there is no evidence of addressing a specific vulnerability or security incident - these are general documentation improvements and feature explanations.
Diff
diff --git a/securityhub/latest/userguide/dashboard-v2.md b/securityhub/latest/userguide/dashboard-v2.md index 1a8d3d8a6..a615a4195 100644 --- a//securityhub/latest/userguide/dashboard-v2.md +++ b//securityhub/latest/userguide/dashboard-v2.md @@ -5 +5 @@ -Exposure summary widget Resource summary widget Security coverage widget Threat summary widget +ConsiderationsAvailable widgetsAvailable filters @@ -7 +7 @@ Exposure summary widget Resource summary widget Security coverage widget Thre -# Working in the Summary dashboard in Security Hub +# Working in the summary dashboard in Security Hub @@ -13 +13 @@ Security Hub is in preview release and is subject to change. -The **Summary** dashboard in the Security Hub console shows an overview of your exposures, resources, threats, and security coverage across multiple security widgets. Data automatically refreshes every time you open the **Summary** dashboard. +The **Summary** dashboard in the Security Hub console displays an overview of your exposures, threats, resources, and security coverage across security widgets. You can customize the dashboard by adding and removing widgets and by creating and applying filter sets to retrieve data in each widget. @@ -15 +15 @@ The **Summary** dashboard in the Security Hub console shows an overview of your -You can customize this page by adding and removing different security widgets and setting filter criteria to retrieve specific data in each widget. Customizations are saved for future use. If your account is the delegated administrator account for an organization, customizations are saved independently from customizations in member accounts. +## Considerations @@ -17 +17,161 @@ You can customize this page by adding and removing different security widgets an -If your account is the delegated administrator account for an organization, data includes findings for your account and member accounts. If your account is a member account or a standalone account, data only includes findings for your account. If you configure cross-Region aggregation in Security Hub, the **Summary** dashboard shows findings in your aggregation. +Consider the following before interacting with the dashboard: + + * Customizations like saved filter sets or changes to the layout of widgets are saved automatically. + + * Data automatically refreshes every time you open the dashboard. + + * If you configure cross-Region aggregation, the dashboard includes findings from all of your linked regions (when viewing the dashboard in your home region). + + + + +Consider the following if your account is a delegated administrator account for an organization, member account in an organization, or standalone account. + + * Customizations made by a delegated administrator account will be saved independently from customizations made by member accounts. Customizations might include saved filter sets or changes to the layout of widgets. + + * If your account is the delegated administrator account for an organization, data includes findings for your account and member accounts. + + * If your account is a member account in an organization or a standalone account, data includes findings only for your account. + + + + +As a best practice, we recommend not including confidential, sensitive, or personally identifiable information (PII) in saved filter sets, custom widgets, or other related free-form text fields. + +## Available widgets + +You can interact with different widgets in the **Executive** and **Triage** tabs of the **Summary** dashboard. The **Executive** tab includes widgets that display trends data for your exposures, threats, and resources and the **Security Coverage** widget to help track your account coverage across different security capabilities. The **Triage** tab includes widgets that display a summary of your exposures, threats, and resources. However, you can add widgets, remove widgets, and manage the position of each widget in both tabs to customize your experience. + +### Trends widgets + +The following widgets display trends data for your exposures, threats, and resources, so you can analyze them over time. + +#### Trends overview widget + + + +This widget displays an overview of your exposures, threats, resources, and findings in the following time periods: + + * **Month-over-month** reflects the period-over-period count for the last two months. + + * **Week-over-week** reflects the period-over-period count for the past two weeks. + + * **Day-over-day** reflects the period-over-period count for the past 2 days. + + + + +The number next to the percentage reflects the average period-over-period count to date. Choosing this number directs you to its corresponding dashboard in the console. If you navigate to another dashboard that displays trends data, the dashboard only displays trends data for the last 90 days or in a best-fit time period if your account does not contain findings or resources older than 30 days. + +###### Note + +To receive data in this widget, you must enable the following security services: + + * **AWS Security Hub CSPM** – To receive data about exposures + + * **Amazon Inspector** – To receive data about exposures + + * **GuardDuty** – To receive data about threats + + + + +#### Exposure finding trends widget + + + +This widget displays the severity of your exposure findings in the following time periods: + + * **5 days** + + * **30 days** + + * **90 days** + + * **6 months** + + * **1 year** + + + + +The visualization displays the average count of your findings over the selected time period. + +###### Severity filters + +You can update the graph by including or excluding the following severity filters: + + * **Fatal** + + * **Critical** + + * **High** + + * **Medium** + + * **Low** + + * **Informational** + + * **Other** + + * **Unknown** + + + + +Applied severity filters show at the bottom of the visualization in different boxes. You can hover over the visualization to review the average count of findings for specific points in time. You can also review the average count of findings that match each applied severity filter. + +You can choose **View all current exposure findings** to be directed to the **Exposure** dashboard. By default, the **Exposure** dashboard only displays trends data for the last 90 days. If your account does not contain exposure findings older than 30 days, the dashboard displays trends data based on a best-fit time period. + +###### Note + +To receive data in this widget, you must enable [Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/getting_started.html) and [Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html). + +#### Threat finding trends widget + + + +This widget displays the severity of your threat findings in the following time periods: + + * **5 days** + + * **30 days** + + * **90 days** + + * **6 months** + + * **1 year** + + + + +The visualization displays the average count of your findings over the selected time period. + +###### Severity filters + +You can update the graph by including or excluding the following severity filters: + + * **Fatal** + + * **Critical** + + * **High** + + * **Medium** + + * **Low** + + * **Informational** + + * **Other** + + * **Unknown** + + + + +Applied severity filters show at the bottom of the visualization in different boxes. You can hover over the visualization to review the average count of findings for specific points in time. You can also review the average count of findings that match each applied severity filter. + +You can choose **View all current threat findings** to be directed to the **Exposure** dashboard. By default, the **Threats** dashboard only displays trends data for the last 90 days. If your account does not contain threat findings older than 30 days, the dashboard displays trends data based on a best-fit time period. @@ -21 +181,30 @@ If your account is the delegated administrator account for an organization, data -We recommend that you do not include confidential, sensitive, or personally identifiable information (PII) in saved filters, custom widgets, or other related free-form text fields. +To receive data in this widget, you must enable [GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html). + +#### Resource trends widget + + + +This widget displays an inventory of your resources in the following time periods: + + * **5 days** + + * **30 days** + + * **90 days** + + * **6 months** + + * **1 year** + +