How to Master AWS Security Hub in 2026

#!/bin/bash

# Assume us-east-1, adapt if needed
aws securityhub enable-security-hub \
  --region us-east-1 \
  --enable-default-standards

# Check the status
aws securityhub describe-hub --region us-east-1

# Enable CIS AWS Foundations and PCI DSS standards
aws securityhub batch-enable-standards \
  --standards-arns "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0" \
  "arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1" \
  --region us-east-1

# List enabled standards
aws securityhub describe-standards --region us-east-1

#!/bin/bash

# Create a GuardDuty detector (if not already done)
aws guardduty create-detector --enable \
  --data-sources '{"MalwareProtection":{},"S3DataEvents":{},"Kubernetes":{}}' \
  --region us-east-1

# Get the detector ID
DETECTOR_ID=$(aws guardduty list-detectors --region us-east-1 --query 'DetectorIds[0]' --output text)

# Activate data sources
aws guardduty update-detector --detector-id $DETECTOR_ID \
  --enable S3Logs,MalwareProtection,KubernetesAuditLogs \
  --region us-east-1

# In Security Hub, integration is automatic after activation
# List recent findings (top 10 HIGH/CRITICAL)
aws securityhub get-findings \
  --filters '{"SeverityLabel":["HIGH","CRITICAL"],"UpdatedAt":{"DateRange":{"Value":30,"Unit":"DAYS"}}}' \
  --region us-east-1 | jq '.Findings[0:2]'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Custom Security Hub Controls'

Resources:
  CustomControl:
    Type: AWS::SecurityHub::Insight
    Properties:
      Name: CustomHighRiskEC2
      Filters:
        ProductArn:
          Eq: 'arn:aws:securityhub:us-east-1::product/aws/guardduty'
        SeverityLabel:
          Eq: 'CRITICAL'
        AwsAccountId:
          Contains:
            - !Ref AWS::AccountId
      GroupByAttribute: ResourceRegion

  AutomationRule:
    Type: AWS::SecurityHub::AutomationRule
    Properties:
      RuleName: AutoArchiveOldFindings
      RuleArn: !GetAtt CustomControl.RuleArn
      Criteria:
        UpdatedAt:
          LessThan: '2024-01-01T00:00:00Z'
      Actions:
        - Type: AUTOMATION
          AutomationRuleParameters:
            ActionType: REMEDIATE
            FindingFields:
              WorkflowStatus: SUPPRESSED

import { APIGatewayProxyHandler } from 'aws-lambda';
import { SecurityHubClient, BatchUpdateFindingsCommand } from '@aws-sdk/client-securityhub';

const client = new SecurityHubClient({ region: 'us-east-1' });

export const handler: APIGatewayProxyHandler = async (event) => {
  const body = JSON.parse(event.body || '{}');
  const findingId = body.detail.findings[0].Id;
  const resourceArn = body.detail.findings[0].Resources[0].Id;

  // Update workflow: NEW -> SUPPRESSED after check
  const updateParams = {
    FindingIdentifiers: [{ Id: findingId, ProductArn: 'arn:aws:securityhub:us-east-1::product/default' }],
    Note: { Text: `Auto-remediated on ${new Date().toISOString()}` },
    RecordState: 'ARCHIVED'
  };

  await client.send(new BatchUpdateFindingsCommand(updateParams));

  // Example: Tag the EC2 instance
  if (resourceArn.startsWith('arn:aws:ec2:')) {
    // EC2 tag call (simplified)
    console.log(`Quarantine tag on ${resourceArn}`);
  }

  return { statusCode: 200, body: 'Remediation OK' };
};

-- Assuming SecurityHubFindings table created via AWS Glue
SELECT 
  account_id,
  COUNT(*) as finding_count,
  AVG(CAST(severity_normalized as DOUBLE)) as avg_severity,
  resources[1].type as resource_type
FROM securityhub_findings
WHERE severity_label IN ('CRITICAL', 'HIGH')
  AND updated_at >= date_add('day', -7, current_date)
GROUP BY account_id, resources[1].type
HAVING finding_count > 5
ORDER BY avg_severity DESC
LIMIT 10;