Comment maîtriser AWS Security Hub en 2026

#!/bin/bash

# Assumer us-east-1, adapter si besoin
aws securityhub enable-security-hub \
  --region us-east-1 \
  --enable-default-standards

# Vérifier le statut
aws securityhub describe-hub --region us-east-1

# Activer standards CIS AWS Foundations et PCI DSS
aws securityhub batch-enable-standards \
  --standards-arns "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0" \
  "arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1" \
  --region us-east-1

# Lister les standards activés
aws securityhub describe-standards --region us-east-1

#!/bin/bash

# Créer un detector GuardDuty (si pas déjà fait)
aws guardduty create-detector --enable \
  --data-sources '{"MalwareProtection":{},"S3DataEvents":{},"Kubernetes":{}}' \
  --region us-east-1

# Obtenir l'ID du detector
DETECTOR_ID=$(aws guardduty list-detectors --region us-east-1 --query 'DetectorIds[0]' --output text)

# Activer les data sources
aws guardduty update-detector --detector-id $DETECTOR_ID \
  --enable S3Logs,MalwareProtection,KubernetesAuditLogs \
  --region us-east-1

# Dans Security Hub, l'intégration est auto après activation
# Lister les findings récents (top 10 HIGH/CRITICAL)
aws securityhub get-findings \
  --filters '{"SeverityLabel":["HIGH","CRITICAL"],"UpdatedAt":{"DateRange":{"Value":30,"Unit":"DAYS"}}}' \
  --region us-east-1 | jq '.Findings[0:2]'

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Custom Security Hub Controls'

Resources:
  CustomControl:
    Type: AWS::SecurityHub::Insight
    Properties:
      Name: CustomHighRiskEC2
      Filters:
        ProductArn:
          Eq: 'arn:aws:securityhub:us-east-1::product/aws/guardduty'
        SeverityLabel:
          Eq: 'CRITICAL'
        AwsAccountId:
          Contains:
            - !Ref AWS::AccountId
      GroupByAttribute: ResourceRegion

  AutomationRule:
    Type: AWS::SecurityHub::AutomationRule
    Properties:
      RuleName: AutoArchiveOldFindings
      RuleArn: !GetAtt CustomControl.RuleArn
      Criteria:
        UpdatedAt:
          LessThan: '2024-01-01T00:00:00Z'
      Actions:
        - Type: AUTOMATION
          AutomationRuleParameters:
            ActionType: REMEDIATE
            FindingFields:
              WorkflowStatus: SUPPRESSED

import { APIGatewayProxyHandler } from 'aws-lambda';
import { SecurityHubClient, BatchUpdateFindingsCommand } from '@aws-sdk/client-securityhub';

const client = new SecurityHubClient({ region: 'us-east-1' });

export const handler: APIGatewayProxyHandler = async (event) => {
  const body = JSON.parse(event.body || '{}');
  const findingId = body.detail.findings[0].Id;
  const resourceArn = body.detail.findings[0].Resources[0].Id;

  // Mise à jour workflow : NEW -> SUPPRESSED après check
  const updateParams = {
    FindingIdentifiers: [{ Id: findingId, ProductArn: 'arn:aws:securityhub:us-east-1::product/default' }],
    Note: { Text: `Auto-remédié le ${new Date().toISOString()}` },
    RecordState: 'ARCHIVED'
  };

  await client.send(new BatchUpdateFindingsCommand(updateParams));

  // Ex: Tagger l'EC2
  if (resourceArn.startsWith('arn:aws:ec2:')) {
    // Appel EC2 tag (simplifié)
    console.log(`Tag quarantaine sur ${resourceArn}`);
  }

  return { statusCode: 200, body: 'Remédiation OK' };
};

-- Assumer table SecurityHubFindings créée via AWS Glue
SELECT 
  account_id,
  COUNT(*) as finding_count,
  AVG(CAST(severity_normalized as DOUBLE)) as avg_severity,
  resources[1].type as resource_type
FROM securityhub_findings
WHERE severity_label IN ('CRITICAL', 'HIGH')
  AND updated_at >= date_add('day', -7, current_date)
GROUP BY account_id, resources[1].type
HAVING finding_count > 5
ORDER BY avg_severity DESC
LIMIT 10;