AWS Security Hub Integration

Create IAM Policy and User

Create an IAM policy with Security Hub permissions and attach it to a user or role.

                # Create IAM policy for DB Audit Security Hub integration
cat > dbaudit-securityhub-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "securityhub:BatchImportFindings",
        "securityhub:GetFindings",
        "securityhub:UpdateFindings"
      ],
      "Resource": "*"
    }
  ]
}
EOF

# Create the policy
aws iam create-policy \
    --policy-name DBauditSecurityHubPolicy \
    --policy-document file://dbaudit-securityhub-policy.json

# Create IAM user (or role) and attach policy
aws iam create-user --user-name dbaudit-securityhub
aws iam attach-user-policy \
    --user-name dbaudit-securityhub \
    --policy-arn arn:aws:iam::ACCOUNT_ID:policy/DBauditSecurityHubPolicy

# Create access keys
aws iam create-access-key --user-name dbaudit-securityhub
              

Enable Security Hub

Enable Security Hub in your AWS account and register DB Audit as a product.

                # Register DB Audit as a Security Hub product integration
# This is typically done once per AWS account

# Option 1: Use custom product integration
aws securityhub create-product-subscription \
    --product-arn arn:aws:securityhub:us-east-1::product/dbaudit/database-audit

# Option 2: Register as custom product (if not in marketplace)
# The product ARN will be:
# arn:aws:securityhub:REGION:ACCOUNT_ID:product/ACCOUNT_ID/default

# Enable Security Hub if not already enabled
aws securityhub enable-security-hub

# Verify Security Hub is enabled
aws securityhub describe-hub
              

Test API Connection

Verify the IAM credentials can import findings to Security Hub.

                # Test Security Hub API access
aws securityhub describe-hub

# Test batch import with a sample finding
aws securityhub batch-import-findings --findings '[
  {
    "SchemaVersion": "2018-10-08",
    "Id": "dbaudit/test/123",
    "ProductArn": "arn:aws:securityhub:us-east-1:ACCOUNT_ID:product/ACCOUNT_ID/default",
    "GeneratorId": "dbaudit-test",
    "AwsAccountId": "ACCOUNT_ID",
    "Types": ["Software and Configuration Checks"],
    "CreatedAt": "2024-01-15T10:30:45Z",
    "UpdatedAt": "2024-01-15T10:30:45Z",
    "Severity": {"Label": "LOW"},
    "Title": "Test Finding from DB Audit",
    "Description": "Test finding to verify integration",
    "Resources": [{"Type": "Other", "Id": "test-resource"}]
  }
]'

# Verify the finding was imported
aws securityhub get-findings --filters '{"Id": [{"Value": "dbaudit/test/123", "Comparison": "EQUALS"}]}'
              

Configure in DB Audit

Add the AWS Security Hub integration in the DB Audit dashboard.

1. Navigate to Integrations → SIEM in DB Audit
2. Click Add SIEM Integration
3. Select AWS Security Hub as the provider
4. Enter your AWS region and credentials (or role ARN)
5. Enter your AWS account ID and product ARN
6. Select event types to forward
7. Test the connection and save

Create Custom Insights (Optional)

Create custom insights to aggregate and analyze DB Audit findings.

                # Create Security Hub custom insight for DB Audit

# Insight: Top database users by finding count
aws securityhub create-insight \
    --name "DB Audit - Top Users by Findings" \
    --filters '{
      "ProductName": [{"Value": "Database Audit", "Comparison": "EQUALS"}],
      "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
    }' \
    --group-by-attribute "ProductFields.dbaudit/User"

# Insight: Findings by database
aws securityhub create-insight \
    --name "DB Audit - Findings by Database" \
    --filters '{
      "ProductName": [{"Value": "Database Audit", "Comparison": "EQUALS"}]
    }' \
    --group-by-attribute "ProductFields.dbaudit/Database"

# Insight: PII access events
aws securityhub create-insight \
    --name "DB Audit - PII Access Events" \
    --filters '{
      "ProductFields": [
        {"Key": "dbaudit/ContainsPII", "Value": "true", "Comparison": "EQUALS"}
      ]
    }' \
    --group-by-attribute "ProductFields.dbaudit/User"