AWS Security Hub

With the AWS Security Hub integration, you can automatically send alerts from Plerion into AWS Security Hub. Alerts can include findings based on parameters you define, such as risk score, publicly exposed resources, sensitive data, or administrative privileges.

​

Steps to integrate AWS Security Hub with Plerion

​

Steps to remove AWS Security Hub integration

​

Architecture

Plerion alerts are routed through Amazon EventBridge and Amazon SQS to an AWS Lambda function. Lambda processes alerts in batches, validates them, and delivers them to Security Hub in AWS Security Finding Format (ASFF).

• Delivery status and alert state are tracked in a database.
• Failed deliveries are stored in a Dead-Letter Queue (DLQ) for review and resubmission.

This ensures reliability and consistency when sending findings to Security Hub.

​

FAQ

1. How long does it take for findings to appear in AWS Security Hub?
   Findings are delivered within 2–3 minutes of being generated in Plerion.
2. How is the Plerion risk score mapped to the ASFF severity label?

   Risk score	ASFF severity label
   0.0	INFORMATIONAL
   0.1–3.999	LOW
   4.0–6.999	MEDIUM
   7.0–8.999	HIGH
   9.0–10.0	CRITICAL

3. How are alerts mapped to ASFF findings?
   Alerts are transformed into AWS Security Finding Format (ASFF) objects. Example:
   {
     "SchemaVersion": "2018-10-08",
     "Id": "<prn>/<workflowId>/<openedAtExecutionTimestamp>",
     "ProductName": "Plerion Workflow Engine",
     "CompanyName": "Plerion",
     "GeneratorId": "<integrationId>",
     "Types": ["Software and Configuration Checks"],
     "FirstObservedAt": "<openedAtExecutionTimestamp>",
     "Title": "<alertTitle>",
     "Description": "<alertSummary>",
     "ProductFields": {
       "IntegrationId": "<integrationId>",
       "IntegrationName": "<integrationName>",
       "WorkflowId": "<workflowId>",
       "WorkflowName": "<workflowName>",
       "TenantId": "<tenantId>",
       "TenantName": "<tenantName>"
     },
     "Resources": [
       {
         "Type": "<resourceTypeMappedToASFF>",
         "Id": "<fullResourceName>"
       }
     ],
     "Workflow": {
       "Status": "NEW"
     },
     "FindingProviderFields": {
       "Severity": {
         "Label": "<riskScoreMappedToASFF>"
       }
     }
   }