> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Security Hub

> Integrate Plerion with AWS Security Hub to send alerts as findings for centralized visibility, compliance, and security posture management.

With the [AWS Security Hub integration](https://app.plerion.com/settings/integrations/add/AWS/SecurityHub), you can automatically send alerts from Plerion into AWS Security Hub. Alerts can include findings based on parameters you define, such as risk score, publicly exposed resources, sensitive data, or administrative privileges.

<Warning>
  **Note:** This is a one-way outbound integration. Alerts created or updated in Plerion will appear in AWS Security Hub, but changes made directly in Security Hub will not sync back to Plerion.
</Warning>

## Steps to integrate AWS Security Hub with Plerion

<Steps>
  <Step title="On the Plerion dashboard, go to Settings > Integrations">
    <img src="https://mintcdn.com/pleriondocs/8xtCYjlATlNqKv2p/images/integrations/jira/settings-integrations-sidenav.png?fit=max&auto=format&n=8xtCYjlATlNqKv2p&q=85&s=2169fd65750b670507500adcfea7a96e" alt="Integrations menu on the navigation sidebar" width="655" height="853" data-path="images/integrations/jira/settings-integrations-sidenav.png" />
  </Step>

  <Step title="Find Security Hub and click the + button">
    <Frame>
      <img src="https://mintcdn.com/pleriondocs/jiIXcoNASwOdbAti/images/integrations/securityhub/add-security-hub.png?fit=max&auto=format&n=jiIXcoNASwOdbAti&q=85&s=34401b50aaa76c12d638f2fd903d4112" alt="Integrations page with Security Hub  option and plus button" width="626" height="428" data-path="images/integrations/securityhub/add-security-hub.png" />
    </Frame>
  </Step>

  <Step title="Enter a name for your integration">
    <Frame>
      <img src="https://mintcdn.com/pleriondocs/jiIXcoNASwOdbAti/images/integrations/securityhub/add-integration.png?fit=max&auto=format&n=jiIXcoNASwOdbAti&q=85&s=e25618c5977e170fdf635b12088b62c7" alt="AWS Security Hub integration page with Integration name field" width="1718" height="608" data-path="images/integrations/securityhub/add-integration.png" />
    </Frame>
  </Step>

  <Step title="Click Add to save the integration" />

  <Step title="Accept findings in AWS Security Hub">
    Open the AWS Security Hub console and accept findings from Plerion.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/jiIXcoNASwOdbAti/images/integrations/securityhub/integrate-plerion.png?fit=max&auto=format&n=jiIXcoNASwOdbAti&q=85&s=ecd027894063e6094c9c351411a9e911" alt="AWS Security Hub console showing prompt to accept Plerion findings" width="1776" height="1346" data-path="images/integrations/securityhub/integrate-plerion.png" />
    </Frame>
  </Step>
</Steps>

## Steps to remove AWS Security Hub integration

<Steps>
  <Step title="Delete the integration in Plerion">
    Go to the integration information page and click the <Icon icon="trash" /> icon.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/jiIXcoNASwOdbAti/images/integrations/securityhub/delete-integration.png?fit=max&auto=format&n=jiIXcoNASwOdbAti&q=85&s=720b5fa5d1f90717bf3ab65e76cb0210" alt="Plerion interface showing delete integration option" width="567" height="416" data-path="images/integrations/securityhub/delete-integration.png" />
    </Frame>
  </Step>

  <Step title="Stop accepting findings in AWS Security Hub">
    In the AWS Security Hub console, stop accepting findings from Plerion.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/jiIXcoNASwOdbAti/images/integrations/securityhub/stop-finding.png?fit=max&auto=format&n=jiIXcoNASwOdbAti&q=85&s=7899f639f267c7402f3b2a7eb4f68730" alt="AWS Security Hub console showing disable findings option for Plerion" width="567" height="591" data-path="images/integrations/securityhub/stop-finding.png" />
    </Frame>
  </Step>
</Steps>

## Architecture

<Frame>
  <img src="https://mintcdn.com/pleriondocs/jiIXcoNASwOdbAti/images/integrations/securityhub/architecture.png?fit=max&auto=format&n=jiIXcoNASwOdbAti&q=85&s=d7f33dd0032c4b93a4a56a0db9c9deb0" alt="AWS Security Hub integration architecture diagram" width="1337" height="542" data-path="images/integrations/securityhub/architecture.png" />
</Frame>

Plerion alerts are routed through Amazon EventBridge and Amazon SQS to an AWS Lambda function. Lambda processes alerts in batches, validates them, and delivers them to Security Hub in **AWS Security Finding Format (ASFF)**.

* Delivery status and alert state are tracked in a database.
* Failed deliveries are stored in a Dead-Letter Queue (DLQ) for review and resubmission.

This ensures reliability and consistency when sending findings to Security Hub.

## FAQ

1. **How long does it take for findings to appear in AWS Security Hub?**\
   Findings are delivered within **2–3 minutes** of being generated in Plerion.

2. **How is the Plerion risk score mapped to the ASFF severity label?**

   | Risk score | ASFF severity label |
   | ---------- | ------------------- |
   | 0.0        | INFORMATIONAL       |
   | 0.1–3.999  | LOW                 |
   | 4.0–6.999  | MEDIUM              |
   | 7.0–8.999  | HIGH                |
   | 9.0–10.0   | CRITICAL            |

3. **How are alerts mapped to ASFF findings?**\
   Alerts are transformed into AWS Security Finding Format (ASFF) objects. Example:

   ```json theme={"system"}
   {
     "SchemaVersion": "2018-10-08",
     "Id": "<prn>/<workflowId>/<openedAtExecutionTimestamp>",
     "ProductName": "Plerion Workflow Engine",
     "CompanyName": "Plerion",
     "GeneratorId": "<integrationId>",
     "Types": ["Software and Configuration Checks"],
     "FirstObservedAt": "<openedAtExecutionTimestamp>",
     "Title": "<alertTitle>",
     "Description": "<alertSummary>",
     "ProductFields": {
       "IntegrationId": "<integrationId>",
       "IntegrationName": "<integrationName>",
       "WorkflowId": "<workflowId>",
       "WorkflowName": "<workflowName>",
       "TenantId": "<tenantId>",
       "TenantName": "<tenantName>"
     },
     "Resources": [
       {
         "Type": "<resourceTypeMappedToASFF>",
         "Id": "<fullResourceName>"
       }
     ],
     "Workflow": {
       "Status": "NEW"
     },
     "FindingProviderFields": {
       "Severity": {
         "Label": "<riskScoreMappedToASFF>"
       }
     }
   }
   ```