AWS Security Hub #3589: SecurityHub Dashboard Overview and other dashboard improvements

[Udayel]

As we discussed in the demo call please consider adding the following resources to the AWS Security Hub overview dashboard:

• Findings by resource type
• Findings by Types
• Top 10 security hub findings
• Top 10 critical findings by severity
• Critical findings count comparison in last week
• Counts records by Severity
• Counts of records by service name

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[felix-lessoer]

Started to improve the Security Hub Dashboard. Any things you like to add?
Working on fixing the last issues.

[jamiehynds]

Thanks @felix-lessoer - once you finalised the dashboards would you minding submitting a PR and we can work through the review process? @Udayel any other suggestions you'd suggest?

[felix-lessoer]

Sure @jamiehynds

I have updates for many of the AWS dashboards in place

[Udayel]

Thank you @felix-lessoer. @jamiehynds Looks good to me. But some of the security findings raw events and geo map data still not showing in the default dashboard.I really appreciate if someone can look into that asap.

[felix-lessoer]

The data that I am able to produce does not include geo information.
Any ideas how to trigger it?

Also: Any doc that is of type aws.securityhub_insights does not include any information. The event.original field is always {"Insights":[]} . The Security Hub Console in AWS shows data. I think thats a bug in the Beat / Agent Integration.

[jamiehynds]

@vinit-elastic can you confirm if the lack of data within Insights is an issue on our side or on Security Hub?

[vinit-chauhan]

Hey @felix-lessoer - can you please increase the time range ( initial_interval ) of the connector and re-run it? I suspect the reason you are getting Insights: [] could be that there are no new insights.

edit: On top of that, in order to populate the map, you'll have to generate the events of the following Action type.
https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Action.html#securityhub-Type-Action-AwsApiCallAction
https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Action.html#securityhub-Type-Action-NetworkConnectionAction

[felix-lessoer]

@vinit-elastic The insights integration only has interval but not initial interval.
Initial interval is only available for findings.

[vinit-chauhan]

Ahh, my bad. You are right. For insights you'll have to generate the logs on the fly, with connector running.

[felix-lessoer]

Is it enough to click on "Create insight" in the AWS console?