[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF0DSVDTFHGZB1MQG80E72":3,"skill-same:01M6AF0DSVDTFHGZB1MQG80E72":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":72,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":76,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6AF0DSVDTFHGZB1MQG80E72","implementing-aws-security-hub-compliance",null,"Deploy AWS Security Hub, backed by AWS Config, to aggregate findings from GuardDuty, Inspector, Macie, Firewall Manager, and Prowler across multi-account AWS Organizations, enable standards like CIS AWS Foundations and PCI DSS, and automate remediation via EventBridge and Lambda. Use for centralizing AWS compliance monitoring or executive compliance dashboards; not for threat detection (GuardDuty) or data classification (Macie).","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub-compliance\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"implementing aws security hub compliance","compliance","aws","security","remediation","cspm","security-hub","t1078","macie","lambda","eventbridge","guardduty","firewall","prowler","data","cloud-security","monitoring","benchmark","config","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-aws-security-hub-compliance\ndescription: 'Deploy AWS Security Hub, backed by AWS Config, to aggregate findings\n  from GuardDuty, Inspector, Macie, Firewall Manager, and Prowler across multi-account\n  AWS Organizations, enable standards like CIS AWS Foundations and PCI DSS, and automate\n  remediation via EventBridge and Lambda. Use for centralizing AWS compliance monitoring\n  or executive compliance dashboards; not for threat detection (GuardDuty) or data\n  classification (Macie).\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws\n- security-hub\n- compliance\n- cspm\n- cis-benchmark\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n---\n\n# Implementing AWS Security Hub Compliance\n\n## When to Use\n\n- When establishing centralized security posture management across multiple AWS accounts\n- When compliance requirements demand continuous monitoring against CIS, PCI DSS, or NIST 800-53 standards\n- When aggregating findings from GuardDuty, Inspector, Macie, Firewall Manager, and third-party tools\n- When building automated remediation workflows triggered by security findings\n- When executive stakeholders require a security compliance dashboard across the organization\n\n**Do not use** for real-time threat detection (use GuardDuty), for vulnerability scanning (use Inspector), or for data classification (use Macie). Security Hub aggregates findings from these services but does not replace them.\n\n## Prerequisites\n\n- AWS Organizations with delegated administrator for Security Hub\n- IAM permissions for `securityhub:*`, `config:*`, `events:*`, and `lambda:*`\n- AWS Config enabled in all target accounts and regions (required by Security Hub)\n- CloudFormation StackSets or Terraform for multi-account deployment\n- SNS topics configured for alert routing to security team\n\n## Workflow\n\n### Step 1: Enable Security Hub with Compliance Standards\n\nEnable Security Hub in the management account and select compliance standards to evaluate.\n\n```bash\n# Enable Security Hub in the current account\u002Fregion\naws securityhub enable-security-hub \\\n  --enable-default-standards \\\n  --control-finding-generator SECURITY_CONTROL\n\n# Enable specific compliance standards\naws securityhub batch-enable-standards --standards-subscription-requests \\\n  '[\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Faws-foundational-security-best-practices\u002Fv\u002F1.0.0\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Fcis-aws-foundations-benchmark\u002Fv\u002F1.4.0\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Fpci-dss\u002Fv\u002F3.2.1\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Fnist-800-53\u002Fv\u002F5.0.0\"}\n  ]'\n\n# Verify enabled standards\naws securityhub get-enabled-standards \\\n  --query 'StandardsSubscriptions[*].[StandardsArn,StandardsStatus]' --output table\n```\n\n### Step 2: Configure Multi-Account Aggregation\n\nSet up a delegated administrator and aggregate findings from all organization accounts.\n\n```bash\n# Designate a delegated admin (run from management account)\naws securityhub enable-organization-admin-account \\\n  --admin-account-id 111122223333\n\n# From the delegated admin account, enable auto-enrollment\naws securityhub update-organization-configuration \\\n  --auto-enable \\\n  --auto-enable-standards DEFAULT\n\n# Create a finding aggregator for cross-region aggregation\naws securityhub create-finding-aggregator \\\n  --region-linking-mode ALL_REGIONS\n\n# List member accounts\naws securityhub list-members \\\n  --query 'Members[*].[AccountId,MemberStatus]' --output table\n```\n\n### Step 3: Review Compliance Scores and Failed Controls\n\nQuery Security Hub for compliance posture across enabled standards and identify failing controls.\n\n```bash\n# Get overall compliance score for CIS benchmark\naws securityhub get-standards-control-associations \\\n  --security-control-id \"IAM.1\" \\\n  --query 'StandardsControlAssociationSummaries[*].[StandardsArn,AssociationStatus]' \\\n  --output table\n\n# List all failed controls\naws securityhub get-findings \\\n  --filters '{\n    \"ComplianceStatus\": [{\"Value\": \"FAILED\", \"Comparison\": \"EQUALS\"}],\n    \"RecordState\": [{\"Value\": \"ACTIVE\", \"Comparison\": \"EQUALS\"}],\n    \"WorkflowStatus\": [{\"Value\": \"NEW\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --sort-criteria '{\"Field\": \"SeverityNormalized\", \"SortOrder\": \"desc\"}' \\\n  --max-items 50 \\\n  --query 'Findings[*].[Title,Severity.Label,Compliance.Status,Resources[0].Id]' \\\n  --output table\n\n# Get finding counts by severity\naws securityhub get-insight-results \\\n  --insight-arn \"arn:aws:securityhub:us-east-1:111122223333:insight\u002F111122223333\u002Fdefault\u002F2\"\n```\n\n### Step 4: Create Custom Security Insights\n\nBuild custom insights to track organization-specific security priorities.\n\n```bash\n# Create insight for publicly accessible resources\naws securityhub create-insight \\\n  --name \"Publicly Accessible Resources\" \\\n  --filters '{\n    \"ResourceType\": [\n      {\"Value\": \"AwsS3Bucket\", \"Comparison\": \"EQUALS\"},\n      {\"Value\": \"AwsEc2SecurityGroup\", \"Comparison\": \"EQUALS\"},\n      {\"Value\": \"AwsRdsDbInstance\", \"Comparison\": \"EQUALS\"}\n    ],\n    \"ComplianceStatus\": [{\"Value\": \"FAILED\", \"Comparison\": \"EQUALS\"}],\n    \"SeverityLabel\": [{\"Value\": \"CRITICAL\", \"Comparison\": \"EQUALS\"}, {\"Value\": \"HIGH\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --group-by-attribute \"ResourceType\"\n\n# Create insight for unencrypted resources\naws securityhub create-insight \\\n  --name \"Unencrypted Resources Across Accounts\" \\\n  --filters '{\n    \"Title\": [{\"Value\": \"encryption\", \"Comparison\": \"CONTAINS\"}],\n    \"ComplianceStatus\": [{\"Value\": \"FAILED\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --group-by-attribute \"AwsAccountId\"\n```\n\n### Step 5: Configure Automated Remediation with EventBridge\n\nSet up EventBridge rules to trigger Lambda-based auto-remediation for specific finding types.\n\n```bash\n# Create EventBridge rule for Security Hub findings\naws events put-rule \\\n  --name \"security-hub-critical-findings\" \\\n  --event-pattern '{\n    \"source\": [\"aws.securityhub\"],\n    \"detail-type\": [\"Security Hub Findings - Imported\"],\n    \"detail\": {\n      \"findings\": {\n        \"Severity\": {\"Label\": [\"CRITICAL\"]},\n        \"Compliance\": {\"Status\": [\"FAILED\"]},\n        \"Workflow\": {\"Status\": [\"NEW\"]}\n      }\n    }\n  }'\n\n# Example Lambda auto-remediation for S3 public access (Python)\ncat > \u002Ftmp\u002Fremediate_s3.py \u003C\u003C 'PYEOF'\nimport boto3\nimport json\n\ndef lambda_handler(event, context):\n    s3 = boto3.client('s3')\n    securityhub = boto3.client('securityhub')\n\n    for finding in event['detail']['findings']:\n        if 'S3' in finding.get('Title', '') and 'public' in finding.get('Title', '').lower():\n            bucket_arn = finding['Resources'][0]['Id']\n            bucket_name = bucket_arn.split(':::')[-1]\n\n            s3.put_public_access_block(\n                Bucket=bucket_name,\n                PublicAccessBlockConfiguration={\n                    'BlockPublicAcls': True,\n                    'IgnorePublicAcls': True,\n                    'BlockPublicPolicy': True,\n                    'RestrictPublicBuckets': True\n                }\n            )\n\n            securityhub.batch_update_findings(\n                FindingIdentifiers=[{\n                    'Id': finding['Id'],\n                    'ProductArn': finding['ProductArn']\n                }],\n                Workflow={'Status': 'RESOLVED'},\n                Note={\n                    'Text': 'Auto-remediated: Block Public Access enabled',\n                    'UpdatedBy': 'security-hub-auto-remediation'\n                }\n            )\n    return {'statusCode': 200}\nPYEOF\n```\n\n### Step 6: Export Findings and Generate Compliance Reports\n\nExport Security Hub findings for reporting and integration with external SIEM or GRC platforms.\n\n```bash\n# Export all findings to S3 via a custom script\naws securityhub get-findings \\\n  --filters '{\n    \"RecordState\": [{\"Value\": \"ACTIVE\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --max-items 1000 \\\n  --output json > security-hub-findings-export.json\n\n# Send critical findings to SNS\naws sns publish \\\n  --topic-arn arn:aws:sns:us-east-1:111122223333:security-alerts \\\n  --subject \"Security Hub Daily Summary\" \\\n  --message file:\u002F\u002Fdaily-summary.json\n\n# Integrate with third-party SIEM via EventBridge\naws events put-targets \\\n  --rule security-hub-critical-findings \\\n  --targets '[{\n    \"Id\": \"splunk-hec\",\n    \"Arn\": \"arn:aws:events:us-east-1:111122223333:api-destination\u002Fsplunk-hec\",\n    \"HttpParameters\": {\n      \"HeaderParameters\": {\"Authorization\": \"Splunk HEC_TOKEN\"}\n    }\n  }]'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Security Hub | AWS service that aggregates security findings from AWS services and third-party tools, evaluates compliance against standards, and provides a unified security dashboard |\n| Security Standard | A predefined set of security controls (CIS, PCI DSS, NIST 800-53) that Security Hub evaluates against your AWS configuration |\n| Security Control | An individual check within a standard that evaluates a specific AWS resource configuration, such as whether S3 buckets block public access |\n| Finding | A security issue detected by Security Hub or an integrated service, formatted in AWS Security Finding Format (ASFF) |\n| Insight | A custom or managed grouping of findings by a specific attribute, providing aggregated views for security analysis |\n| ASFF | AWS Security Finding Format, the standardized JSON schema used by all Security Hub integrations for consistent finding representation |\n\n## Tools & Systems\n\n- **AWS Security Hub**: Central aggregation and compliance evaluation platform for security findings across AWS accounts\n- **AWS Config**: Configuration recording service required by Security Hub for evaluating resource compliance\n- **Amazon EventBridge**: Event bus for routing Security Hub findings to Lambda, SNS, or external remediation systems\n- **AWS Lambda**: Serverless compute for automated remediation functions triggered by Security Hub findings\n- **Prowler**: Open-source tool that can send findings to Security Hub via ASFF integration\n\n## Common Scenarios\n\n### Scenario: Rolling Out Security Hub Across a 50-Account Organization\n\n**Context**: A security team needs to enable Security Hub with CIS and FSBP standards across all accounts in an AWS Organization, with centralized finding aggregation and automated alerting.\n\n**Approach**:\n1. Enable Security Hub in the management account and designate a security account as delegated admin\n2. Configure auto-enable for all existing and new member accounts via `update-organization-configuration`\n3. Create a cross-region finding aggregator to consolidate findings from all regions into the admin account\n4. Enable CIS AWS Foundations 1.4 and AWS FSBP standards across all accounts\n5. Create EventBridge rules to route CRITICAL findings to PagerDuty and all findings to Splunk\n6. Build custom insights for the top organizational risks: public resources, missing encryption, unused credentials\n7. Schedule weekly compliance reports to stakeholders using Lambda and SES\n\n**Pitfalls**: Security Hub requires AWS Config to be enabled in every account and region. Failing to enable Config will result in controls showing as \"No data\" rather than PASSED or FAILED. Member accounts with Config disabled will silently produce incomplete compliance scores.\n\n## Output Format\n\n```\nAWS Security Hub Compliance Report\n=====================================\nOrganization: acme-corp (50 accounts)\nRegion: us-east-1 (aggregated from all regions)\nReport Date: 2026-02-23\nStandards Enabled: CIS 1.4, FSBP v1.0, PCI DSS 3.2.1\n\nCOMPLIANCE SCORES:\n  CIS AWS Foundations 1.4:     78% (142\u002F182 controls passing)\n  AWS FSBP v1.0.0:             85% (198\u002F233 controls passing)\n  PCI DSS 3.2.1:               72% (89\u002F124 controls passing)\n\nCRITICAL FINDINGS: 23\nHIGH FINDINGS: 87\nMEDIUM FINDINGS: 245\nLOW FINDINGS: 412\n\nTOP FAILING CONTROLS:\n  [IAM.6]  MFA not enabled for root account           12 accounts\n  [S3.2]   S3 Block Public Access not enabled          8 accounts\n  [EC2.19] Security groups allow unrestricted access   15 accounts\n  [RDS.3]  RDS encryption at rest not enabled          6 accounts\n\nAUTO-REMEDIATION ACTIONS (Last 30 Days):\n  S3 Block Public Access enabled:    14\n  Security Group rules restricted:    8\n  CloudTrail logging re-enabled:      3\n  Total auto-remediated findings:    25\n```\n","# Implementing AWS Security Hub Compliance\n\n## When to Use\n\n- When establishing centralized security posture management across multiple AWS accounts\n- When compliance requirements demand continuous monitoring against CIS, PCI DSS, or NIST 800-53 standards\n- When aggregating findings from GuardDuty, Inspector, Macie, Firewall Manager, and third-party tools\n- When building automated remediation workflows triggered by security findings\n- When executive stakeholders require a security compliance dashboard across the organization\n\n**Do not use** for real-time threat detection (use GuardDuty), for vulnerability scanning (use Inspector), or for data classification (use Macie). Security Hub aggregates findings from these services but does not replace them.\n\n## Prerequisites\n\n- AWS Organizations with delegated administrator for Security Hub\n- IAM permissions for `securityhub:*`, `config:*`, `events:*`, and `lambda:*`\n- AWS Config enabled in all target accounts and regions (required by Security Hub)\n- CloudFormation StackSets or Terraform for multi-account deployment\n- SNS topics configured for alert routing to security team\n\n## Workflow\n\n### Step 1: Enable Security Hub with Compliance Standards\n\nEnable Security Hub in the management account and select compliance standards to evaluate.\n\n```bash\n# Enable Security Hub in the current account\u002Fregion\naws securityhub enable-security-hub \\\n  --enable-default-standards \\\n  --control-finding-generator SECURITY_CONTROL\n\n# Enable specific compliance standards\naws securityhub batch-enable-standards --standards-subscription-requests \\\n  '[\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Faws-foundational-security-best-practices\u002Fv\u002F1.0.0\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Fcis-aws-foundations-benchmark\u002Fv\u002F1.4.0\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Fpci-dss\u002Fv\u002F3.2.1\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Fnist-800-53\u002Fv\u002F5.0.0\"}\n  ]'\n\n# Verify enabled standards\naws securityhub get-enabled-standards \\\n  --query 'StandardsSubscriptions[*].[StandardsArn,StandardsStatus]' --output table\n```\n\n### Step 2: Configure Multi-Account Aggregation\n\nSet up a delegated administrator and aggregate findings from all organization accounts.\n\n```bash\n# Designate a delegated admin (run from management account)\naws securityhub enable-organization-admin-account \\\n  --admin-account-id 111122223333\n\n# From the delegated admin account, enable auto-enrollment\naws securityhub update-organization-configuration \\\n  --auto-enable \\\n  --auto-enable-standards DEFAULT\n\n# Create a finding aggregator for cross-region aggregation\naws securityhub create-finding-aggregator \\\n  --region-linking-mode ALL_REGIONS\n\n# List member accounts\naws securityhub list-members \\\n  --query 'Members[*].[AccountId,MemberStatus]' --output table\n```\n\n### Step 3: Review Compliance Scores and Failed Controls\n\nQuery Security Hub for compliance posture across enabled standards and identify failing controls.\n\n```bash\n# Get overall compliance score for CIS benchmark\naws securityhub get-standards-control-associations \\\n  --security-control-id \"IAM.1\" \\\n  --query 'StandardsControlAssociationSummaries[*].[StandardsArn,AssociationStatus]' \\\n  --output table\n\n# List all failed controls\naws securityhub get-findings \\\n  --filters '{\n    \"ComplianceStatus\": [{\"Value\": \"FAILED\", \"Comparison\": \"EQUALS\"}],\n    \"RecordState\": [{\"Value\": \"ACTIVE\", \"Comparison\": \"EQUALS\"}],\n    \"WorkflowStatus\": [{\"Value\": \"NEW\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --sort-criteria '{\"Field\": \"SeverityNormalized\", \"SortOrder\": \"desc\"}' \\\n  --max-items 50 \\\n  --query 'Findings[*].[Title,Severity.Label,Compliance.Status,Resources[0].Id]' \\\n  --output table\n\n# Get finding counts by severity\naws securityhub get-insight-results \\\n  --insight-arn \"arn:aws:securityhub:us-east-1:111122223333:insight\u002F111122223333\u002Fdefault\u002F2\"\n```\n\n### Step 4: Create Custom Security Insights\n\nBuild custom insights to track organization-specific security priorities.\n\n```bash\n# Create insight for publicly accessible resources\naws securityhub create-insight \\\n  --name \"Publicly Accessible Resources\" \\\n  --filters '{\n    \"ResourceType\": [\n      {\"Value\": \"AwsS3Bucket\", \"Comparison\": \"EQUALS\"},\n      {\"Value\": \"AwsEc2SecurityGroup\", \"Comparison\": \"EQUALS\"},\n      {\"Value\": \"AwsRdsDbInstance\", \"Comparison\": \"EQUALS\"}\n    ],\n    \"ComplianceStatus\": [{\"Value\": \"FAILED\", \"Comparison\": \"EQUALS\"}],\n    \"SeverityLabel\": [{\"Value\": \"CRITICAL\", \"Comparison\": \"EQUALS\"}, {\"Value\": \"HIGH\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --group-by-attribute \"ResourceType\"\n\n# Create insight for unencrypted resources\naws securityhub create-insight \\\n  --name \"Unencrypted Resources Across Accounts\" \\\n  --filters '{\n    \"Title\": [{\"Value\": \"encryption\", \"Comparison\": \"CONTAINS\"}],\n    \"ComplianceStatus\": [{\"Value\": \"FAILED\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --group-by-attribute \"AwsAccountId\"\n```\n\n### Step 5: Configure Automated Remediation with EventBridge\n\nSet up EventBridge rules to trigger Lambda-based auto-remediation for specific finding types.\n\n```bash\n# Create EventBridge rule for Security Hub findings\naws events put-rule \\\n  --name \"security-hub-critical-findings\" \\\n  --event-pattern '{\n    \"source\": [\"aws.securityhub\"],\n    \"detail-type\": [\"Security Hub Findings - Imported\"],\n    \"detail\": {\n      \"findings\": {\n        \"Severity\": {\"Label\": [\"CRITICAL\"]},\n        \"Compliance\": {\"Status\": [\"FAILED\"]},\n        \"Workflow\": {\"Status\": [\"NEW\"]}\n      }\n    }\n  }'\n\n# Example Lambda auto-remediation for S3 public access (Python)\ncat > \u002Ftmp\u002Fremediate_s3.py \u003C\u003C 'PYEOF'\nimport boto3\nimport json\n\ndef lambda_handler(event, context):\n    s3 = boto3.client('s3')\n    securityhub = boto3.client('securityhub')\n\n    for finding in event['detail']['findings']:\n        if 'S3' in finding.get('Title', '') and 'public' in finding.get('Title', '').lower():\n            bucket_arn = finding['Resources'][0]['Id']\n            bucket_name = bucket_arn.split(':::')[-1]\n\n            s3.put_public_access_block(\n                Bucket=bucket_name,\n                PublicAccessBlockConfiguration={\n                    'BlockPublicAcls': True,\n                    'IgnorePublicAcls': True,\n                    'BlockPublicPolicy': True,\n                    'RestrictPublicBuckets': True\n                }\n            )\n\n            securityhub.batch_update_findings(\n                FindingIdentifiers=[{\n                    'Id': finding['Id'],\n                    'ProductArn': finding['ProductArn']\n                }],\n                Workflow={'Status': 'RESOLVED'},\n                Note={\n                    'Text': 'Auto-remediated: Block Public Access enabled',\n                    'UpdatedBy': 'security-hub-auto-remediation'\n                }\n            )\n    return {'statusCode': 200}\nPYEOF\n```\n\n### Step 6: Export Findings and Generate Compliance Reports\n\nExport Security Hub findings for reporting and integration with external SIEM or GRC platforms.\n\n```bash\n# Export all findings to S3 via a custom script\naws securityhub get-findings \\\n  --filters '{\n    \"RecordState\": [{\"Value\": \"ACTIVE\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --max-items 1000 \\\n  --output json > security-hub-findings-export.json\n\n# Send critical findings to SNS\naws sns publish \\\n  --topic-arn arn:aws:sns:us-east-1:111122223333:security-alerts \\\n  --subject \"Security Hub Daily Summary\" \\\n  --message file:\u002F\u002Fdaily-summary.json\n\n# Integrate with third-party SIEM via EventBridge\naws events put-targets \\\n  --rule security-hub-critical-findings \\\n  --targets '[{\n    \"Id\": \"splunk-hec\",\n    \"Arn\": \"arn:aws:events:us-east-1:111122223333:api-destination\u002Fsplunk-hec\",\n    \"HttpParameters\": {\n      \"HeaderParameters\": {\"Authorization\": \"Splunk HEC_TOKEN\"}\n    }\n  }]'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Security Hub | AWS service that aggregates security findings from AWS services and third-party tools, evaluates compliance against standards, and provides a unified security dashboard |\n| Security Standard | A predefined set of security controls (CIS, PCI DSS, NIST 800-53) that Security Hub evaluates against your AWS configuration |\n| Security Control | An individual check within a standard that evaluates a specific AWS resource configuration, such as whether S3 buckets block public access |\n| Finding | A security issue detected by Security Hub or an integrated service, formatted in AWS Security Finding Format (ASFF) |\n| Insight | A custom or managed grouping of findings by a specific attribute, providing aggregated views for security analysis |\n| ASFF | AWS Security Finding Format, the standardized JSON schema used by all Security Hub integrations for consistent finding representation |\n\n## Tools & Systems\n\n- **AWS Security Hub**: Central aggregation and compliance evaluation platform for security findings across AWS accounts\n- **AWS Config**: Configuration recording service required by Security Hub for evaluating resource compliance\n- **Amazon EventBridge**: Event bus for routing Security Hub findings to Lambda, SNS, or external remediation systems\n- **AWS Lambda**: Serverless compute for automated remediation functions triggered by Security Hub findings\n- **Prowler**: Open-source tool that can send findings to Security Hub via ASFF integration\n\n## Common Scenarios\n\n### Scenario: Rolling Out Security Hub Across a 50-Account Organization\n\n**Context**: A security team needs to enable Security Hub with CIS and FSBP standards across all accounts in an AWS Organization, with centralized finding aggregation and automated alerting.\n\n**Approach**:\n1. Enable Security Hub in the management account and designate a security account as delegated admin\n2. Configure auto-enable for all existing and new member accounts via `update-organization-configuration`\n3. Create a cross-region finding aggregator to consolidate findings from all regions into the admin account\n4. Enable CIS AWS Foundations 1.4 and AWS FSBP standards across all accounts\n5. Create EventBridge rules to route CRITICAL findings to PagerDuty and all findings to Splunk\n6. Build custom insights for the top organizational risks: public resources, missing encryption, unused credentials\n7. Schedule weekly compliance reports to stakeholders using Lambda and SES\n\n**Pitfalls**: Security Hub requires AWS Config to be enabled in every account and region. Failing to enable Config will result in controls showing as \"No data\" rather than PASSED or FAILED. Member accounts with Config disabled will silently produce incomplete compliance scores.\n\n## Output Format\n\n```\nAWS Security Hub Compliance Report\n=====================================\nOrganization: acme-corp (50 accounts)\nRegion: us-east-1 (aggregated from all regions)\nReport Date: 2026-02-23\nStandards Enabled: CIS 1.4, FSBP v1.0, PCI DSS 3.2.1\n\nCOMPLIANCE SCORES:\n  CIS AWS Foundations 1.4:     78% (142\u002F182 controls passing)\n  AWS FSBP v1.0.0:             85% (198\u002F233 controls passing)\n  PCI DSS 3.2.1:               72% (89\u002F124 controls passing)\n\nCRITICAL FINDINGS: 23\nHIGH FINDINGS: 87\nMEDIUM FINDINGS: 245\nLOW FINDINGS: 412\n\nTOP FAILING CONTROLS:\n  [IAM.6]  MFA not enabled for root account           12 accounts\n  [S3.2]   S3 Block Public Access not enabled          8 accounts\n  [EC2.19] Security groups allow unrestricted access   15 accounts\n  [RDS.3]  RDS encryption at rest not enabled          6 accounts\n\nAUTO-REMEDIATION ACTIONS (Last 30 Days):\n  S3 Block Public Access enabled:    14\n  Security Group rules restricted:    8\n  CloudTrail logging re-enabled:      3\n  Total auto-remediated findings:    25\n```\n",{"name":5,"tags":54,"author":56,"domain":48,"license":15,"version":57,"nist_csf":58,"subdomain":44,"description":63,"mitre_attack":64},[44,31,35,30,34,55],"cis-benchmark","mahipal","1.0",[59,60,61,62],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Deploy AWS Security Hub, backed by AWS Config, to aggregate findings from GuardDuty, Inspector, Macie, Firewall Manager, and Prowler across multi-account AWS Organizations, enable standards like CIS AWS Foundations and PCI DSS, and automate remediation via EventBridge and Lambda. Use for centralizing AWS compliance monitoring or executive compliance dashboards; not for threat detection (GuardDuty) or data classification (Macie).\n",[65,66,67,68],"T1078.004","T1530","T1537","T1580","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-aws-security-hub-compliance",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-security-hub-compliance",{"tool":85,"command":86},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-security-hub-compliance",{"tool":88,"command":89},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-security-hub-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub-compliance\u002FSKILL.md",true,[93,98,104],{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub-compliance\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",2366,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub-compliance\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fagent.py","SCRIPT","脚本",7181,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub-compliance\u002Fscripts\u002Fagent.py",[111,137,161,187,212,238],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[117],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[119,120,121,122,32,48,123,124,125,126,127,128,129,130,131,132,133,134,135,136],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[143],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,133,146,147,32,148,48,125,149,150,151,152,153,154,155,156,157,158,159,160],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[167,170],{"categoryNo":168,"categoryName":169,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,172,173,174,175,48,176,177,149,30,178,179,180,181,182,36,183,184,185,186],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[193],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[195,196,197,48,198,199,200,201,202,203,204,43,205,206,207,208,152,209,210,211],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[218],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,48,223,224,225,226,227,228,229,230,231,33,232,233,234,235,236,237],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[244],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[32,246,48,247,248,249,250,251,252,253,254,36,255,183,256,257,258,259,260,261],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]