[aws_securityhub] Initial release of AWS Security Hub

[brijesh-elastic]

Proposed commit message

aws_securityhub: Initial release of AWS Security Hub

the integration collects findings in OCSF format using GetFindingsV2 API, it supports
OCSF v1.5 classes(2002, 2003, 2004, 2006).

ECS mapping and transforms have also been added to facilitate with the
Cloud Native Vulnerability Management (CNVM)[1] workflow.

[1] https://www.elastic.co/guide/en/security/current/vuln-management-overview.html

Note

To Reviewers:

• Please refer to this guide: https://docs.elastic.dev/security-solution/cloud-security/cdr/3p-dev-guide which was used for proposed changes.
• OCSF to ECS Mapping Analysis Document

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/aws_securityhub directory.
• Run the following command to run tests.

elastic-package test

Related issues

• Closes [AWS Security Hub] - Create a new integration to support OCSF format findings #16201
• Closes AWS Security Hub: Implement mappings for Cloud Security Vulnerability Workflows #15425
• Closes AWS Security Hub: Implement transform for Cloud Security Vulnerability Workflows #15426

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

I think also that the document that forms the basis of the OCSF to ECS mapping should be made public and linked in the commit message.

[maxcold]

@kcreddy @brijesh-elastic Tested the env with data ingested. All good except missing host.name . In the mapping sheet we discussed that we want to provide the instance id in the host.name. Did we miss this requirement or were there any technical challenges doing so?

[brijesh-elastic]

@kcreddy @brijesh-elastic Tested the env with data ingested. All good except missing host.name . In the mapping sheet we discussed that we want to provide the instance id in the host.name. Did we miss this requirement or were there any technical challenges doing so?

It looks like I missed it. I’ll update this in the next commit, along with the cluster.

[kcreddy]

To be merged after #16195

[brijesh-elastic]

I think also that the document that forms the basis of the OCSF to ECS mapping should be made public and linked in the commit message.

@kcreddy @ShourieG, should we make the CDR mapping sheet and RFC document for OCSF to ECS public?

[kcreddy]

CDR mapping sheet

@brijesh-elastic, spreadsheet permissions already there. You can share the link with reviewers, but Dan's point is on OCSF to ECS.

[ShourieG]

I think also that the document that forms the basis of the OCSF to ECS mapping should be made public and linked in the commit message.

@kcreddy @ShourieG, should we make the CDR mapping sheet and RFC document for OCSF to ECS public?

Yes, I agree with making the OCSF to ECS mapping documents public, we can link it in the PR description

[maxcold]

tested on provided environment, everything working as expected from our flows perspective

[kcreddy]

LGTM. Thanks @brijesh-elastic

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 55b23f9

History

• 💚 Build #35355 succeeded 0c68cf2
• 💚 Build #35336 succeeded 2cc447b
• 💚 Build #35113 succeeded 72e4968
• 💔 Build #35111 failed f238280
• 💚 Build #35109 succeeded 6ed2466
• 💚 Build #34955 succeeded aeebca9

cc @brijesh-elastic

[ShourieG]

LGTM

[elastic-vault-github-plugin-prod]

Package aws_securityhub - 0.1.0 containing this change is available at https://epr.elastic.co/package/aws_securityhub/0.1.0/