[aws] Rebrand AWS Security Hub to AWS Security Hub CSPM

[brijesh-elastic]

Proposed commit message

aws: Rebrand AWS Security Hub to AWS Security Hub CSPM

The changes include display names, reference links, documentation and dashboards to align
with the new brand name.
This adds a breaking change, as it involves updating the `observer.vendor` value to
`AWS Security Hub CSPM`.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [AWS Security Hub] Rebrand AWS Security Hub integration to AWS Security Hub CSPM #16148

Screenshots

Integration Overview

Before:

After:

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[jamiehynds]

@brijesh-elastic please don't merge this PR until there's approval from PM (@cpascale43). We need a better understand of the AWS branding and whether Security Hub CSPM is simply a component within Security Hub (which I think is the case). If we reband, it likely implies a narrower focus than what the integration offers.

@cpascale43 can you look into this one please and confirm if we should stick with the current Security Hub branding?

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package aws 👍(9) 💚(6) 💔(7)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
lambda_logs	9803.92	6622.52	-3181.4 (-32.45%)	💔
route53_public_logs	20408.16	16666.67	-3741.49 (-18.33%)	💔
route53_resolver_logs	12987.01	6944.44	-6042.57 (-46.53%)	💔
securityhub_findings_full_posture	1968.5	1037.34	-931.16 (-47.3%)	💔
vpcflow	7936.51	6024.1	-1912.41 (-24.1%)	💔
cloudfront_logs	2898.55	2386.63	-511.92 (-17.66%)	💔
elb_logs	5235.6	3759.4	-1476.2 (-28.2%)	💔

To see the full report comment with /test benchmark fullreport

[cpascale43]

We are good to merge this - it was discussed here

AWS has branded them as two new services - these can be configured separately so it makes sense to me to treat them as two separate integrations:
https://docs.aws.amazon.com/securityhub/latest/userguide/what-are-securityhub-services.html

However, since this is relatively new (~June 2025) we should be prepared for feedback

[efd6]

nit only

[efd6]

LGTM after conflicts are addressed.

[kcreddy]

LGTM.

@maxcold, since we are rebranding our existing integration AWS Security Hub to AWS Security Hub CSPM, there will be change required in this list and its corresponding page.

[kcreddy]

Requires observer.vendor field to be updated to AWS Security Hub CSPM, confirmed by @nick-alayil.

[kcreddy]

Insights also come under CSPM. Can you update the securityhub_insights data stream as well?

[brijesh-elastic]

Insights also come under CSPM. Can you update the securityhub_insights data stream as well?

Updated in commit.

[kcreddy]

Suggested change

	- version: "4.8.0"
	- version: "5.0.0"

[kcreddy]

for breaking-change

[kcreddy]

LGTM

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 1c55955

History

• 💚 Build #35269 succeeded 80d1d59
• 💚 Build #35254 succeeded 352e35e
• 💚 Build #35117 succeeded 3b16510
• 💚 Build #35005 succeeded 4cb337c
• 💚 Build #34939 succeeded d7b3519

cc @brijesh-elastic

[agithomas]

LGTM!

[elastic-vault-github-plugin-prod]

Package aws - 5.0.0 containing this change is available at https://epr.elastic.co/package/aws/5.0.0/