Skip to main content

Quick Start: Security Hub

This guide walks you through the shortest path to value in the Security Hub: enabling your first detection engine (CSPM or GuardDuty), enrolling your member accounts, and reviewing your first findings or compliance scores.

Prerequisites​

  • Your organization has been onboarded to Prism by CloudKeeper
  • Security Hub has been enabled for your organization as a beta capability by CloudKeeper (contact your CloudKeeper representative if you are not sure)
  • Security Hub access has been granted to your account by a Prism Admin in Preferences > Admin Management
  • At least one AWS account is onboarded in Prism

Step 1: Log In​

  1. Navigate to your organization's Prism URL (for example, https://yourcompany.prism.cloudkeeper.com)
  2. Authenticate through SSO or with your username and password
  3. Select Security Hub on the Application Selection screen. You will land on the Overview page.

Step 2: Choose an Engine​

On the Overview page, you will see the Enable Security Hub panel (if no engines are yet enabled) or your existing engine stat cards.

  1. Click Enable on the Posture management card to start with standards-based compliance posture, or on the Threat detection card to start with threat detection
  2. If one engine is already enabled and you want to add a second, go to Configuration in the sidebar and open the Capabilities tab instead

Step 3: Run the Setup Wizard​

The wizard walks you through the required settings for your chosen engine.

CSPM setup (5 steps)​

  1. Admin account: Select the AWS account that will act as the delegated CSPM administrator. This choice is permanent; changing it requires disabling and re-enabling the engine.
  2. Regions: Select the home region and any linking regions to aggregate findings from.
  3. Standards: Choose at least one compliance standard (for example, AWS Foundational Security Best Practices or CIS AWS Foundations Benchmark).
  4. Members: Select which of your onboarded AWS accounts to enroll as member accounts.
  5. Review: Confirm your selections and click Enable.

GuardDuty setup (6 steps)​

  1. Admin account: Select the AWS account that will act as the delegated GuardDuty administrator.
  2. Regions: Select the home region and any additional regions.
  3. Features: Choose which GuardDuty protection plans to enable (all six are on by default).
  4. Members: Select which AWS accounts to enroll as member accounts.
  5. Emails: Prism auto-resolves the root email for each member account. For any account whose email could not be resolved automatically, enter it manually. Use the account's real root (primary) email as shown in the AWS Console under Account Settings > Account > Email address. Add accounts in batches of 5 or fewer if you are enrolling many at once to avoid resolution timeouts.
  6. Review: Confirm and click Enable.

After you click Enable, a progress screen appears while the async setup job runs. This typically takes a few minutes. You can safely navigate away; the job continues on the server and the screen resumes polling when you return.

Step 4: Set Up AWS Config​

Security Hub CSPM standards require AWS Config recorders to evaluate most controls. After the engine enables, Prism prompts you to configure recording.

  1. Accept the inline AWS Config prompt when it appears, or navigate to AWS Config directly
  2. Select the accounts and regions you want to record
  3. Choose Minimal scope (recommended for cost) or Record all
  4. Click Enable recorders

If you skip this step, CSPM controls will show NO DATA until recording is active.

Step 5: Refresh and Review​

Findings and compliance scores are not populated automatically; you trigger a refresh from the dashboard.

  1. Open the Compliance Dashboard (CSPM) or Threat Dashboard (GuardDuty)
  2. Click Refresh findings
  3. When the job completes, the dashboard populates with scores, findings counts, and breakdowns by account and region

What Happens Next​

  • CSPM: Drill into Security Standards to see per-standard compliance scores, then into individual controls and resource checks.
  • GuardDuty: Review the Threat Dashboard and open Findings to archive or investigate threats.
  • Add another engine: Go to Configuration > Capabilities and enable an engine you did not start with (CSPM, GuardDuty, Amazon Macie, Amazon Inspector, Amazon Detective, AWS IAM Access Analyzer, or AWS Firewall Manager).
  • Amazon Macie: Enable Macie from Configuration > Capabilities for S3 data-security posture and sensitive-data findings, then refresh its dashboard and bucket inventory.
  • Amazon Inspector: Enable Inspector from Configuration > Capabilities for software vulnerability scanning, then review the Top CVEs across your estate. Inspector needs no administrator account and no root email addresses, so its setup wizard is only four steps.
  • Amazon Detective: Enable Detective from Configuration > Capabilities for behavior-graph investigation. Its setup wizard is three steps and, like GuardDuty and Macie, it needs each member account's real AWS root user email address. Note that Detective does not create investigations on its own, so its list stays empty until an investigation is run from the AWS console.
  • AWS IAM Access Analyzer: Enable Access Analyzer from Configuration > Capabilities to see which resource policies grant access outside their zone of trust. Its setup wizard is four steps and, like Inspector, it needs no administrator account and no root email addresses. External-access analysis is free; the Unused access step is opt-in, off by default, and is the only part AWS bills for. Prism creates account-scoped analyzers, so a grant to another account in your own AWS Organization is reported as external. See Zone of trust before triaging the first results.
  • Manage enrollment: Open Member Enrollment (CSPM) or Member Enrollment (GuardDuty) to add, retry, or remove accounts.

Not an Engine: VPC IPAM​

VPC IPAM is the ninth Security Hub capability and the one that does not fit this guide, because it is not a security engine. It does not produce findings, has no severity, has no Overview stat card, and nothing about it appears in the findings inbox. It answers a different question: where is my organization's IP address space, who owns it, how much of it is used, and where does it collide?

Enable it from the Networking section of Configuration > Capabilities, or from the VPC IPAM group in the sidebar, which is present whether or not it has been set up.

Three things to know before you start, because none of them can be undone from Prism afterwards:

  • It is billed, and it is the only Security Hub capability that is. VPC IPAM Advanced tier is mandatory for any multi-account use. The setup wizard prepares a cost estimate from the real number of active IP addresses in the accounts and regions you select, and will not let you continue until you acknowledge the charge.
  • The host account you nominate pays for every account you enrol, and cannot be changed later. AWS charges the account that owns the IPAM for every active IP it manages. Only the accounts you enrol are metered, never your whole organization. See Why is the whole bill on one account?.
  • The inventory is empty at first, and that is normal. AWS's discovery is a periodic background sweep, not a live query. The first sweep can take up to about 20 minutes. See Why is my inventory empty?.

Prism never uses your AWS Organizations management account for VPC IPAM, and never deletes one of your VPCs. That is also why tearing an IPAM down can stop on a pool a member account still holds an address from. Read Disabling VPC IPAM before you enable it, not after.

Next Steps​