Skip to main content

Quick Start: Security Hub

This guide walks you through the shortest path to value in the Security Hub: enabling your first detection engine (CSPM or GuardDuty), enrolling your member accounts, and reviewing your first findings or compliance scores.

Prerequisites​

  • Your organization has been onboarded to Prism by CloudKeeper
  • Security Hub has been enabled for your organization as a beta capability by CloudKeeper (contact your CloudKeeper representative if you are not sure)
  • Security Hub access has been granted to your account by a Prism Admin in Preferences > Admin Management
  • At least one AWS account is onboarded in Prism

Step 1: Log In​

  1. Navigate to your organization's Prism URL (for example, https://yourcompany.prism.cloudkeeper.com)
  2. Authenticate through SSO or with your username and password
  3. Select Security Hub on the Application Selection screen. You will land on the Overview page.

Step 2: Choose an Engine​

On the Overview page, you will see the Enable Security Hub panel (if no engines are yet enabled) or your existing engine stat cards.

  1. Click Enable on the Posture management card to start with standards-based compliance posture, or on the Threat detection card to start with threat detection
  2. If one engine is already enabled and you want to add a second, go to Configuration in the sidebar and open the Capabilities tab instead

Step 3: Run the Setup Wizard​

The wizard walks you through the required settings for your chosen engine.

CSPM setup (5 steps)​

  1. Admin account: Select the AWS account that will act as the delegated CSPM administrator. This choice is permanent; changing it requires disabling and re-enabling the engine.
  2. Regions: Select the home region and any linking regions to aggregate findings from.
  3. Standards: Choose at least one compliance standard (for example, AWS Foundational Security Best Practices or CIS AWS Foundations Benchmark).
  4. Members: Select which of your onboarded AWS accounts to enroll as member accounts.
  5. Review: Confirm your selections and click Enable.

GuardDuty setup (6 steps)​

  1. Admin account: Select the AWS account that will act as the delegated GuardDuty administrator.
  2. Regions: Select the home region and any additional regions.
  3. Features: Choose which GuardDuty protection plans to enable (all six are on by default).
  4. Members: Select which AWS accounts to enroll as member accounts.
  5. Emails: Prism auto-resolves the root email for each member account. For any account whose email could not be resolved automatically, enter it manually. Use the account's real root (primary) email as shown in the AWS Console under Account Settings > Account > Email address. Add accounts in batches of 5 or fewer if you are enrolling many at once to avoid resolution timeouts.
  6. Review: Confirm and click Enable.

After you click Enable, a progress screen appears while the async setup job runs. This typically takes a few minutes. You can safely navigate away; the job continues on the server and the screen resumes polling when you return.

Step 4: Set Up AWS Config​

Security Hub CSPM standards require AWS Config recorders to evaluate most controls. After the engine enables, Prism prompts you to configure recording.

  1. Accept the inline AWS Config prompt when it appears, or navigate to AWS Config directly
  2. Select the accounts and regions you want to record
  3. Choose Minimal scope (recommended for cost) or Record all
  4. Click Enable recorders

If you skip this step, CSPM controls will show NO DATA until recording is active.

Step 5: Refresh and Review​

Findings and compliance scores are not populated automatically; you trigger a refresh from the dashboard.

  1. Open the Compliance Dashboard (CSPM) or Threat Dashboard (GuardDuty)
  2. Click Refresh findings
  3. When the job completes, the dashboard populates with scores, findings counts, and breakdowns by account and region

What Happens Next​

  • CSPM: Drill into Security Standards to see per-standard compliance scores, then into individual controls and resource checks.
  • GuardDuty: Review the Threat Dashboard and open Findings to archive or investigate threats.
  • Add another engine: Go to Configuration > Capabilities and enable an engine you did not start with (CSPM, GuardDuty, Amazon Macie, Amazon Inspector, or Amazon Detective).
  • Amazon Macie: Enable Macie from Configuration > Capabilities for S3 data-security posture and sensitive-data findings, then refresh its dashboard and bucket inventory.
  • Amazon Inspector: Enable Inspector from Configuration > Capabilities for software vulnerability scanning, then review the Top CVEs across your estate. Inspector needs no administrator account and no root email addresses, so its setup wizard is only four steps.
  • Amazon Detective: Enable Detective from Configuration > Capabilities for behavior-graph investigation. Its setup wizard is three steps and, like GuardDuty and Macie, it needs each member account's real AWS root user email address. Note that Detective does not create investigations on its own, so its list stays empty until an investigation is run from the AWS console.
  • Manage enrollment: Open Member Enrollment (CSPM) or Member Enrollment (GuardDuty) to add, retry, or remove accounts.

Next Steps​