Skip to main content

Security Hub

The Security Hub is where Prism deploys AWS's organization-wide services across every one of your accounts at once. From a single interface, you can measure the compliance posture of every AWS account in your organization, detect threats across all of your accounts and regions, discover sensitive data and software vulnerabilities, investigate the IAM principals involved in a security event, see which of your resources grant access outside their zone of trust, apply web ACL policies across your estate, and manage the AWS Config recording that the compliance standards depend on. From the same interface, you also manage your organization's IP address space.

What is Security Hub?​

Security Hub brings nine AWS capabilities together in one place, deployed across every account in your organization rather than configured account by account in the AWS Console.

Eight of them are security capabilities. The ninth, VPC IPAM, is not: it is IP address management, and it belongs here because it is an AWS service Prism deploys across your whole organization in exactly the same way as the others. It produces an address inventory rather than findings, so it has no severity, contributes nothing to the findings inbox, and has no Overview stat card.

Most of the security capabilities use a delegated administrator: one account you nominate aggregates results from all of your enrolled member accounts. Amazon Inspector, AWS IAM Access Analyzer and AWS Firewall Manager are the exceptions, they use a flat peer model with no administrator account at all. Amazon Detective uses an administrator too, but the administrator owns a behavior graph that the other accounts join by invitation. VPC IPAM nominates a host account that owns the IPAM and receives every enrolled account's inventory, but that host is an ordinary enrolled account, not an AWS Organizations delegated administrator. See each capability's own guide for its deployment model.

Key capabilities include:

  • Security Hub CSPM, Enroll your accounts under a central administrator and evaluate them against up to six AWS compliance standards, with per-account, per-standard compliance scores and a drill-down from standard to control to individual resource check
  • Amazon GuardDuty, Enable threat detection across your accounts and regions, with a severity-based threat dashboard, per-type and per-account breakdowns, and an archive workflow for triaging findings
  • AWS Config, The recording foundation that Security Hub standards rely on; Prism provisions and manages AWS Config recorders in every enrolled account and region
  • Amazon Macie, S3 data-security posture and sensitive-data findings across your accounts and regions, with a bucket-posture inventory, a severity dashboard, and opt-in automated sensitive-data discovery
  • Amazon Inspector, Software vulnerability scanning of EC2 instances, container images, Lambda functions, and code repositories, with an estate-wide Top CVEs view, fix-availability tracking, and per-account selectable scan types
  • Amazon Detective, Behavior-graph investigation of the IAM users and roles involved in a security event, built from CloudTrail management events, VPC flow logs, and GuardDuty findings, with accounts joining one administrator's behavior graph by invitation
  • AWS IAM Access Analyzer, External-access analysis of the resource policies in your accounts (which principals outside the zone of trust can reach an S3 bucket, KMS key, IAM role or queue), plus opt-in unused-access analysis of IAM roles, users, access keys and passwords
  • AWS Firewall Manager, Organization-wide AWS WAF (WAFv2) web ACL policies, applied and audited by Prism through each account's own switch role, with an orphan scanner for web ACLs a removed policy left behind
  • VPC IPAM, Organization-wide IP address management: a discovered inventory of every VPC, subnet and Elastic IP CIDR in your enrolled accounts, address pools you allocate from, utilization, cross-account CIDR overlap detection, and Public IP Insights. A networking capability, not a security one, and the only one that requires a paid AWS tier (IPAM Advanced)

Authentication​

  1. Navigate to your organization's Prism URL, Open your organization's Prism URL in your browser (e.g., https://yourcompany.prism.cloudkeeper.com).
  2. Authenticate, Log in using one of the available methods:
    • SSO, Click the SSO button to authenticate through your organization's identity provider.
    • Username and password, Enter your Prism credentials directly.
  3. Select the Organisation Services, After authentication, click Organisation Services on the application selection screen.
info

Security Hub is available as a beta feature. Contact your CloudKeeper representative to enable it for your organization. Once enabled, an Admin grants per-user access in Preferences > Admin Management.

Capabilities​

The Security Hub is organized into the areas below, each accessible from the sidebar:

SectionDescription
Security Hub CSPMStandards-based compliance posture, findings, and control drill-down
GuardDutyAmazon GuardDuty threat detection dashboard and findings
AWS ConfigThe AWS Config recording foundation required by Security Hub standards
MacieAmazon Macie S3 data-security posture and sensitive-data findings
InspectorAmazon Inspector software vulnerability findings and CVE prioritisation
DetectiveAmazon Detective behavior-graph investigation reports for IAM users and roles
IAM Access AnalyzerAWS IAM Access Analyzer external-access and unused-access findings
AWS Firewall ManagerOrganization-wide AWS WAF web ACL policies, coverage ledger, and the orphan scanner
VPC IPAMAddress-space inventory, pools and allocations, utilization and overlap. Networking, not security

When you open the Security Hub you land on the Overview page. What you see depends on how much is set up:

  • One stat card per enabled engine summarizes each engine at a glance and links into its dashboard.
  • If no engines are enabled yet, the Overview shows the Enable Security Hub panel instead of the stat cards, from which you can start any engine's setup wizard.

To enable an additional engine after your first one is already live, use the Configuration page (that panel only appears on the Overview while nothing is enabled).

info

Each engine is enabled independently. An engine that has not been set up shows an Enable call-to-action in the sidebar instead of its dashboard.

note

VPC IPAM has no Overview stat card, because it produces an address inventory rather than findings and a card counting findings would permanently read zero. Its sidebar group is always present, whether or not IPAM is enabled. Opening Dashboard on a tenant that has not enabled it takes you to the setup wizard, which is the right destination. You can also reach it from Configuration, under the Networking heading below the engine cards.

note

The Overview loads each engine's status from a capabilities service and shows loading skeletons while it resolves. If the cards do not finish loading, reload the page; see Security Hub Issues if it persists.

Prerequisites​

Before using the Security Hub, ensure the following:

  • Your organization has been onboarded to Prism by CloudKeeper
  • Security Hub has been enabled for your organization as a beta feature by CloudKeeper
  • Security Hub access enabled for your account by an Admin in Preferences > Admin Management
  • At least one AWS account is onboarded in Prism