Skip to main content

Security Hub

The Security Hub is the security surface of Prism Organization Services. From a single interface, you can measure the compliance posture of every AWS account in your organization, detect threats across all of your accounts and regions, discover sensitive data and software vulnerabilities, investigate the IAM principals involved in a security event, and manage the AWS Config recording that the compliance standards depend on.

What is Security Hub?​

Security Hub brings six AWS security capabilities together in one place, deployed across every account in your organization rather than configured account by account in the AWS Console.

Most capabilities use a delegated administrator: one account you nominate aggregates results from all of your enrolled member accounts. Amazon Inspector is the exception, it uses a flat peer model with no administrator account at all. Amazon Detective uses an administrator too, but the administrator owns a behavior graph that the other accounts join by invitation. See each capability's own guide for its deployment model.

Key capabilities include:

  • Security Hub CSPM, Enroll your accounts under a central administrator and evaluate them against up to six AWS compliance standards, with per-account, per-standard compliance scores and a drill-down from standard to control to individual resource check
  • Amazon GuardDuty, Enable threat detection across your accounts and regions, with a severity-based threat dashboard, per-type and per-account breakdowns, and an archive workflow for triaging findings
  • AWS Config, The recording foundation that Security Hub standards rely on; Prism provisions and manages AWS Config recorders in every enrolled account and region
  • Amazon Macie, S3 data-security posture and sensitive-data findings across your accounts and regions, with a bucket-posture inventory, a severity dashboard, and opt-in automated sensitive-data discovery
  • Amazon Inspector, Software vulnerability scanning of EC2 instances, container images, Lambda functions, and code repositories, with an estate-wide Top CVEs view, fix-availability tracking, and per-account selectable scan types
  • Amazon Detective, Behavior-graph investigation of the IAM users and roles involved in a security event, built from CloudTrail management events, VPC flow logs, and GuardDuty findings, with accounts joining one administrator's behavior graph by invitation

Authentication​

  1. Navigate to your organization's Prism URL, Open your organization's Prism URL in your browser (e.g., https://yourcompany.prism.cloudkeeper.com).
  2. Authenticate, Log in using one of the available methods:
    • SSO, Click the SSO button to authenticate through your organization's identity provider.
    • Username and password, Enter your Prism credentials directly.
  3. Select the Organisation Services, After authentication, click Organisation Services on the application selection screen.
info

Security Hub is available as a beta feature. Contact your CloudKeeper representative to enable it for your organization. Once enabled, an Admin grants per-user access in Preferences > Admin Management.

Detection Engines and Foundation​

The Security Hub is organized into six areas, each accessible from the sidebar:

SectionDescription
Security Hub CSPMStandards-based compliance posture, findings, and control drill-down
GuardDutyAmazon GuardDuty threat detection dashboard and findings
AWS ConfigThe AWS Config recording foundation required by Security Hub standards
MacieAmazon Macie S3 data-security posture and sensitive-data findings
InspectorAmazon Inspector software vulnerability findings and CVE prioritisation
DetectiveAmazon Detective behavior-graph investigation reports for IAM users and roles

When you open the Security Hub you land on the Overview page. What you see depends on how much is set up:

  • One stat card per enabled engine summarizes each engine at a glance and links into its dashboard.
  • If no engines are enabled yet, the Overview shows the Enable Security Hub panel instead of the stat cards, from which you can start any engine's setup wizard.

To enable an additional engine after your first one is already live, use the Configuration page (that panel only appears on the Overview while nothing is enabled).

info

Each engine is enabled independently. An engine that has not been set up shows an Enable call-to-action in the sidebar instead of its dashboard.

note

The Overview loads each engine's status from a capabilities service and shows loading skeletons while it resolves. If the cards do not finish loading, reload the page; see Security Hub Issues if it persists.

Prerequisites​

Before using the Security Hub, ensure the following:

  • Your organization has been onboarded to Prism by CloudKeeper
  • Security Hub has been enabled for your organization as a beta feature by CloudKeeper
  • Security Hub access enabled for your account by an Admin in Preferences > Admin Management
  • At least one AWS account is onboarded in Prism