01 Run get-findings command (OSX/Linux/UNIX) with custom query filters to list the Amazon Resource Names (ARNs) of the Security Hub-aggregated findings available within the selected region:
aws securityhub get-findings
--region us-east-1
--query 'Findings[*].Id'
02 The command output should return an array with the requested ARNs:
[
"arn:aws:inspector:us-east-1:123456789012:target/0-aaaabbbb/template/0-abcd1234/run/0-aabbccdd/finding/0-abcdabcd",
"arn:aws:inspector:us-east-1:123456789012:target/0-aabbccdd/template/0-1234abcd/run/0-abcdabcd/finding/0-aaaabbbb",
...
"arn:aws:securityhub:us-east-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0/3.8/finding/12341234-abcd-1234-abcd-123412341234",
"arn:aws:securityhub:us-east-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0/3.7/finding/1234abcd-1234-abcd-1234-1234abcd1234"
]
03 Create a JSON document required for get-findings command filtering, as shown in the example below, and save it in a file named finding-id.json. Make sure that you replace the ARN of the Security Hub finding listed for the Value attribute with the ARN of the finding that you want to examine:
{
"Id": [
{
"Value": "arn:aws:inspector:us-east-1:123456789012:target/0-aaaabbbb/template/0-abcd1234/run/0-aabbccdd/finding/0-abcdabcd",
"Comparison": "EQUALS"
}
]
}
04 Execute get-findings command (OSX/Linux/UNIX) using the ARN of the finding that you want to examine as identifier, listed within finding-id.json document, to describe the selected Amazon Security Hub finding:
aws securityhub get-findings
--region us-east-1
--filters file://finding-id.json
05 The command output should return the configuration metadata for selected security finding:
{
"Findings": [
{
"LastObservedAt": "2018-12-10T08:54:03Z",
"FirstObservedAt": "2018-12-10T08:54:03Z",
"GeneratorId": "arn:aws:inspector:us-east-1:123456789012:target/0-abcdabcd",
"Severity": {
"Product": 9,
"Normalized": 45
},
"Title": "On instance i-abcdabcd123456789, TCP port 21 which is associated with 'FTP' is reachable from the Internet.",
"Resources": [
{
"Region": "us-east-1",
"Partition": "aws",
"Type": "AwsEc2Instance",
"Id": "arn:aws:ec2:us-east-1:123456789012:instance/i-abcdabcd123456789",
"Details": {
"AwsEc2Instance": {
"SubnetId": "subnet-abcd1234",
"VpcId": "vpc-12345678",
"ImageId": "ami-012345678aaaabbbb"
}
}
}
],
"WorkflowState": "NEW",
"ProductArn": "arn:aws:securityhub:us-east-1::product/aws/inspector",
"Confidence": 10,
"ProductFields": {
"attributes:7/key": "SECURITY_GROUP",
"attributes:9/value": "acl-1234abcd",
"aws/securityhub/ProductName": "Inspector",
"attributes:7/value": "sg-012345678abcdabcd",
"attributes:4/value": "TCP",
"attributes:1/key": "RULE_TYPE",
"serviceAttributes/schemaVersion": "1",
"attributes:5/value": "igw-abcd1234",
"serviceAttributes/rulesPackageArn": "arn:aws:inspector:us-east-1:123456789012:rulespackage/0-abcdabcd",
"attributes:6/key": "VPC",
"attributes:4/key": "PROTOCOL",
"attributes:3/value": "FTP",
"aws/securityhub/FindingId": "arn:aws:securityhub:us-east-1::product/aws/inspector/arn:aws:inspector:us-east-1:123456789012:target/0-aaaabbbb/template/0-abcd1234/run/0-aabbccdd/finding/0-abcdabcd",
"attributes:6/value": "vpc-12345678",
"attributes:9/key": "ACL",
"attributes:0/value": "eni-089c2f505015c6291",
"aws/securityhub/SeverityLabel": "MEDIUM",
"attributes:10/value": "i-0abcd1234abcd1234",
"attributes:3/key": "PORT_GROUP_NAME",
"attributes:8/key": "REACHABILITY_TYPE",
"attributes:2/value": "21",
"attributes:5/key": "IGW",
"attributes:2/key": "PORT",
"attributes:1/value": "RecognizedPortNoAgent",
"attributes:8/value": "Internet",
"serviceAttributes/assessmentRunArn": "arn:aws:inspector:us-east-1:123456789012:target/0-aaaabbbb/template/0-abcd1234/run/0-aabbccdd",
"attributes:10/key": "INSTANCE_ID",
"attributes:0/key": "ENI",
"aws/securityhub/CompanyName": "AWS"
},
"RecordState": "ACTIVE",
"CreatedAt": "2018-12-10T08:54:03Z",
"UpdatedAt": "2018-12-10T08:54:03Z",
"Remediation": {
"Recommendation": {
"Text": "You can edit the Security Group sg-abcdabcd123456789 to remove access from the Internet on port 21."
}
},
"Description": "On this instance, TCP port 21, which is associated with FTP, is reachable from the Internet. You can install the Inspector agent on this instance and re-run the assessment to check for any process listening on this port. The instance i-abcdabcd123456789 is located in VPC vpc-12345678 and has an attached ENI eni-0abcd1234abcd1234 which uses network ACL acl-1234abcd. The port is reachable from the Internet through Security Group sg-012345678abcdabcd and IGW igw-abcd1234.",
"SchemaVersion": "2018-10-08",
"Id": "arn:aws:inspector:us-east-1:123456789012:target/0-aaaabbbb/template/0-abcd1234/run/0-aabbccdd/finding/0-abcdabcd",
"Types": [
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability - Recognized port reachable from internet"
],
"AwsAccountId": "123456789012"
}
]
}
06 Analyze the metadata returned for the selected security finding by checking the following output attributes:
- "Title" – the name of the finding, e.g. "On instance i-abcdabcd123456789, TCP port 21 which is associated with 'FTP' is reachable from the Internet."
- "Description" – a detailed description of the security finding which includes the AWS resources affected by the security risk e.g. "On this instance, TCP port 21, which is associated with FTP, is reachable from the Internet. You can install the Inspector agent on this instance and re-run the assessment to check for any process listening on this port. The instance i-abcdabcd123456789 is located in VPC vpc-12345678 and has an attached ENI eni-0abcd1234abcd1234 which uses network ACL acl-1234abcd. The port is reachable from the Internet through Security Group sg-012345678abcdabcd and IGW igw-abcd1234."
- "AwsAccountId" – the ID number of the AWS account where the potential security issue described by the selected finding was found, e.g. "123456789012".
- "ProductFields.aws/securityhub/SeverityLabel" – the severity label associated with the finding, e.g. "MEDIUM". Possible values are "HIGH", "MEDIUM", "LOW" and "INFORMATIONAL".
- "ProductFields.aws/securityhub/ProductName" – the service/solution that generates the finding, e.g. "Inspector" (AWS Inspector service).
- "Compliance.Status" – describes the result of the compliance check. Valid values are: "PASSED" (all resources that were checked were found in compliance with the check), "WARNING" (There is configuration information that needs to be supplied that is lacking), "FAILED" (all resources that were checked failed the check) and "NOT_AVAILABLE" (the check could not be performed due to a service outage, an API error, etc).
- "Resources"– an array that contains the configuration attributes of the resources to which the selected finding refers, e.g. "Type": "AwsEc2Instance", "Id": "arn:aws:ec2:us-east-1:123456789012:instance/i-abcdabcd123456789", "Region": "us-east-1", etc.
- "RecordState" – the record state of the security finding. Valid values are "ACTIVE" and "ARCHIVED".
- "Remediation.Recommendation" – provides a suggestion on how to remediate the issue identified by the selected finding, e.g. "You can edit the Security Group sg-abcdabcd123456789 to remove access from the Internet on port 21".
07 Based on the metadata returned at the previous step you can analyze the security risk described by the finding and implement the recommended fix.
08 Repeat steps no. 3 – 7 to check and analyze other Amazon Security Hub findings found in the selected region.
09 Change the AWS region by updating the --region command parameter value and repeat the entire audit process for other regions.
Security