AttackIQ Platform

Don't have AttackIQ? Learn more

Overview

The AttackIQ Platform provides the capability to send notifications for scheduled assessment results to AWS Security Hub. With this facility, you can set a minimum prevention rate for a scheduled assessment. When the prevention percentage falls below this threshold, the AttackIQ Platform will send a notification to your Security Hub Console conveying the assessment results.

This guide will show you how to configure the AWS Security Notification facility for your scheduled assessments.

Configuration

To configure AWS Security Hub notifications, follow this procedure:

1. Open your AttackIQ Platform UI then click on the assessment you want to schedule.

2. Click on the Scheduled menu item, then schedule your assessment. The details of how this is done will not be covered in this guide.
3. Click on the Notification menu item.
4. Click on the Global Config button.

5. Click on the AWS Configure button.

6. Enter your AWS Account ID
7. Enter your AWS Region
8. Click on the TEST CONNECTION button to send a test notification.
9. Click on the Update button to save the notification configuration fo your scheduled assessment.

10. Click on the AWS STATUS switch to enable AWS notifications.

11. Click on the AWS toggle switch to enable notifications for your assessment.

12. Click on the SET THRESHOLD button.
13. Set the desired threshold with the slider control.
14. Click on Save button.

AWS Security Hub Console

To see your Security Hub notifications:

1. Open your AWS Management Console
2. Click on Security Hub in the Security, Identity, & Compliance section.
3. Click on Findings in the menu on the left.
4. Click on the empty part of the search box.
5. Select Severity label from the menu.
6. Enter CRITICAL.
7. Click on Apply.

You should get findings that look like the following.

In this example, both a test notification and a scheduled assessment notification are shown.