AWS Security Hub alert integration

AWS Security Hub sends each finding to Amazon EventBridge as a Security Hub Findings - Imported event. The Flashduty AWS EventBridge integration recognizes these events: each finding becomes one alert, and the alert recovers automatically when the finding is resolved or archived. No separate Security Hub integration is needed: create an AWS EventBridge integration in Flashduty, then create an EventBridge rule that forwards Security Hub events to it.

Configure in AWS

Create an API destination that points to Flashduty in Amazon EventBridge

API destination (recommended)
SNS topic

Where: Amazon EventBridge › Integration › API destinations › Connections › Create connection

Field	Value
Connection name (required)	`Flashduty`
Destination type (required, under Authorization)	`Other`
Authorization type (required)	`API Key`
API key name (required)	`Flashduty`
Value (required)	`{integration_key}`, the `integration_key` in the push URL

Click Create to save.Where: Amazon EventBridge › Integration › API destinations › Create API destination

Field	Value
Name (required)	`Flashduty`
API destination endpoint (required)	`{integration_url}`
HTTP method (required)	`POST`
Connection type (required)	`Use an existing connection`, then select the `Flashduty` connection created above

Click Create to save.

Where: Amazon SNS › Subscriptions › Create subscription (if the topic does not exist yet, go to Topics › Create topic first and set Type to Standard)

Field	Value
Topic ARN (required)	The SNS topic that forwards EventBridge events
Protocol (required)	`HTTPS`
Endpoint (required)	`{integration_url}`, which must be the push URL of this integration

Click Create subscription and wait until the subscription status is Confirmed. Flashduty only visits subscription confirmation URLs on sns.<region>.amazonaws.com, sns.<region>.amazonaws.com.cn and sns.<region>.amazonaws.eu. For the full SNS topic and subscription steps, see the AWS CloudWatch integration.

Create a rule for Security Hub events in Amazon EventBridge

Where: Amazon EventBridge › Rules › Create rule › Advanced Builder

Field	Value
Builder (when the console offers a choice)	`Advanced Builder`
Name (required)	A name of your choice, for example `Flashduty-SecurityHub`
Event bus	`AWS default event bus`
Rule type (required)	`Rule with an event pattern`, then click Next
Event source (required)	`AWS events or EventBridge partner events`
Creation method / Method (required)	`Custom pattern (JSON editor)`
Event pattern (required)	Paste the event pattern below, then click Next
Target type (required)	`EventBridge API destination`, choose `Use an existing API destination` and the `Flashduty` one created in the previous step (for the SNS method choose `AWS service` › `SNS topic` and that topic)
Execution role (required)	`Create a new role for this specific resource`
Input transformer	Do not configure; send the full event

Event pattern:

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"]
}

Paste the JSON pattern below; the optional Event pattern form opens it in the Pattern Builder.To receive only some findings, filter on finding attributes under detail.findings. For example, only findings produced by Amazon Inspector:

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "ProductArn": ["arn:aws:securityhub:us-east-1::product/aws/inspector"]
    }
  }
}

Do not filter on Workflow.Status, RecordState, Compliance.Status or Severity; the update events for resolved or archived findings would not reach Flashduty and alerts could not recover. A finding’s severity can change when it is updated (for example, a passed control check is INFORMATIONAL). The product (ProductArn) stays the same, so it is safe to filter on. To handle only high-severity findings, filter in Flashduty with an alert pipeline on the severity_label label instead.

Create the rule in every Region where Security Hub is enabled. Security Hub Findings - Custom Action events, sent by custom actions, also carry findings and are handled the same way; add that detail-type to the rule if you use them.

Send a test Security Hub event and confirm

Where: A terminal that can reach the Flashduty push URLThe rule only forwards events that AWS really emits. To verify right away, POST a test event shaped like the real one to the push URL:

curl -X POST '{integration_url}' \
  -H 'Content-Type: application/json' \
  -d '{"version":"0","id":"flashduty-test-1","detail-type":"Security Hub Findings - Imported","source":"aws.securityhub","account":"123456789012","region":"us-east-1","resources":[],"detail":{"findings":[{"ProductArn":"arn:aws:securityhub:us-east-1::product/aws/securityhub","Id":"flashduty-test-finding","ProductName":"Security Hub","AwsAccountId":"123456789012","Title":"Flashduty integration test","Severity":{"Label":"HIGH"},"Workflow":{"Status":"NEW"},"RecordState":"ACTIVE","Resources":[{"Id":"arn:aws:s3:::flashduty-test","Type":"AwsS3Bucket"}]}]}}'

Send it again with Workflow.Status set to RESOLVED to confirm that the alert recovers automatically. A few seconds later, go back to Flashduty. The integration shows a latest event time, which means the setup works.

Field mapping

The detail.findings array of a Security Hub Findings - Imported event holds a single finding. The mapping below is how Flashduty processes these AWS EventBridge events:

Security Hub field	Flashduty
`ProductArn` + `Id`	Alert Key. Later updates of the same finding merge into one alert
`Workflow.Status`, `RecordState`	`Workflow.Status` of `RESOLVED` or `SUPPRESSED`, or `RecordState` of `ARCHIVED`, recovers the alert; any other state triggers or updates it
`Title`	Label `summary` (the alert title is always `aws.securityhub / Security Hub Findings - Imported`)
`Severity.Label`	Label `severity_label`; the alert severity is always Warning, and an alert pipeline can rewrite it based on this label
`Resources[0].Id`, `Resources[0].Type`	Labels `resource`, `resource_type`
`ProductName`, `GeneratorId`, `AwsAccountId`, `Compliance.Status`, `Workflow.Status`, `RecordState`	Labels `product_name`, `generator_id`, `aws_account_id`, `compliance_status`, `workflow_status`, `record_state`
Event `source`, `region`, `account`, `detail-type`, `detail`	Labels `source`, `region`, `account`, `check`, `detail`

Recovery and deduplication

Setting a finding’s workflow status to Resolved or Suppressed, or archiving the finding, produces a new Security Hub Findings - Imported event. Flashduty then closes the alert with the same Alert Key.
When an event contains several findings, each finding becomes its own alert.
If an event lacks Id or ProductArn, Flashduty returns HTTP 400.

Troubleshooting

The API destination call fails: confirm the endpoint is the full push URL including integration_key and that HTTP method is POST
Alerts do not recover: check whether the rule’s event pattern filters on Workflow.Status or RecordState, and whether the target has an Input transformer (the full event must be sent)
Findings from a Region are missing: an EventBridge rule only applies in its own Region; create a rule in every Region where Security Hub is enabled

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

AWS Security Hub alert integration

In Flashduty On-call

Use a dedicated integration

Use a shared integration

Configure in AWS

Field mapping

Recovery and deduplication

Troubleshooting