AWS Security Hub Remediation Guide

https://github.com/awsdocs/aws-security-hub-user-guide/blob/master/doc_source/securityhub-cloudwatch-events.md

With Amazon EventBridge, you can automate your AWS services to respond automatically to system events such as application availability issues or resource changes. Events from AWS services are delivered to EventBridge in near-real time and on a guaranteed basis. You can write simple rules to indicate which events you are interested in and what automated actions to take when an event matches a rule. The actions that can be automatically triggered include the following:

  • Invoking an AWS Lambda function
  • Invoking the Amazon EC2 run command
  • Relaying the event to Amazon Kinesis Data Streams
  • Activating an AWS Step Functions state machine
  • Notifying an Amazon SNS topic or an Amazon SQS queue
  • Sending a finding to a third-party ticketing, chat, SIEM, or incident response and management tool

Security Hub automatically sends all new findings and all updates to existing findings to EventBridge as EventBridge events. You can also create custom actions that allow you to send selected findings and insight results to EventBridge.

You then configure EventBridge rules to respond to each type of event.

For more information about using EventBridge, see the https://docs.aws.amazon.com/eventbridge/latest/userguide/what-is-amazon-eventbridge.html.