...
Amazon Security Hub is a bidirectional integration .
...
and setting it up involves multiple steps:
Add an Amazon Security Hub integration in Jira Service Management
Configure the integration in Amazon Security Hub
Configure the integration in Amazon SNS
Configure the integration in Amazon CloudWatch Events
Configure the integration in Amazon EventBridge Events
Send updates back to Amazon Security Hub
Add Amazon Security Hub integration
To add an Amazon Security Hub integration in Jira Service Management:
Go to your team’s operations page.
On the left navigation panel, select Integrations and then Add integration.
Run a search and select “Amazon Security Hub”.
On the next screen, enter aname for the integration.
Optional: Select a team in Assignee team if you want a specific team to receive alerts from the integration.
Select Continue.
The integration is saved at this point.Expand the Steps to configure the integration section and copy the integration endpoint URL.
You will use this URL while configuring the integration in Amazon Security Hub later.Select Turn on integration.
The rules you create for the integration will work only if you turn on the integration.
...
Configure the integration in Amazon Security Hub
...
Create a custom Security Hub action.
Create a rule in CloudWatch Events for Security Hub findings and an SNS topic for CloudWatch Event target by using the CloudFormation template.
Paste the URL you copied while adding the integration in Jira Service Management into SNSSubEndpoint in the CloudFormation template.
Copy-paste the following (after entering the custom Security Hub action ARN you created in Step 1) into EventPatternParameter in the CloudFormation template.
Code Block { "source": [ "aws.securityhub" ], "detail-type": [ "Security Hub Findings - Custom Action" ], "resources": [ "< CUSTOM ACTION ARN YOU CREATED IN SECURITY HUB >" ] }If the configuration is successful, a confirmation alert is created in Jira Service Management.
Select Send Alert Updates Back to AmazonSecurityHub to enable the outgoing functionality.
Allow Jira Service Management to access the Security Hub resources through an IAM Role.
Use CloudFormation template to create an IAM role.Copy-paste the IAM Role ARN into AmazonSecurityHub Role ARN.
Select the AWS region where you’ve set up the Security Hub.
...
Configure the integration in Amazon SNS
Go to AWS SNS, select Topics > Create topic.
When on the Subscription tab, select Create subscription. This is how you’ll send SNS messages to Jira Service Management.
In the Protocol field select HTTPS as an endpoint type.
In the Endpoint field, enter the API endpoint URL you copied while adding the integration in Jira Service Management.
...
Configure the integration in Amazon CloudWatch Events
...
In your Amazon CloudWatch account select Events > Rules.
Then select Create rule.
In the Event Source section select the Event Pattern option.
Then select Build event pattern to match all events from the dropdown menu.
Select Edit in the Event Pattern Preview and enter the script below provided to you under this section.
In the Targets section select the SNS topic from the dropdown menu, then select the topic you’ve created before.
Select Configure details and enter a name, description, and other details.
When done, select Create rule.
...
| Code Block |
|---|
{
"source": [
"aws.securityhub"
],
"detail-type": [
"Security Hub Findings - Custom Action"
],
"resources": [
<custom action arn you created in security hub>
]
}
|
...
Configure the integration in Amazon EventBridge Events
...
Go to Amazon EventBridge and select Rules.
Select Create rule.
In Step 1, enter a Name and Description for this rule.
Select Rule with an event patterns as Rue type and select Next.
In Step 2, select AWS events and EventBrigde partner events as the Event source.
Then, select AWS services as Event source.
Select Security Hub as AWS Service.
In the Event Type section, select the custom action you created in the security hub.
Select Next.
In Step 3, select SNS topic from the dropdown menu in Target types, then select the topic you created before in the Topic field.
Select Next.
In Step 5, review and create the rule.
...
Send updates back to Amazon Security Hub
Complete the following steps to send alert updates back to Amazon Security Hub:
...