...
Use the Amazon Security Hub Integration integration to forward Amazon Security Hub findings to Jira Service Management. Jira Service Management determines the right people to notify based on on-call schedules – notifies via email, text messages (SMS), phone calls, and iOS & Android push notifications, and escalates alerts until they are acknowledged or closed.
...
When an alert is Acknowledged in Jira Service Management, update the Finding workflow status to Notified in Amazon Security Hub.
When an alert is Closed in Jira Service Management, update the Finding workflow status to Resolved in Amazon Security Hub.
When a Note is added to the alert in Jira Service Management, add the same Note to the Finding in Amazon Security Hub.
When an alert Priority is updated in Jira Service Management, update the severity of the Finding in Amazon Security Hub.
...
Set up the integration
Amazon Security Hub is a bidirectional integration, and setting it up involves multiple . Adding it to Jira Service Management and configuring it to send alert updates back to Amazon Security Hub (when some actions are performed on the alerts created in Jira Service Management) involves a sequence of steps:
Add an Amazon Security Hub integration in Jira Service Management
Configure the integration in Amazon Security Hub
Configure the integration in Amazon SNS
Configure the integration in Amazon CloudWatch Events
Configure the integration Create subscriptions to send SNS messages to Jira Service Management
Create an Amazon CloudWatch Event rule
Select an SNS topic for the target in Amazon EventBridge Events
Send updates back to Amazon Security Hub
Add Amazon Security Hub integration
| Info |
|---|
If you're using the Free or Standard plan in Jira Service Management, you can only add this integration from your team’s operations page. To access the feature through Adding an integration from your team’s operations page makes your team the owner of the integration. This means Jira Service Management assigns the alerts received through this integration to your team only |
...
To add an integration:
Go to your team’s operations page.
On the left navigation panel, select Integrations and then Add integration.
...
. |
To add an Amazon Security Hub integration in Jira Service Management:
...
Create a custom Security Hub action.
Create a rule in CloudWatch Events for Security Hub findings and an SNS topic for CloudWatch Event target by using the CloudFormation template.
Paste the URL you copied while adding the integration in Jira Service Management into SNSSubEndpoint in the CloudFormation template.
Copy-paste the following (after entering the custom Security Hub action ARN you created in Step 1) into EventPatternParameter in the CloudFormation template.
Code Block { "source": [ "aws.securityhub" ], "detail-type": [ "Security Hub Findings - Custom Action" ], "resources": [ "< CUSTOM ACTION ARN YOU CREATED IN SECURITY HUB >" ] }If the configuration is successful, a confirmation alert is created in Jira Service Management.
Select Send alert updates back to Amazon Security Hub to enable turn on the outgoing functionality.
Allow Jira Service Management to access the Security Hub resources through an IAM Role.
Use CloudFormation template to create an IAM role.Copy-paste the IAM Role ARN into AmazonSecurityHub Role ARN.
Select the AWS region where you’ve set up the Security Hub.
...
Create subscriptions to send SNS messages to Jira Service Management
Selecting an SNS topic for the target lets you publish the related event message for findings to SNS.
Go to AWS SNS, select Topics > Create topic.
When on the Subscription tab, select Create subscription.
This is how you’ll send SNS messages to Jira Service Management.In the Protocol field, select HTTPS as an endpoint type.
In the Endpoint field, enter the API endpoint URL you copied while adding the integration in Jira Service Management.
...
Create an Amazon CloudWatch Event rule
Create an Amazon CloudWatch Event rule so Amazon Security Hub can send findings matching the rule to CloudWatch.
In your Amazon CloudWatch account, select Events > Rules.
Then select Select Create rule.
In the Event Source section, select the Event Pattern option.
Then selectSelect Build event pattern to match all events from the dropdown menu.
Select Edit in the Event Pattern Preview and copy-paste the script given in this section.
In the Targets section, select the SNS topic from the dropdown menu, then select the topic you’ve you created before.
Select Configure details and enter a name, description, and other information.
When done, select Select Create rule.
Event pattern preview script
Enter Copy the script below in following script and paste it into the Event pattern preview section of the Event Source.JSON
| Expand | ||
|---|---|---|
| ||
|
...
Select an SNS topic for the target in Amazon EventBridge Events
Selecting an SNS topic for the target lets you publish the related event message for findings to SNS which will send this message to Jira Service Management at the end.
Go to Amazon EventBridge and select Rules.
Select Create rule.
In Step 1, enter a Name and Description for this rule.
Select Rule with an event patternspattern as Rue Rule type and select Next.
In Step 2, select AWS events and EventBrigde partner events as the Event source.
Select AWS services as Event source.
Select Security Hub as AWS Service.
In the Event Type section, select the custom action you created in the security hub.
Select Next.
In Step 3, select SNS topic from the dropdown menu in Target types, then select the topic you created before earlier in the Topic field.
Select Next.
In Step 5, review and create the rule.
...
Sample payload from Amazon Security Hub
| Expand | ||
|---|---|---|
| ||
|
...
See also
...