AWS Security Hub

AWS Security Hub Integration with DefectDojo

AWS Security Hub is the central aggregation point for security findings across an AWS environment — pulling in results from native AWS services like GuardDuty, Inspector, Macie, IAM Access Analyzer, and Firewall Manager, as well as dozens of third-party security tools that integrate directly with Security Hub's standardized finding format. For teams operating in AWS, it provides a single console view of cloud security posture that would otherwise require navigating five or more separate AWS services. What Security Hub doesn't provide is a cross-functional vulnerability management workflow — the kind where remediation is assigned to specific teams, SLA deadlines are tracked and enforced, risk acceptance decisions are documented with approver records, and posture trends are reported longitudinally across quarters. Integrating AWS Security Hub with DefectDojo provides exactly that operational layer, turning Security Hub's aggregated AWS signal into a managed, auditable remediation program with full lifecycle tracking from detection through verified closure.

Why AWS Security Hub Matters

Security Hub has become the de facto aggregation layer for AWS security findings, combining native AWS service integration with a normalized finding format that enables cross-source analysis.

• Security Hub ingests findings from GuardDuty (threat detection), Inspector v2 (vulnerability management for EC2 and container workloads), Macie (S3 data security and sensitive data discovery), IAM Access Analyzer (identity and resource policy analysis), Firewall Manager (network security policy compliance), and Systems Manager Patch Manager — giving a single view of findings across the most security-relevant AWS services
• The Amazon Security Finding Format (ASFF) normalizes findings from all integrated sources into a consistent schema, enabling cross-service filtering, correlation, and export without format-specific handling for each source
• Security Hub runs automated security checks against AWS Foundations Best Practices, CIS AWS Foundations Benchmark, PCI DSS, NIST SP 800-53, and other standards — surfacing configuration findings continuously without manual assessment runs
• Multi-account aggregation via AWS Organizations allows a central security account to receive findings from all member accounts in an organization, providing estate-wide visibility without per-account console access
• Security Hub findings are exportable via the AWS CLI, SDK, and EventBridge — giving teams multiple options for building automated pipelines that push findings into downstream systems including DefectDojo
• The breadth of integrated sources means that a single Security Hub export can carry GuardDuty threat detections, Inspector CVEs, Macie data findings, and compliance check failures in a single JSON output — all consumable by DefectDojo's Security Hub parser

Advantages of This Integration

Security Hub aggregates your AWS security signal. DefectDojo operationalizes the response across teams, timelines, and audit requirements.

• Persistent finding records across the dynamic AWS estate: AWS environments change continuously — instances launch and terminate, buckets are created and deleted, policies change. DefectDojo's reimport workflow captures finding history across this flux, tracking when issues first appeared, when they resolved, and whether they re-emerged — giving an audit-ready record that Security Hub's live console doesn't retain beyond its 90-day finding window.
• SLA enforcement across finding source types: GuardDuty threat detections, Inspector CVEs, and compliance check failures have different remediation owners and urgency profiles. DefectDojo applies configurable SLA policies by severity, tracks breach dates, and surfaces overdue findings in dashboards and reports — turning Security Hub severity ratings into enforceable deadlines with documented breach history.
• Multi-account portfolio visibility in a single platform: Security teams managing AWS Organizations with dozens or hundreds of accounts use Security Hub's aggregation to collect cross-account findings, then import them into DefectDojo to apply the lifecycle management layer Security Hub itself lacks. DefectDojo's product structure maps naturally to accounts or business units, giving security leadership an aggregated posture view with assignment and SLA tracking attached.
• Risk acceptance with documented audit trail: Many Security Hub findings — particularly compliance checks — reflect architectural decisions that are intentional rather than remediation targets. DefectDojo captures risk acceptance decisions with justification, approver identity, and expiration dates — persistent across reimports and available for auditor review without hunting through Security Hub suppression records.
• Cross-team remediation routing: Security Hub findings span multiple owners — GuardDuty detections go to the security operations team, Inspector findings go to application or platform engineering, Macie findings go to data owners, compliance failures go to cloud infrastructure. DefectDojo's assignment model routes each finding to the right owner with context, without a manual triage meeting per export cycle.
• Compliance posture tracking over time: Security Hub's compliance check findings map to CIS, PCI DSS, NIST, and other framework controls. DefectDojo retains that mapping across reimports, enabling longitudinal tracking of compliance posture — which controls are consistently failing, which regressed after remediation, and how the overall compliance score trends over quarters.
• Ticketing integration for remediation handoff: Triaged Security Hub findings push from DefectDojo to Jira, ServiceNow, or GitHub Issues with finding type, affected resource, severity, and AWS remediation guidance included — giving infrastructure and application teams actionable tickets without requiring Security Hub console access.

How This Integration Works

AWS Security Hub findings are exported via the AWS CLI or SDK in ASFF-compliant JSON format and imported into DefectDojo using the Security Hub parser.

Step 1 — Export findings from AWS Security Hub

Using the AWS CLI to export findings:

# Export all active findings to JSON

aws securityhub get-findings \

--filters '{"RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]}' \

--output json \

> security-hub-findings.json

# Filter by severity (CRITICAL and HIGH only)

aws securityhub get-findings \

--filters '{

"RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}],

"SeverityLabel": [

{"Value": "CRITICAL", "Comparison": "EQUALS"},

{"Value": "HIGH", "Comparison": "EQUALS"}

]

}' \

--output json \

> security-hub-critical-high.json

# Filter by specific finding source (e.g., GuardDuty only)

aws securityhub get-findings \

--filters '{

"ProductName": [{"Value": "GuardDuty", "Comparison": "EQUALS"}],

"RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]

}' \

--output json \

> security-hub-guardduty.json

# Multi-account aggregation — run from the delegated administrator account

aws securityhub get-findings \

--filters '{"RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]}' \

--region us-east-1 \

--output json \

> security-hub-org-findings.json

For automated pipeline export, use EventBridge to stream new and updated findings to an S3 bucket or Lambda function that triggers the DefectDojo import:

# Example: Export findings updated in the last 24 hours

aws securityhub get-findings \

--filters '{

"RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}],

"UpdatedAt": [{"Start": "2025-05-12T00:00:00Z", "End": "2025-05-13T00:00:00Z", "DateRange": {"Value": 1, "Unit": "DAYS"}}]

}' \

--output json \

> security-hub-daily.json

Step 2 — Import into DefectDojo

Use AWS Security Hub Scan as the scan type:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=AWS Security Hub Scan" \

-F "file=@security-hub-findings.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Step 3 — Reimport for recurring exports

For environments where Security Hub findings are exported on a regular cadence — daily or weekly — use the reimport endpoint to update existing finding states:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=AWS Security Hub Scan" \

-F "file=@security-hub-findings.json" \

-F "test=<test-id>"

DefectDojo marks findings absent from the new export as resolved, creates records for new findings, and leaves previously accepted or false-positived findings untouched.

Data Granularity: What Gets Imported

Use Cases

For continuous AWS security operations across an organization: An organization with 40 AWS accounts uses Security Hub's Organizations integration to aggregate all findings into a central security account. Daily exports import into DefectDojo, organized by account under a product-per-account structure. GuardDuty detections route to the SOC team; Inspector findings route to application engineering; compliance failures route to the cloud platform team. SLA tracking in DefectDojo surfaces which teams are meeting remediation commitments and which accounts have the longest-standing unaddressed findings.

For Inspector vulnerability management at scale: AWS Inspector v2 generates CVE findings for EC2 instances and container images continuously as new vulnerabilities are published. Security Hub aggregates these findings across all accounts. Daily Security Hub exports into DefectDojo give the vulnerability management team a persistent, deduplicated record of Inspector findings with SLA tracking attached — closing the gap between Inspector's continuous detection and the team's ability to track remediation to completion.

During a pre-audit compliance preparation: Ahead of a PCI DSS or CIS benchmark audit, the security team exports Security Hub findings filtered to the relevant compliance standard and imports them into a dedicated DefectDojo engagement. Findings are triaged, remediated, and a follow-up export reimported into the same engagement to confirm closure. The before-and-after record in DefectDojo provides auditors with structured evidence of identified gaps and documented remediation — without manual extraction from Security Hub's console.

For Macie sensitive data finding management: Macie generates findings when it detects sensitive data in S3 buckets — PII, financial data, credentials — and reports them to Security Hub. These findings import into DefectDojo under a dedicated data security engagement, routed to data owners for review. Risk acceptance decisions for intentional sensitive data stores are documented in DefectDojo with business justification and expiration dates — giving the security team an auditable record of what sensitive data exposure is known and accepted versus what requires remediation.

For new account security baseline establishment: When a new AWS account is provisioned and Security Hub is enabled, the initial findings export represents the account's security debt at baseline. Importing this into a DefectDojo engagement tied to the new account establishes a tracked starting point — every finding is accounted for, triaged, and either assigned for remediation or risk-accepted with documented rationale from day one.

Operational Tips

• Use finding source filters to separate product types into distinct engagements: GuardDuty threat detections, Inspector CVEs, Macie data findings, and Security Hub compliance checks have fundamentally different remediation owners and urgency profiles. Filtering by ProductName on export and importing into separate DefectDojo engagements keeps ownership and SLA policies clean — don't mix threat detections with configuration findings in the same engagement.
• Export daily to stay within Security Hub's 90-day finding window: Security Hub retains findings for 90 days by default. If your export cadence is longer than that, findings that aged out of Security Hub will appear as resolved in DefectDojo not because they were fixed but because they were deleted. Daily or weekly exports with reimport keep DefectDojo's finding state accurate.
• Use EventBridge for real-time finding ingestion in high-velocity environments: For production accounts with high GuardDuty finding volumes, polling the Security Hub API on a schedule introduces latency. EventBridge rules can stream new and updated findings to an S3 bucket or Lambda function that triggers a DefectDojo import automatically — reducing detection-to-tracking lag for active threat findings.
• Map DefectDojo products to AWS accounts or business units, not to finding types: The finding type (GuardDuty, Inspector, etc.) is captured as a tag or in the engagement name. The product should represent the organizational entity responsible for that AWS account — a business unit, application team, or environment tier. This keeps ownership routing and SLA accountability attached to the right teams.
• Document Security Hub suppressions as DefectDojo risk acceptances: Security Hub supports workflow suppression (Workflow.Status = SUPPRESSED) for findings that are accepted or not applicable. Where possible, mirror suppression decisions as risk acceptances in DefectDojo — the rationale, approver, and expiration date are then auditable in the vulnerability management platform rather than visible only to those with Security Hub console access.
• Filter INFORMATIONAL severity findings on import: Security Hub Informational findings are typically observations rather than actionable security issues. Importing them as inactive in DefectDojo keeps your active queue focused on rated risk while preserving the data for completeness and compliance evidence.
• Coordinate finding status between Security Hub and DefectDojo: When a finding is resolved in DefectDojo after verification, confirm that the corresponding Security Hub finding has also transitioned to RESOLVED or SUPPRESSED workflow status. Keeping both platforms in sync prevents confusion when security team members check finding status in the AWS console versus in DefectDojo.
• Use AWS Config alongside Security Hub for remediation verification: Security Hub detects misconfigurations; AWS Config tracks configuration change history. When a finding is remediated and marked resolved in DefectDojo, AWS Config's change timeline provides independent verification that the configuration actually changed — useful for closing the loop on compliance evidence without re-running a full Security Hub export.