AWS Security Hub Integration with DefectDojo

AWS Security Hub Integration with DefectDojo

AWS Security Hub is Amazon Web Services' service for aggregating security findings across AWS accounts. It runs its own compliance checks against security standards such as the AWS Foundational Security Best Practices and CIS benchmarks, and collects findings from services like Amazon GuardDuty and Amazon Inspector and from third-party tools, all normalized into the AWS Security Finding Format (ASFF). AWS now calls this service AWS Security Hub CSPM, alongside a newer Security Hub offering. DefectDojo reads ASFF findings, retrieved with the AWS CLI or produced by tools that emit ASFF, and can also import Amazon Inspector findings straight from the Inspector API (aws inspector2). DefectDojo Pro adds a Security Hub connector.

AWS Security Hub Integration with DefectDojo

Security Hub is where AWS findings collect, but it is not where our application teams work, and it knows nothing about our code, container, or pentest findings. Bringing Security Hub findings into DefectDojo puts failed controls, GuardDuty detections, and Inspector CVEs on the same Assets as everything else, with owners, SLAs, and Jira tickets. Security Hub's own status for each finding comes along, so something AWS marks as resolved shows up as mitigated in DefectDojo too.

Why AWS Security Hub Matters

Most AWS estates span many accounts and regions, and each AWS security service reports in its own console.

• Security Hub gives one feed across accounts and services, in a single schema.
• Its compliance checks cover the configuration mistakes that cause most cloud incidents.
• GuardDuty findings flag suspicious activity, while Inspector findings report CVEs in EC2 instances, ECR images, and Lambda functions.
• Every finding carries the account, region, and affected resource ARN, which is what you need to route it.
• Security Hub tracks state, but it doesn't assign owners or measure time to remediate against your SLAs.

Advantages of This Integration

What we gained by routing Security Hub findings through DefectDojo:

• Stable identity. The Security Hub and ASFF scan types deduplicate on the unique ID from the tool, which is the finding's Security Hub Id, and the Inspector2 scan type uses the Inspector findingArn, so a finding is matched across exports regardless of wording changes.
• Status carried over. Compliance findings that passed and Inspector findings whose status is not ACTIVE arrive as inactive and mitigated. GuardDuty findings that are no longer active are marked mitigated but stay active. LastObservedAt is used as the mitigation date when it is present.
• Source-aware parsing. Compliance, GuardDuty, and Inspector findings each get their own mapping. Inspector findings carry CVE IDs, CVSS vectors, EPSS scores, and package upgrade guidance.
• Inspector without Security Hub. For a single EC2 instance, ECR image, or Lambda function, Inspector findings can be imported directly with the AWS Inspector2 Scan type, including code vulnerabilities and network reachability findings.
• Account-level views. File imports create a Test whose description lists the AWS accounts and finding origins in the report.
• One SLA model. Cloud findings follow the same severity SLAs, risk acceptance, and Jira workflows as application findings.

How This Integration Works

There are three scan types and a DefectDojo Pro connector.

AWS Security Hub Scan. Reads the JSON returned by aws securityhub get-findings, an object with a Findings list. Filter it to what you want to track:

aws securityhub get-findings --filters 'ComplianceStatus=[{Comparison=EQUALS,Value=FAILED}]' > securityhub-failed.json
aws securityhub get-findings --filters 'ProductName=[{Value=Inspector,Comparison=EQUALS}]' > securityhub-inspector.json

AWS Security Finding Format (ASFF) Scan. Reads a JSON array of ASFF findings, such as the output of tools that write ASFF directly. Prowler, for example, produces it with -M json-asff.

AWS Inspector2 Scan. Reads the JSON returned by aws inspector2 list-findings (the current Inspector API, not Inspector Classic), an object with a findings list. It works in a standalone account or the Inspector delegated administrator account, and fits best when you pull findings for one resource, such as an instance or ECR image, into a Test that represents that workload:

aws inspector2 list-findings --filter-criteria '{"resourceId":[{"comparison":"EQUALS","value":"i-0abc123def4567890"}]}' --region us-east-1 > inspector2-findings.json

Import a file. In the UI, open the Engagement, choose Import Scan Results, select the scan type, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=AWS Security Hub Scan" \
  -F "file=@securityhub-failed.json" \
  -F "product_name=aws-prod-us-east-1" \
  -F "engagement_name=Security Hub" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "AWS Security Hub Scan" \
  --report-path "./securityhub-failed.json" \
  --product-name "aws-prod-us-east-1" \
  --engagement-name "Security Hub" \
  --auto-create-context

Security Hub connector (DefectDojo Pro). The connector calls the Security Hub APIs with an AWS access key. Create a dedicated IAM user with the AWS managed AWSSecurityHubReadOnlyAccess policy, or a custom policy allowing DescribeHub, GetFindingAggregator, GetFindings, and ListFindingAggregators. Enter the regional Security Hub endpoint (for example https://securityhub.us-east-1.amazonaws.com) as the Location, then the access key and secret key. With cross-region aggregation enabled, point it at the aggregation region and linked regions get their own Records.

By default the connector creates one Record and Asset per AWS account and region. The optional Asset Grouping setting can instead create Assets per resource type or per individual resource, with account and region Assets becoming parents when the Asset Hierarchy feature is enabled. Further options add a parent Asset per AWS account and place each account's Assets in its own Organization, by account ID, account name, AWS Organizations OU, or an account tag.

Data Granularity: What Gets Imported

The table describes the AWS Security Hub Scan type.

ASFF Scan differences. Severity uses Severity.Label, falling back to Normalized (0 Info, 1 to 39 Low, 40 to 69 Medium, 70 to 89 High, 90 and up Critical). The description begins with the resource ARNs, which also fill Impact. The finding is active only when RecordState is ACTIVE. The date comes from CreatedAt, and private IPv4 addresses of EC2 instances become endpoints. Deduplication also uses the Id.

AWS Inspector2 Scan:

Use Cases

For multi-account AWS estates: DefectDojo Pro teams connect Security Hub in the aggregation region and group Assets by resource, so each workload team sees findings for the resources it owns.

For focused file imports: A team without the connector exports failed compliance checks and Inspector findings separately each week and reimports them into stable Tests, which keeps configuration and vulnerability work apart.

For compliance programs: Security Hub's standards map to frameworks auditors recognize. DefectDojo keeps when each failed control was found and closed.

For container and host CVEs: Inspector findings arrive with CVEs, CVSS, and EPSS, so they can be prioritized and deduplicated next to CVEs from pipeline scanners on the same Asset.

Operational Tips

• Filter exports before import. An unfiltered get-findings call returns passed controls too, and compliance findings without a FAILED status are imported as mitigated.
• Third-party findings without a Compliance block go through the compliance mapping, which treats a missing status as passed. To keep them active, extract the Findings array and import it with the ASFF Scan type, which sets status from RecordState.
• Don't cap exports with --max-items for reimports. Findings missing from a partial export are mitigated in the Test.
• Use one Test per account and region, or per finding source, and reimport into it. For AWS Inspector2 Scan, filter list-findings to one resource per Test, so a reimport doesn't mitigate findings from resources outside the filter.
• Inspector findings still marked UNTRIAGED import as Info. Review them before relying on minimum_severity, which would drop them.
• Tag imports with account and region (for example tags=prod,us-east-1) for filtering.
• On DefectDojo Pro, prefer the connector for ongoing use. It syncs on a schedule and maps accounts to Assets without scripts.