Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
Integrasi dengan AWS Security Hub
AWS Security Hub memberi Anda gambaran menyeluruh tentang status keamanan Anda dalam AWS dan membantu Anda memeriksa lingkungan Anda terhadap standar industri keamanan dan praktik terbaik. Security Hub mengumpulkan data keamanan dari berbagai AWS akun, layanan, dan produk mitra pihak ketiga yang didukung serta membantu Anda menganalisis tren keamanan dan mengidentifikasi masalah keamanan prioritas tertinggi.
GuardDuty Integrasi Amazon dengan Security Hub memungkinkan Anda mengirim temuan GuardDuty ke Security Hub. Security Hub kemudian dapat menyertakan temuan tersebut dalam analisis postur keamanan Anda.
Daftar Isi
Bagaimana Amazon GuardDuty mengirimkan temuan ke AWS Security Hub
Pada tahun AWS Security Hub, masalah keamanan dilacak sebagai temuan. Beberapa temuan berasal dari masalah yang terdeteksi oleh AWS layanan lain atau oleh mitra pihak ketiga. Security Hub juga memiliki seperangkat aturan yang digunakan untuk mendeteksi masalah keamanan dan menghasilkan temuan.
Security Hub menyediakan alat untuk mengelola temuan dari seluruh sumber tersebut. Anda dapat melihat dan mem-filter daftar temuan dan melihat detail suatu temuan. Untuk informasi lebih lanjut, lihat Melihat temuan dalam Panduan Pengguna AWS Security Hub . Anda juga dapat melacak status penyelidikan temuan. Untuk informasi lebih lanjut, lihat Mengambil tindakan pada temuan dalam Panduan Pengguna AWS Security Hub .
Semua temuan di Security Hub menggunakan format JSON standar yang disebut AWS Security Finding Format (ASFF). ASFF mencakup detail tentang sumber masalah, sumber daya yang terdampak, dan status temuan saat ini. Lihat AWS Security Finding Format (ASFF) di Panduan Pengguna AWS Security Hub .
Amazon GuardDuty adalah salah satu AWS layanan yang mengirimkan temuan ke Security Hub.
Jenis temuan yang GuardDuty dikirim ke Security Hub
Setelah Anda mengaktifkan GuardDuty dan Security Hub di akun yang sama dalam akun yang sama Wilayah AWS, GuardDuty mulai mengirim semua temuan yang dihasilkan ke Security Hub. Temuan ini dikirim ke Security Hub menggunakan AWS
Security Finding Format (ASFF). Dalam ASFF, bidang Types menyediakan jenis temuan.
Latensi untuk mengirimkan temuan baru
Saat GuardDuty membuat temuan baru, biasanya dikirim ke Security Hub dalam waktu lima menit.
Mencoba kembali saat Security Hub tidak tersedia
Jika Security Hub tidak GuardDuty tersedia, coba lagi mengirimkan temuan sampai diterima.
Memperbarui temuan yang ada di Security Hub
Setelah mengirimkan temuan ke Security Hub, GuardDuty mengirimkan pembaruan untuk mencerminkan pengamatan tambahan dari aktivitas temuan ke Security Hub. Pengamatan baru dari temuan ini dikirim ke Security Hub berdasarkan Langkah 5 - Frekuensi untuk mengekspor temuan pengaturan di Anda Akun AWS.
Saat Anda mengarsipkan atau membatalkan arsip temuan, GuardDuty tidak akan mengirim temuan itu ke Security Hub. Temuan yang tidak diarsipkan secara manual yang nantinya menjadi aktif tidak GuardDuty dikirim ke Security Hub.
Melihat GuardDuty temuan di AWS Security Hub
Untuk melihat GuardDuty temuan Anda di Security Hub, pilih Lihat Temuan di bawah Amazon GuardDuty dari halaman ringkasan. Atau, Anda dapat memilih Temuan dari panel navigasi dan memfilter temuan untuk hanya menampilkan GuardDuty temuan dengan memilih bidang Nama produk: dengan nilaiGuardDuty.
Menafsirkan GuardDuty menemukan nama di AWS Security Hub
GuardDuty mengirimkan temuan ke Security Hub menggunakan AWS
Security Finding Format (ASFF). Dalam ASFF, bidang Types menyediakan jenis temuan. Jenis ASFF menggunakan skema penamaan yang berbeda dari GuardDuty tipe. Tabel di bawah ini merinci semua jenis GuardDuty temuan dengan rekan ASFF mereka saat muncul di Security Hub.
catatan
Untuk beberapa jenis GuardDuty temuan Security Hub memberikan nama temuan ASFF yang berbeda tergantung pada apakah Peran Sumber Daya detail temuan adalah ACTOR atau TARGET. Untuk mengetahui informasi selengkapnya, lihat Detail temuan.
|
GuardDuty menemukan jenis |
Tipe temuan ASFF |
|---|---|
|
TTPs/Command and Control/Backdoor:EC2-C&CActivity.B |
|
|
TTPs/Command and Control/Backdoor:EC2-C&CActivity.B!DNS |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.Dns |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.Tcp |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.Udp |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.UdpOnTcpPorts |
|
|
TTPs/Command and Control/Backdoor:EC2-DenialOfService.UnusualProtocol |
|
|
TTPs/Command and Control/Backdoor:EC2-Spambot |
|
|
Unusual Behaviors/VM/Behavior:EC2-NetworkPortUnusual |
|
|
Unusual Behaviors/VM/Behavior:EC2-TrafficVolumeUnusual |
|
|
TTPs/Command and Control/Backdoor:Lambda-C&CActivity.B |
|
|
TTPs/Command and Control/Backdoor:Runtime-C&CActivity.B |
|
|
TTPs/Command and Control/Backdoor:Runtime-C&CActivity.B!DNS |
|
|
TTPs/Credential Access/IAMUser-AnomalousBehavior |
|
|
CredentialAccess:Kubernetes/AnomalousBehavior.SecretsAccessed |
TTPs/AnomalousBehavior/CredentialAccess:Kubernetes-SecretsAccessed |
|
TTPs/Credential Access/CredentialAccess:RDS-AnomalousBehavior.FailedLogin |
|
|
TTPs/Credential Access/RDS-AnomalousBehavior.SuccessfulBruteForce |
|
|
TTPs/Credential Access/RDS-AnomalousBehavior.SuccessfulLogin |
|
|
TTPs/Credential Access/RDS-MaliciousIPCaller.FailedLogin |
|
|
TTPs/Credential Access/RDS-MaliciousIPCaller.SuccessfulLogin |
|
|
TTPs/Credential Access/RDS-TorIPCaller.FailedLogin |
|
|
TTPs/Credential Access/RDS-TorIPCaller.SuccessfulLogin |
|
|
TTPs/Command and Control/CryptoCurrency:EC2-BitcoinTool.B |
|
|
TTPs/Command and Control/CryptoCurrency:EC2-BitcoinTool.B!DNS |
|
|
TTPs/Command and Control/CryptoCurrency:Lambda-BitcoinTool.B Effects/Resource Consumption/CryptoCurrency:Lambda-BitcoinTool.B |
|
|
TTPs/Command and Control/CryptoCurrency:Runtime-BitcoinTool.B |
|
|
TTPs/Command and Control/CryptoCurrency:Runtime-BitcoinTool.B!DNS |
|
|
TTPs/DefenseEvasion/EC2:Unusual-DNS-Resolver |
|
|
TTPs/DefenseEvasion/EC2:Unusual-DoH-Activity |
|
|
TTPs/DefenseEvasion/EC2:Unusual-DoT-Activity |
|
|
TTPs/Defense Evasion/IAMUser-AnomalousBehavior |
|
|
TTPs/Defense Evasion/DefenseEvasion:Runtime-FilelessExecution |
|
|
TTPs/DefenseEvasion/DefenseEvasion:Runtime-PtraceAntiDebugging |
|
|
TTPs/DefenseEvasion/DefenseEvasion:Runtime-SuspiciousCommand |
|
|
TTPs/Discovery/IAMUser-AnomalousBehavior |
|
|
TTPs/AnomalousBehavior/Discovery:Kubernetes-PermissionChecked |
|
|
TTPs/Discovery/RDS-MaliciousIPCaller |
|
|
TTPs/Discovery/RDS-TorIPCaller |
|
|
TTPs/Discovery:S3-AnomalousBehavior |
|
|
TTPs/Discovery:S3-BucketEnumeration.Unusual |
|
|
TTPs/Discovery:S3-MaliciousIPCaller.Custom |
|
|
TTPs/Discovery:S3-TorIPCaller |
|
|
TTPs/Discovery:S3-MaliciousIPCaller |
|
|
TTPs/AnomalousBehavior/Execution:Kubernetes-ExecInPod |
|
|
TTPs/AnomalousBehavior/Execution:Kubernetes-WorkloadDeployed |
|
|
Persistence:Kubernetes/AnomalousBehavior.WorkloadDeployed!ContainerWithSensitiveMount |
TTPs/AnomalousBehavior/Persistence:Kubernetes-WorkloadDeployed!ContainerWithSensitiveMount |
PrivilegeEscalation:Kubernetes/AnomalousBehavior.WorkloadDeployed!PrivilegedContainer |
TTPs/AnomalousBehavior/PrivilegeEscalation:Kubernetes-WorkloadDeployed!PrivilegedContainer |
|
TTPs/Execution/Execution:EC2-MaliciousFile |
|
|
TTPs/Execution/Execution:ECS-MaliciousFile |
|
|
TTPs/Execution/Execution:Kubernetes-MaliciousFile |
|
|
TTPs/Execution/Execution:Container-MaliciousFile |
|
|
TTPs/Execution/Execution:EC2-SuspiciousFile |
|
|
TTPs/Execution/Execution:ECS-SuspiciousFile |
|
|
TTPs/Execution/Execution:Kubernetes-SuspiciousFile |
|
|
TTPs/Execution/Execution:Container-SuspiciousFile |
|
|
TTPs/Execution/Execution:Runtime-MaliciousFileExecuted |
|
|
TTPs/Execution/Execution:Runtime-NewBinaryExecuted |
|
|
TTPs/Execution/Execution:Runtime-NewLibraryLoaded |
|
|
TTPs/Execution/Execution:Runtime-ReverseShell |
|
|
TTPs/Execution/Execution:Runtime-SuspiciousCommand |
|
|
TTPs/Execution/Execution:Runtime-SuspiciousTool |
|
|
TTPs/Exfiltration:S3-AnomalousBehavior |
|
|
TTPs/Exfiltration:S3-ObjectRead.Unusual |
|
|
TTPs/Exfiltration:S3-MaliciousIPCaller |
|
|
TTPs/Impact:EC2-AbusedDomainRequest.Reputation |
|
|
TTPs/Impact:EC2-BitcoinDomainRequest.Reputation |
|
|
TTPs/Impact:EC2-MaliciousDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:EC2-PortSweep |
|
|
TTPs/Impact:EC2-SuspiciousDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:EC2-WinRMBruteForce |
|
|
TTPs/Impact/IAMUser-AnomalousBehavior |
|
|
TTPs/Impact/Impact:Runtime-AbusedDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:Runtime-BitcoinDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:Runtime-CryptoMinerExecuted |
|
|
TTPs/Impact/Impact:Runtime-MaliciousDomainRequest.Reputation |
|
|
TTPs/Impact/Impact:Runtime-SuspiciousDomainRequest.Reputatio |
|
|
TTPs/Impact:S3-AnomalousBehavior.Delete |
|
|
TTPs/Impact:S3-AnomalousBehavior.Permission |
|
|
TTPs/Impact:S3-AnomalousBehavior.Write |
|
|
TTPs/Impact:S3-ObjectDelete.Unusual |
|
|
TTPs/Impact:S3-PermissionsModification.Unusual |
|
|
TTPs/Impact:S3-MaliciousIPCaller |
|
|
TTPs/Initial Access/IAMUser-AnomalousBehavior |
|
|
TTPs/PenTest:IAMUser/KaliLinux |
|
|
TTPs/PenTest:IAMUser/ParrotLinux |
|
|
TTPs/PenTest:IAMUser/PentooLinux |
|
|
TTPs/PenTest:S3-KaliLinux |
|
|
TTPs/PenTest:S3-ParrotLinux |
|
|
TTPs/PenTest:S3-PentooLinux |
|
| TTPs/Persistence/IAMUser-AnomalousBehavior | |
|
TTPs/Persistence/Persistence:IAMUser-NetworkPermissions |
|
|
TTPs/Persistence/Persistence:IAMUser-ResourcePermissions |
|
|
TTPs/Persistence/Persistence:IAMUser-UserPermissions |
|
|
TTPs/Policy:IAMUser-RootCredentialUsage |
|
|
TTPs/Policy:S3-AccountBlockPublicAccessDisabled |
|
|
TTPs/Policy:S3-BucketAnonymousAccessGranted |
|
|
Effects/Data Exposure/Policy:S3-BucketBlockPublicAccessDisabled |
|
|
TTPs/Policy:S3-BucketPublicAccessGranted |
|
| TTPs/Privilege Escalation/IAMUser-AnomalousBehavior | |
|
TTPs/Privilege Escalation/PrivilegeEscalation:IAMUser-AdministrativePermissions |
|
PrivilegeEscalation:Kubernetes/AnomalousBehavior.RoleBindingCreated |
TTPs/AnomalousBehavior/PriviledgeEscalation:Kubernetes-RoleBindingCreated |
PriviledgeEscalation:Kubernetes/AnomalousBehavior.RoleCreated |
TTPs/AnomalousBehavior/PriviledgeEscalation:Kubernetes-RoleCreated |
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-ContainerMountsHostDirectory |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-CGroupsReleaseAgentModified |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-DockerSocketAccessed |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-RuncContainerEscape |
|
|
TTPs/Privilege Escalation/PrivilegeEscalation:Runtime-UserfaultfdUsage |
|
|
TTPs/Discovery/Recon:EC2-PortProbeEMRUnprotectedPort |
|
|
TTPs/Discovery/Recon:EC2-PortProbeUnprotectedPort |
|
|
TTPs/Discovery/Recon:EC2-Portscan |
|
|
TTPs/Discovery/Recon:IAMUser-MaliciousIPCaller |
|
|
TTPs/Discovery/Recon:IAMUser-MaliciousIPCaller.Custom |
|
|
TTPs/Discovery/Recon:IAMUser-NetworkPermissions |
|
|
TTPs/Discovery/Recon:IAMUser-ResourcePermissions |
|
|
TTPs/Discovery/Recon:IAMUser-TorIPCaller |
|
|
TTPs/Discovery/Recon:IAMUser-UserPermissions |
|
|
Unusual Behaviors/User/ResourceConsumption:IAMUser-ComputeResources |
|
|
TTPs/Defense Evasion/Stealth:IAMUser-CloudTrailLoggingDisabled |
|
|
TTPs/Defense Evasion/Stealth:IAMUser-LoggingConfigurationModified |
|
|
TTPs/Defense Evasion/Stealth:IAMUser-PasswordPolicyChange |
|
|
TTPs/Defense Evasion/Stealth:S3-ServerAccessLoggingDisabled |
|
|
TTPs/Command and Control/Trojan:EC2-BlackholeTraffic |
|
|
TTPs/Command and Control/Trojan:EC2-BlackholeTraffic!DNS |
|
|
TTPs/Command and Control/Trojan:EC2-DGADomainRequest.B |
|
|
TTPs/Command and Control/Trojan:EC2-DGADomainRequest.C!DNS |
|
|
TTPs/Command and Control/Trojan:EC2-DNSDataExfiltration |
|
|
TTPs/Initial Access/Trojan:EC2-DriveBySourceTraffic!DNS |
|
|
Effects/Data Exfiltration/Trojan:EC2-DropPoint |
|
|
Effects/Data Exfiltration/Trojan:EC2-DropPoint!DNS |
|
|
TTPs/Command and Control/Trojan:EC2-PhishingDomainRequest!DNS |
|
|
TTPs/Command and Control/Trojan:Lambda-BlackholeTraffic |
|
|
Effects/Data Exfiltration/Trojan:Lambda-DropPoint |
|
|
TTPs/Command and Control/Trojan:Runtime-BlackholeTraffic |
|
|
TTPs/Command and Control/Trojan:Runtime-BlackholeTraffic!DNS |
|
|
TTPs/Command and Control/Trojan:Runtime-DGADomainRequest.C!DNS |
|
|
TTPs/Initial Access/Trojan:Runtime-DriveBySourceTraffic!DNS |
|
|
Effects/Data Exfiltration/Trojan:Runtime-DropPoint |
|
|
Effects/Data Exfiltration/Trojan:Runtime-DropPoint!DNS |
|
|
TTPs/Command and Control/Trojan:Runtime-PhishingDomainRequest!DNS |
|
|
TTPs/Command and Control/UnauthorizedAccess:EC2-MaliciousIPCaller.Custom |
|
|
TTPs/UnauthorizedAccess:EC2-MetadataDNSRebind |
|
|
TTPs/Initial Access/UnauthorizedAccess:EC2-RDPBruteForce |
|
|
TTPs/Initial Access/UnauthorizedAccess:EC2-SSHBruteForce |
|
|
Effects/Resource Consumption/UnauthorizedAccess:EC2-TorClient |
|
|
Effects/Resource Consumption/UnauthorizedAccess:EC2-TorRelay |
|
|
Unusual Behaviors/User/UnauthorizedAccess:IAMUser-ConsoleLogin |
|
|
TTPs/UnauthorizedAccess:IAMUser-ConsoleLoginSuccess.B |
|
|
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS |
Effects/Data Exfiltration/UnauthorizedAccess:IAMUser-InstanceCredentialExfiltration.InsideAWS |
|
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS |
Effects/Data Exfiltration/UnauthorizedAccess:IAMUser-InstanceCredentialExfiltration.OutsideAWS |
|
TTPs/UnauthorizedAccess:IAMUser-MaliciousIPCaller |
|
|
TTPs/UnauthorizedAccess:IAMUser-MaliciousIPCaller.Custom |
|
|
TTPs/Command and Control/UnauthorizedAccess:IAMUser-TorIPCaller |
|
|
TTPs/Command and Control/UnauthorizedAccess:Lambda-MaliciousIPCaller.Custom |
|
|
Effects/Resource Consumption/UnauthorizedAccess:Lambda-TorClient |
|
|
Effects/Resource Consumption/UnauthorizedAccess:Lambda-TorRelay |
|
|
TTPs/UnauthorizedAccess:Runtime-MetadataDNSRebind |
|
|
Effects/Resource Consumption/UnauthorizedAccess:Runtime-TorRelay |
|
|
Effects/Resource Consumption/UnauthorizedAccess:Runtime-TorClient |
|
|
TTPs/UnauthorizedAccess:S3-MaliciousIPCaller.Custom |
|
|
TTPs/UnauthorizedAccess:S3-TorIPCaller |
Temuan standar dari GuardDuty
GuardDuty mengirimkan temuan ke Security Hub menggunakan AWS Security Finding Format (ASFF).
Berikut adalah contoh temuan khas dari GuardDuty.
{ "SchemaVersion": "2018-10-08", "Id": "arn:aws::guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64/finding/46ba0ac2845071e23ccdeb2ae03bfdea", "ProductArn": "arn:aws::securityhub:us-east-1:product/aws/guardduty", "GeneratorId": "arn:aws::guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64", "AwsAccountId": "193043430472", "Types": [ "TTPs/Initial Access/UnauthorizedAccess:EC2-SSHBruteForce" ], "FirstObservedAt": "2020-08-22T09:15:57Z", "LastObservedAt": "2020-09-30T11:56:49Z", "CreatedAt": "2020-08-22T09:34:34.146Z", "UpdatedAt": "2020-09-30T12:14:00.206Z", "Severity": { "Product": 2, "Label": "MEDIUM", "Normalized": 40 }, "Title": "199.241.229.197 is performing SSH brute force attacks against i-0c10c2c7863d1a356.", "Description": "199.241.229.197 is performing SSH brute force attacks against i-0c10c2c7863d1a356. Brute force attacks are used to gain unauthorized access to your instance by guessing the SSH password.", "SourceUrl": "https://us-east-1.console.aws.amazon.com/guardduty/home?region=us-east-1#/findings?macros=current&fId=46ba0ac2845071e23ccdeb2ae03bfdea", "ProductFields": { "aws/guardduty/service/action/networkConnectionAction/remotePortDetails/portName": "Unknown", "aws/guardduty/service/archived": "false", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/asnOrg": "CENTURYLINK-US-LEGACY-QWEST", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/geoLocation/lat": "42.5122", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/ipAddressV4": "199.241.229.197", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/geoLocation/lon": "-90.7384", "aws/guardduty/service/action/networkConnectionAction/blocked": "false", "aws/guardduty/service/action/networkConnectionAction/remotePortDetails/port": "46717", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/country/countryName": "United States", "aws/guardduty/service/serviceName": "guardduty", "aws/guardduty/service/evidence": "", "aws/guardduty/service/action/networkConnectionAction/localIpDetails/ipAddressV4": "172.31.43.6", "aws/guardduty/service/detectorId": "d4b040365221be2b54a6264dc9a4bc64", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/org": "CenturyLink", "aws/guardduty/service/action/networkConnectionAction/connectionDirection": "INBOUND", "aws/guardduty/service/eventFirstSeen": "2020-08-22T09:15:57Z", "aws/guardduty/service/eventLastSeen": "2020-09-30T11:56:49Z", "aws/guardduty/service/action/networkConnectionAction/localPortDetails/portName": "SSH", "aws/guardduty/service/action/actionType": "NETWORK_CONNECTION", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/city/cityName": "Dubuque", "aws/guardduty/service/additionalInfo": "", "aws/guardduty/service/resourceRole": "TARGET", "aws/guardduty/service/action/networkConnectionAction/localPortDetails/port": "22", "aws/guardduty/service/action/networkConnectionAction/protocol": "TCP", "aws/guardduty/service/count": "74", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/asn": "209", "aws/guardduty/service/action/networkConnectionAction/remoteIpDetails/organization/isp": "CenturyLink", "aws/securityhub/FindingId": "arn:aws::securityhub:us-east-1::product/aws/guardduty/arn:aws::guardduty:us-east-1:193043430472:detector/d4b040365221be2b54a6264dc9a4bc64/finding/46ba0ac2845071e23ccdeb2ae03bfdea", "aws/securityhub/ProductName": "GuardDuty", "aws/securityhub/CompanyName": "Amazon" }, "Resources": [ { "Type": "AwsEc2Instance", "Id": "arn:aws::ec2:us-east-1:193043430472:instance/i-0c10c2c7863d1a356", "Partition": "aws", "Region": "us-east-1", "Tags": { "Name": "kubectl" }, "Details": { "AwsEc2Instance": { "Type": "t2.micro", "ImageId": "ami-02354e95b39ca8dec", "IpV4Addresses": [ "18.234.130.16", "172.31.43.6" ], "VpcId": "vpc-a0c2d7c7", "SubnetId": "subnet-4975b475", "LaunchedAt": "2020-08-03T23:21:57Z" } } } ], "WorkflowState": "NEW", "Workflow": { "Status": "NEW" }, "RecordState": "ACTIVE" }
Mengaktifkan dan mengonfigurasi integrasi
Untuk menggunakan integrasi dengan AWS Security Hub, Anda harus mengaktifkan Security Hub. Untuk informasi tentang cara mengaktifkan Security Hub, lihat Menyiapkan Security Hub di Panduan Pengguna AWS Security Hub .
Saat Anda mengaktifkan keduanya GuardDuty dan Security Hub, integrasi diaktifkan secara otomatis. GuardDutysegera mulai mengirim temuan ke Security Hub.
Menghentikan publikasi temuan ke Security Hub
Untuk berhenti mengirim temuan ke Security Hub, Anda dapat menggunakan konsol Security Hub atau API.
Lihat Menonaktifkan dan mengaktifkan alur temuan dari integrasi (konsol) atau Menonaktifkan alur temuan dari integrasi (Security Hub API, AWS CLI) di Panduan Pengguna.AWS Security Hub
