Custom insights
In addition to the AWS Security Hub managed insights, you can create custom insights in Security Hub to track issues that are specific to your environment. Custom insights provide a way to track a curated subset of issues.
Here are some examples of custom insights that may be useful to set up:
If you own an administrator account, you can set up a custom insight to track critical and high severity findings that are affecting member accounts.
If you rely on a specific integrated AWS service, you can set up a custom insight to track critical and high severity findings from that service.
If you rely on a third party integration, you can set up a custom insight to track critical and high severity findings from that integrated product.
You can create completely new custom insights, or start from an existing custom or managed insight.
Each insight is configured with the following options.
-
Grouping attribute – The grouping attribute determines which items are displayed in the insight results list. For example, if the grouping attribute is Product name, then the insight results display the number of findings that are associated with each finding provider.
-
Optional filters – The filters narrow down the matching findings for the insight.
When querying your findings, Security Hub applies Boolean AND logic to the set of filters. In other words, a finding only matches if it matches all of the provided filters. For example, if the filters are "Product name is GuardDuty" and "Resource type is
AwsS3Bucket," then matching findings must match both of these criteria.However, Security Hub applies Boolean OR logic to filters that use the same attribute but different values. For example, if the filters are "Product name is GuardDuty" and "Product name is Amazon Inspector," then a finding matches if it was generated by either GuardDuty or Amazon Inspector.
Note that if you use the resource identifier or resource type as the grouping attribute, then the insight results include all of the resources that are in the matching findings. The list is not limited to resources that match a resource type filter. For example, an insight identifies findings that are associated with S3 buckets, and groups those findings by resource identifier. A matching finding contains both an S3 bucket resource and an IAM access key resource. The insight results include both resources.
Creating a custom insight (console)
From the console, you can create a completely new insight.
To create a custom insight
Open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/
. -
In the navigation pane, choose Insights.
-
Choose Create insight.
-
To select the grouping attribute for the insight:
-
Choose the search box to display the filter options.
-
Choose Group by.
-
Select the attribute to use to group the findings that are associated with this insight.
-
Choose Apply.
-
-
(Optional) Choose any additional filters to use for this insight. For each filter, define the filter criteria, and then choose Apply.
-
Choose Create insight.
-
Enter an Insight name, then choose Create insight.
Creating a custom insight (programmatic)
Choose your preferred method, and follow the steps to programmatically create a custom insight in Security Hub. You can specify filters to narrow down the collection of findings in the insight to a specific subset.
The following tabs include instructions in a few languages for creating a custom insight. For support in additional languages, see
Tools to Build on AWS
Modifying a custom insight (console)
You can modify an existing custom insight to change the grouping value and filters. After you make the changes, you can save the updates to the original insight, or save the updated version as a new insight.
To modify an insight
Open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/
. -
In the navigation pane, choose Insights.
-
Choose the custom insight to modify.
-
Edit the insight configuration as needed.
-
To change the attribute used to group findings in the insight:
-
To remove the existing grouping, choose the X next to the Group by setting.
-
Choose the search box.
-
Select the attribute to use for grouping.
-
Choose Apply.
-
-
To remove a filter from the insight, choose the circled X next to the filter.
-
To add a filter to the insight:
-
Choose the search box.
-
Select the attribute and value to use as a filter.
-
Choose Apply.
-
-
-
When you complete the updates, choose Save insight.
-
When prompted, do one of the following:
-
To update the existing insight to reflect your changes, choose Update
<Insight_Name>and then choose Save insight. -
To create a new insight with the updates, choose Save new insight. Enter an Insight name, and then choose Save insight.
-
Modifying a custom insight (programmatic)
To modify a custom insight, choose your preferred method, and follow the instructions.
Creating a new custom insight from a managed insight (console)
You cannot save changes to or delete a managed insight. You can use a managed insight as the basis for a new custom insight.
To create a new custom insight from a managed insight
Open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/
. -
In the navigation pane, choose Insights.
-
Choose the managed insight to work from.
-
Edit the insight configuration as needed.
-
To change the attribute used to group findings in the insight:
-
To remove the existing grouping, choose the X next to the Group by setting.
-
Choose the search box.
-
Select the attribute to use for grouping.
-
Choose Apply.
-
-
To remove a filter from the insight, choose the circled X next to the filter.
-
To add a filter to the insight:
-
Choose the search box.
-
Select the attribute and value to use as a filter.
-
Choose Apply.
-
-
-
When your updates are complete, choose Create insight.
-
When prompted, enter an Insight name, and then choose Create insight.
Deleting a custom insight (console)
When you no longer want a custom insight, you can delete it. You cannot delete managed insights.
To delete a custom insight
Open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/
. -
In the navigation pane, choose Insights.
-
Locate the custom insight to delete.
-
For that insight, choose the more options icon (the three dots in the top-right corner of the card).
-
Choose Delete.
Deleting a custom insight (programmatic)
To delete a custom insight, choose your preferred method, and follow the instructions.
