Skip to content
English
Contact Us →
  • There are no suggestions because the search field is empty.

AWS Security Hub Connector

Set up the AWS Security Hub connector to pull NIST 800-53 Revision 5 compliance data into CyberHQ, from IAM configuration through to the required HTTP nodes

This guide covers setting up the AWS Security Hub connector to bring NIST 800-53 compliance data into CyberHQ as capability data.

Initial configuration in AWS

Enable Security Hub and activate the NIST Special Publication 800-53 Revision 5 security standard. Note that it may take one to two days for the data to process. Create a new IAM user, grant it AWSSecurityHubReadOnlyAccess permissions, and enable programmatic access to obtain an access key and secret key. Save these keys somewhere secure.

First HTTP node (get enabled standards)

In CyberHQ Connect, create a new automation and add an HTTP node:

  • Select POST as the request type.
  • Enter the URL: https://securityhub.ap-southeast-2.amazonaws.com/standards/get
  • Enable Advanced Authorization and select AWS Signing, then enter your AWS Access Key and Secret Key.
  • Click Autogenerate AWS Parameters from URL.
  1. Test the node, then open View Data Flow, select Output, and Export. In the exported JSON, copy the NIST 800-53 StandardsSubscriptionArn (for example, arn:aws:securityhub:ap-southeast-2:123456789:subscription/nist-800-53/v/5.0.0).

Second HTTP node (get controls)

In a new automation, create an HTTP node:

  • Select GET as the request type.
  • Enter the URL using the StandardsSubscriptionArn you copied, for example: https://securityhub.ap-southeast-2.amazonaws.com/standards/controls/arn:aws:securityhub:ap-southeast-2:123456789:subscription/nist-800-53/v/5.0.0
  • Enable Advanced Authorization, select AWS Signing, enter your keys, and click Autogenerate AWS Parameters from URL.

How the data is used

The connector brings Security Hub data in as JSON and converts it for CyberHQ, translating the NIST 800-53 R5 mapping numbers into the format CyberHQ's capability assessment expects and converting whether a control is enabled into 100% or 0%. All control frameworks can be mapped objectively, while NIST 800-53 can be mapped objectively or subjectively, as it forms part of the Master Control Framework.

Reference documents