Skip to content

API for AWS SecurityHub

ABAP Package /AWS1/API_SHB_IMPL
ABAP SDK "TLA" SHB
ABAP Interface /AWS1/IF_SHB

The "TLA" is a Three Letter Abbreviation that appears in ABAP class names, data dictionary objects and other ABAP objects throughout the AWS SDK for SAP ABAP. The TLA for AWS SecurityHub is SHB. This TLA helps squeeze ABAP objects into the 30-character length limit of the ABAP data dictionary.

Installation

To install the AWS SDK for SAP ABAP, import the Core transport, along with the transport for the SecurityHub module and other API modules you are interested in. A few modules are included in the Core transport itself. For more information, see the Developer Guide guide.

About The Service

Security Hub provides you with a comprehensive view of your security state in Amazon Web Services and helps you assess your Amazon Web Services environment against security industry standards and best practices.

Security Hub collects security data across Amazon Web Services accounts, Amazon Web Services services, and supported third-party products and helps you analyze your security trends and identify the highest priority security issues.

To help you manage the security state of your organization, Security Hub supports multiple security standards. These include the Amazon Web Services Foundational Security Best Practices (FSBP) standard developed by Amazon Web Services, and external compliance frameworks such as the Center for Internet Security (CIS), the Payment Card Industry Data Security Standard (PCI DSS), and the National Institute of Standards and Technology (NIST). Each standard includes several security controls, each of which represents a security best practice. Security Hub runs checks against security controls and generates control findings to help you assess your compliance against security best practices.

In addition to generating control findings, Security Hub also receives findings from other Amazon Web Services services, such as Amazon GuardDuty and Amazon Inspector, and supported third-party products. This gives you a single pane of glass into a variety of security-related issues. You can also send Security Hub findings to other Amazon Web Services services and supported third-party products.

Security Hub offers automation features that help you triage and remediate security issues. For example, you can use automation rules to automatically update critical findings when a security check fails. You can also leverage the integration with Amazon EventBridge to trigger automatic responses to specific findings.

This guide, the Security Hub API Reference, provides information about the Security Hub API. This includes supported resources, HTTP methods, parameters, and schemas. If you're new to Security Hub, you might find it helpful to also review the Security Hub User Guide . The user guide explains key concepts and provides procedures that demonstrate how to use Security Hub features. It also provides information about topics such as integrating Security Hub with other Amazon Web Services services.

In addition to interacting with Security Hub by making calls to the Security Hub API, you can use a current version of an Amazon Web Services command line tool or SDK. Amazon Web Services provides tools and SDKs that consist of libraries and sample code for various languages and platforms, such as PowerShell, Java, Go, Python, C++, and .NET. These tools and SDKs provide convenient, programmatic access to Security Hub and other Amazon Web Services services . They also handle tasks such as signing requests, managing errors, and retrying requests automatically. For information about installing and using the Amazon Web Services tools and SDKs, see Tools to Build on Amazon Web Services.

With the exception of operations that are related to central configuration, Security Hub API requests are executed only in the Amazon Web Services Region that is currently active or in the specific Amazon Web Services Region that you specify in your request. Any configuration or settings change that results from the operation is applied only to that Region. To make the same change in other Regions, call the same API operation in each Region in which you want to apply the change. When you use central configuration, API requests for enabling Security Hub, standards, and controls are executed in the home Region and all linked Regions. For a list of central configuration operations, see the Central configuration terms and concepts section of the Security Hub User Guide.

The following throttling limits apply to Security Hub API operations.

  • BatchEnableStandards - RateLimit of 1 request per second. BurstLimit of 1 request per second.

  • GetFindings - RateLimit of 3 requests per second. BurstLimit of 6 requests per second.

  • BatchImportFindings - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.

  • BatchUpdateFindings - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.

  • UpdateStandardsControl - RateLimit of 1 request per second. BurstLimit of 5 requests per second.

  • All other operations - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.

Using the SDK

In your code, create a client using the SDK module for AWS SecurityHub, which is created with factory method /AWS1/CL_SHB_FACTORY=>create(). In this example we will assume you have configured an SDK profile in transaction /AWS1/IMG called ZFINANCE.

DATA(go_session)   = /aws1/cl_rt_session_aws=>create( 'ZFINANCE' ).
DATA(go_shb)       = /aws1/cl_shb_factory=>create( go_session ).

Your variable go_shb is an instance of /AWS1/IF_SHB, and all of the operations in the AWS SecurityHub service are accessed by calling methods in /AWS1/IF_SHB.

API Operations

For an overview of ABAP method calls corresponding to API operations in AWS SecurityHub, see the Operation List.

Factory Method

/AWS1/CL_SHB_FACTORY=>create( )

Creates an object of type /AWS1/IF_SHB.

IMPORTING

Optional arguments:

IV_PROTOCOL TYPE /AWS1/RT_PROTOCOL /AWS1/RT_PROTOCOL

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

IO_SESSION TYPE REF TO /AWS1/CL_RT_SESSION_BASE /AWS1/CL_RT_SESSION_BASE

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

IV_REGION TYPE /AWS1/RT_REGION_ID /AWS1/RT_REGION_ID

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

IV_CUSTOM_ENDPOINT TYPE /AWS1/RT_ENDPOINT /AWS1/RT_ENDPOINT

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

RETURNING

OO_CLIENT TYPE REF TO /AWS1/IF_SHB /AWS1/IF_SHB

/AWS1/IF_SHB represents the ABAP client for the SecurityHub service, representing each operation as a method call. For more information see the API Page page.

Configuring Programmatically

DATA(lo_config) = DATA(go_shb)->get_config( ).

lo_config is a variable of type /AWS1/CL_SHB_CONFIG. See the documentation for /AWS1/CL_SHB_CONFIG for details on the settings that can be configured.

Paginators

Paginators for AWS SecurityHub can be created via `get_paginator()` which returns a paginator object of type [`/AWS1/IF_SHB_PAGINATOR`](./_AWS1_IF_SHB_PAGINATOR.md). The operation method that is being paginated is called using the paginator object, which accepts any necessary parameters to provide to the underlying API operation. This returns an iterator object which can be used to iterate over paginated results using `has_next()` and `get_next()` methods.

Details about the paginator methods available for service AWS SecurityHub can be found in interface [`/AWS1/IF_SHB_PAGINATOR`](./_AWS1_IF_SHB_PAGINATOR.md).