Reviewing finding details and finding history in Security Hub

From this menu, you can review the complete JSON of a finding or add notes. A finding can have no more than one note attached to it at a time. This menu also provides options to set the workflow status of a finding or send a finding to a custom action in Amazon EventBridge.

From this menu, you can investigate a finding in Amazon Detective. Detective extracts entities, such as IP addresses and AWS users, from a finding and visualizes their activity. You can use the entity activity as a starting point to investigate the cause and impact of a finding.

This tab provides a summary of the finding. For example, you can see when the finding was created and last updated, in which account it exists, and the source of the finding. For control findings, you can also see the name of the associated AWS Config rule and a link to remediation instructions in the Security Hub documentation.

On the Resources snapshot within the Overview tab, you can get a brief overview of the resources involved in a finding. For some resources, we include an option to Open resource and directly view an impacted resource in the relevant AWS service console. The History snapshot shows up to two changes made to the finding on the most recent date for which history is being tracked. The date must fall within the last 90 days. As an example, if you made one change yesterday and one today, the snapshot shows only today's change. To view earlier entries, switch to the History tab.

The Compliance row expands to show more details. For example, for controls that include parameters, you can see the current parameter values that Security Hub uses when conducting security checks.

This tab provides details about the resources involved in a finding. If you're signed in to the account that owns a resource, you can view the resource in the relevant AWS service console. If you're not the owner of a resource, the console displays the AWS account ID of the owner.

The Details row shows resource-specific details about the finding by displaying the ResourceDetails section of the finding JSON.

The Tags row shows tag key and value information for the resources involved in a finding. Resources that are supported by the GetResources operation of the AWS Resource Groups Tagging API can be tagged. Security Hub calls this operation through the service-linked role when processing new or updated findings and retrieves the resource tags if the AWS Security Finding Format (ASFF) Resource.Id field is populated with the AWS resource ARN. Security Hub ignores invalid resource IDs. For more information about the inclusion of resource tags in findings, see Tags.

This tab tracks the history of a finding in the last 90 days. Finding history is available for active and archived findings. It provides an immutable trail of changes made to a finding over time, including what AWS Security Finding Format (ASFF) field changed, when the change occurred, and by which user. More recent changes are displayed first. If you're signed in to a Security Hub administrator account, the finding history shown is for the administrator account and all member accounts.

Finding history includes changes that a user made manually or automatically through Security Hub automation rules. However, finding history doesn't include changes to top-level timestamp fields, such as CreatedAt and UpdatedAt.

This tab includes data from the Action, Malware, and ProcessDetails objects of the ASFF, including the type of threat and whether a resource is the target or actor. This object typically applies to findings that originate in Amazon GuardDuty.

This tab displays data from the Vulnerability object of the ASFF, including whether there are exploits or available fixes associated with a finding. This object typically applies to findings that originate in Amazon Inspector.