Integrating AWS Security Hub in ServiceNow

To configure AWS Security Hub integration features

1. Enable AWS Security Hub. For more information, see Setting up AWS Security Hub with the Console.

2. Set up an SQS queue to receive updated Findings. Name the queue, AwsServiceManagementConnectorForSecurityHubQueue, to align with the default name in the ServiceNow System Properties for the AWS Security Hub integration. For more information, see Getting started with Amazon SQS.

3. Set up an Amazon EventBridge rule to detect changes to Findings and push these to the queue. For more information, see Getting started with Amazon EventBridge.

   The rule should have this event pattern and point to the SQS queue created in Step 2.

   "EventPattern": {
   
          "source": [
   
           "aws.securityhub"
   
           ]
   }         

4. You can also customize this CloudWatch Events rule to only pull in Security Hub findings that have specific finding types, severity labels, workflow statuses, or compliance statuses. For details about how to filter the event pattern, see Configuring an EventBridge rule for automatically sent findings in the AWS Security Hub User Guide.

To configure AWS Security Hub synchronization behavior to the Connector in ServiceNow

1. In the ServiceNow filter navigator in the fulfiller (stand user interface) view, enter AWS Service Management Connector.

2. Choose System Properties, then AWS Security Hub.

3. Set these configuration items:

   • Choose the types of AWS Security Hub Findings to sync in ServiceNow: CRITICAL, HIGH, MEDIUM, LOW, and INFORMATIONAL.

   • Choose an action for a newly synced Finding to the Connector in ServiceNow:

     • Do Nothing. This action only imports Security Finding types for the scoped app. Users with scoped app permissions can view and choose to create an Incident or Problem. Do Nothing is the default value in the Connector.

     • Create Incident. This action automatically creates Incidents from Security Findings and syncs updates in ServiceNow to AWS Security Hub.

     • Create Problem. This action automatically creates Incidents from Security Findings and syncs updates in ServiceNow to AWS Security Hub.

     • Create Incident and Problem. This action automatically creates Incidents and Problems from Security Findings and syncs updates in ServiceNow to AWS Security Hub.

   • Adjust the maximum number of messages to fetch from the SQS queue per sync, account, or Region (default 50). By default, the sync process runs every five minutes.

   • Change the SQS Queue name if you’re not using the default that the Connector created. The CloudFormation template supplies the Connector.

     Note

     We recommend you not change the SQS name in the ServiceNow scoped app (AwsServiceManagementConnectorForSecurityHubQueue) unless you change the SQS name in the AWS account.

4. Choose Save after any changes.

   Fields synchronized from AWS Security Hub Findings to the ServiceNow scoped app AWS Security Hub Findings module in ServiceNow

To view Findings from AWS Security Hub

To view AWS Security Hub Findings, you must have the role, x_126749_aws_sc.finding_manager, from the Connector scope app.

1. Log in to your ServiceNow instance as a user (for example, System Administrator) in the fulfiller view (standard user interface view).

2. In the navigator, enter AWS Service Management.

3. Choose AWS Security Hub.

4. Choose Findings to show a list of all synced Findings.

5. Choose a Finding to open the record.

6. The Incident and Problem fields show the Incident and Problem related to the Finding if these exist.

7. Choose the ⓘ symbol to the right of the field to preview the Incident or Problem.

8. Choose Open Record on the preview form to open the Incident or Problem.

9. If the Connector does not automatically create a ServiceNow Incident or Problem when a new Finding syncs, choose the link at the bottom of the form to create one manually.