• Security Hub is a central security tool with an integrated dashboard used to manage several AWS accounts and automate security checks.
• Aggregates alerts from various AWS services including:
  • Config
  • GuardDuty
  • Macie
  • Inspector
  • IAM Access Manager
• AWS Config Service must be enabled for Security Hub to work.
• EventBridge can be used to automate responses to alerts in the Security Hub.
• Security Hub generates findings and can check against security standards (ex. CIS AWS Foundations, PCI DSS).
• Findings are automatically deleted after 90 days.
• Insights are a collection of related findings that identify a security area requiring attention.

• Cross-Region Aggregation – aggregate findings from multiple regions.

More reading:

• https://docs.aws.amazon.com/securityhub/latest/userguide/what-are-securityhub-services.html