AWS Security Hub OCSF Plugin for Risk Exchange

This document explains how to configure the AWS Security Hub OCSF v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin is used to fetch Workloads from the AWS Security Hub > Findings for EC2 instance resources of Commercial Cloud. This plugin does not support performing any actions on the Security Hub.

Prerequisites

To complete this integration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Connectivity to the Amazon AWS Security hub.

AWS Security Hub Plugin Support 

The plugin fetches workload records of type aws-ec2-instances from the findings available in AWS Security Hub.

Mappings

Mappings are used to view the pulled Workloads along with their respective details. Fields mapped during plugin configuration are visible on the Records page when the data is pulled. Here are the suggested mapping to use while configuring the plugin.

Workload Mappings

Permissions 

AWS Security Hub permissions to the IAM user to pull Workloads information is GetFindings.

securityhub_client = boto3.client(
                "securityhub",
                aws_access_key_id=self.aws_public_key,
                aws_secret_access_key=self.aws_private_key,
                aws_session_token=self.aws_session_token,
                region_name=self.configuration["region_name"].strip(),
                config=Config(
                    proxies=self.proxy,
                    user_agent=self.useragent,
                    retries={
                        "total_max_attempts": 3,
                        "mode": standard
                    }
                ),
            )

{
    "Filters": {
        "CompositeFilters": [
            {
                "StringFilters": [
                    {
                        "FieldName": "resources.type",
                        "Filter": {
                            "Value": "AWS::EC2::Instance",
                            "Comparison": "EQUALS",
                        },
                    }
                ],
                "DateFilters": [
                    {
                        "FieldName": "finding_info.modified_time_dt",
                        "Filter": {
                            "Start": start_time,
                            "End": end_time,
                        }
                    }
                ]
            },
        ]
    },
    "SortCriteria": [
        {
            "Field": "finding_info.modified_time_dt",
            "SortOrder": "desc",
        }
    ],
    "MaxResults": 100,
}

response = securityhub_client.get_findings_v2(**params)

Performance Matrix

Here is the performance matrix conducted on a Large CE Stack with these specifications by pulling 500k devices.

User Agent

APN/1.1 (ahq9d89xj9gspapczzdb59goq)

Workflow

1. Generate credentials for AWS Security Hub authentication methods.
2. Configuring the AWS Security Hub OCSF plugin.
3. Add a Business Rule.
4. Add an Action.
5. Validate the AWS Security Hub plugin.

Watch a Video

Click play to watch a video:

Create an AWS Security Hub Policy

1. Search for IAM in the search box, and in the left panel click Policies.

   

2. Click Create Policy.

   

3. Click on the JSON tab, and enter this policy. Click Next: Tags, and then click Next: Review.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "Statement1",
         "Effect": "Allow",
         "Action": [
           "securityhub:GetFindings"
         ],
         "Resource": "*"
       }
     ]
   }

4. Enter a Name and click Create Policy.

   

5. Attach this policy to the user. Go to IAM > Users. Select the user for which you want to attach a policy, and click Add permissions, and then click Add permissions options.
6. Select the Attach policies directly option under Permissions, and then search and select the policy you created in the previous step for the source queue.

   

7. Click Next, and then click Add permissions. The policy will be attached to the user.

Plugin Authentication Methods

IAM Role Anywhere Configuration 

Prerequisites

The AWS Certificate Manager service is required to be enabled to authenticate the plugin using the AWS IAM Roles Anywhere Authentication Method.

Note to sure you create the Private Certificate Authority, Trust Anchor and Profile in the same region in which your AWS SQS Queue resides.

Create a Policy

This Policy contains the required permissions for creating Private CA Certificate (including Permissions for creating a Trust Anchor and Profile) and using the IAM Roles Anywhere.

1. Go to Policy Generator and select IAM Policy as policy type, enter Add Statement details, and generate a policy.
   • Select Type of Policy: IAM Policy
   • Effect: Allow
   • AWS Service: AWS Private Certificate Authority
   • Actions:
     • CreateCertificateAuthority
     • DescribeCertificateAuthority
     • GetCertificate
     • GetCertificateAuthorityCertificate
     • GetCertificateAuthorityCsr
     • ImportCertificateAuthorityCertificate
     • IssueCertificate
     • ListCertificateAuthorities
   • ARN: *
2. Click Add Statement.
   
3. Scroll back up to add another statement.
   • Select Type of Policy: IAM Policy
   • Effect: Allow
   • AWS Service: AWS Identity and Access Management (IAM)
   • Actions:
     • AttachRolePolicy
     • CreateAccessKey
     • CreateRole
     • DeleteRole
     • PassRole
   • ARN: *
4. Click Add Statement.
   
5. Scroll back up to add another statement.
   • Select Type of Policy: IAM Policy
   • Effect: Allow
   • AWS Service: AWS Certificate Manager
   • Actions:
     • DescribeCertificate
     • ExportCertificate
     • GetCertificate
     • ListCertificates
     • ListTagsForCertificate
     • RequestCertificate
   • ARN: *
6. Click Add Statement.
   
7. Scroll back up to add another statement.
   • Select Type of Policy: IAM Policy
   • Effect: Allow
   • AWS Service: AWS Identity and Access Management Roles Anywhere
   • Actions:
     • CreateProfile
     • CreateTrustAnchor
     • GetProfile
     • GetTrustAnchor
     • ListProfiles
     • ListTrustAnchors
   • ARN: *
8. Click Add Statement.
   
9. Click Generate Policy.
   
10. Copy the Policy as it will be used in the next step for creating the policy required for creating the Private CA certificates.
11. Go to AWS Console and select IAM from All Services. Click Policies in the left panel, and then click Create Policy.
    
12. Copy the policy to the JSON tab, click Next:Tags, and then click Next:Review
    .
    
13. Enter a name (like netskope-ce-rolesAnywhere-policy) and click Save Changes.
    

Create a Private Certificate Authority

1. Log in to AWS Console.
2. Search for Certificate Manager.
   
3. Click AWS Private CA.
4. Click Create a private CA.
   
5. For Mode Options, select General-purpose.
6. For CA type options, select Root.
   
7. Enter the Organization (O).
   
8. For Key algorithm options, select RSA 2048.
   
9. Add tagsif any (optional).
10. Check the checkbox in the CA permissions options section.
11. Check the checkbox in the Pricing section.
12. Click Create to create the CA certificate.
    
13. From Actions,select Install CA Certificate.
    
14. Click Confirm and Install.
    

Create a Trust Anchor

1. Search for the IAM service, go to Roles under Access management scroll down to Roles Anywhere and select Manage.
   
2. Click Create a Trust anchor.
   
3. Enter a Trust anchor name.
   
4. Select AWS Certificate Manager Private CA (created in the previous steps) as a Certificate authority (CA) source. Select the Certificate that was created in the previous step in AWS Private Certificate Authority.
5. Add tags if required.
6. Click Create a trust anchor.
   
   
7. Click on the created Trust Anchor and copy the Trust Anchor ARN. This will be required in the Plugin configuration Trust Anchor ARN parameter for the authentication method AWS IAM Roles Anywhere.
   

Create an IAM Role

1. Go to IAM services in the AWS Console.
2. Click Role in the Access Management submenu.
3. Click Create Role.
   
4. In the Trusted entity type, select Custom Trust Policy.
   
5. Replace the Custom trust Policy with this Trust Policy. This policy contains the permissions for using the roles anywhere service:{ “Version”: “2012-10-17”, “Statement”: [ { “Effect”: “Allow”, “Principal”: { “Service”: [ “rolesanywhere.amazonaws.com” ] }, “Action”: [ “sts:AssumeRole”, “sts:TagSession”, “sts:SetSourceIdentity” ] } ] }
6. Click Next.
7. In the Permissions policies, select the policy created in Create an AWS Security Hub Policy.
   
8. Click Next.
9. Provide a Role name (like netskope-ce-aws-verified-access-role) and Description for the role.
   
10. Click Create role. Search for the created role and click on the Role Name. 
    
11. Make a note of the Role ARN. This will be required in the Plugin configuration Role ARN parameter for the authentication method AWS IAM Roles Anywhere.
    

Create a Profile

1. Select Roles under Access management.
2. Scroll down to Roles Anywhere and click Manage.
   
3. Expand the Setup steps.
4. Click Step 2: Configure roles.
5. Click Configure a profile.
   
6. Enter a Profile Name.
7. Select the role created in the Create IAM Role section.
   
8. Remove the Inline Policy.
   
9. Click Create a profile.
   
10. Select the created Profile and copy the Profile ARN.
    

Request a Private Certificate

1. Go to AWS Certificate Manager > Request certificate.
2. Select Request a private certificate.
   
3. Click Next.
4. Select the Certificate authority created in the previous step.
   
5. Provide a domain name in the Fully qualified domain name field, like netskope-ce-verified-access.com.
6. Select RSA 2048 as the Key algorithm.
   
7. Add tags if required.
8. Acknowledge the Certificate renewal permissions.
9. Click Request.
   
10. Go to List certificates from the navigation pane of AWS Certificate Manager.
11. Select the certificate created previously.
    
12. Click Export.
    
13. Enter a passphrase. Make a note of the passphrase as it will be required for the Configuration of the AWS Security Lake Plugin using the AWS IAM Roles Anywhere Authentication method.
14. Click Generate PEM Encoding.
    
15. Download all theCertificatesas it won’t be visible again. For new certificates, you will need to Export them again.
    

The Certificate body, Certificate Private Key will be required for the Configuration of the AWS Verified Access Plugin using the AWS IAM Roles Anywhere authentication method. For more info, go to AWS IAM Role Anywhere.

Deployed on AWS Configuration Manual

Create a Role

1. Go to IAM services in the AWS Console.
2. Click Create role.
   
3. Select the AWS Service.
4. Under Use case, select EC2.
5. Click Next.
   
6. Select the permission policy created in Create an AWS Security Hub policy.
   
7. Click Next.
   
8. Enter a Role Name and Description.
   
9. Click Create Role.
   

Assign a Role to an EC2 Instance

1. Log in to your EC2 instance console.
2. Click Instances under Instances.
   
3. Go to Action > Security > Modify IAM Role.
   
4. Select the Role that you created above in Create a Role. (netskope-ce-instance-role).
5. Click Add IAM Role or Modify IAM Role.
   

Configure the AWS Security Hub Plugin

1. In Cloud Exchange, go to Settings > Plugins. Search for and select the AWS Security Hub OCSF v1.0.0 (CRE) plugin box.
   
2. Enter a configuration name and change sync interval.
   

2. Enter the configuration parameters: >
   • Authentication Method: Select the method to be used for authentication (Deployed on AWS/AWS IAM Roles Anywhere)
   • Private Key: Private Key for decrypting the AWS Private CA Certificate. Required for ‘AWS IAM Roles Anywhere’ authentication type.
   • Certificate Body: Certificate Body for AWS Public/Private CA Certificate. Required for ‘AWS IAM Roles Anywhere’ authentication type.
   • Password Phrase: Password Phrase for decrypting the CA Certificate. Required for ‘AWS IAM Roles Anywhere’ authentication type.
   • Profile ARN: AWS Profile ARN for AWS client authentication. Required for ‘AWS IAM Roles Anywhere’ authentication type.
   • Role ARN: AWS Role ARN for AWS client authentication. Required for ‘AWS IAM Roles Anywhere’ authentication type.
   • Trust Anchor ARN: AWS Trust Anchor ARN for AWS client authentication. Required for ‘AWS IAM Roles Anywhere’ authentication type.
   • AWS Region Name: AWS Region Name. Make sure that the region name matches the region in the Profile ARN and Trust Anchor ARN.
   • Initial Range: Number of days to pull the data for the initial run.

3. Click Next. Select the Entity from the Entity dropdown. The Entity fields can be created from the Schema Editor page or using the + Add Field option from the field dropdown. Provide the field mappings. For the suggested mappings, refer to the section ‘Mapping’.
   

4. Click Save.
   

   Note:

   The Finding ID, Resource ID, and IPv4 address, fields will be required to pull the Users and instance id is required to pull applications.

Add a Risk Exchange Business Rule for the AWS Security Hub Plugin

1. Go to Risk Exchange > Business Rules.
2. Click Create New Rule in the top right corner.
3. Enter a Rule Name. Select the Entity for which Fields have been configured for the AWS Security Hub OCSF plugin, and configure the query based on your requirements. The below example filters the data fetched from the plugin.
   
4. Click Save.

Add Risk Exchange Actions for the AWS Security Hub Plugin

The AWS Security Hub OCSF supports the following action type:

No Action

No action will be performed for this action. You can generate UBA alerts in Ticket Orchestrator by using this action, and enabling the Generate Alert toggle.

Steps to configure the Action

1. Go to User Risk Exchange > Actions > Click on Add Action Configuration.
2. Select the required Business Rule, Configuration, and Action from their respective dropdown.
3. Enable the Require Approval toggle if Approval is needed before performing an action.
4. Click Save.

Validate the AWS Security Hub Plugin

Validate in Cloud Exchange

To validate the pulling of devices in Cloud Exchange from the AWS Security Hub OCSF findings, go to Logging and search for message Like “CRE AWS Security Hub OCSF [CRE AWS Security Hub] OCSF” .

To validate the stored records in Cloud Exchange, go to Risk Exchange > Records. Select the entity that you used while adding the mapping in the plugin configuration, and check the records.

Validate in AWS Security Hub

In AWS, the plugin pulls AwsEc2Instance details from AWS Security Hub > Findings.

Troubleshooting AWS Security Hub Plugin

Unable to pull Workloads or the field values from the plugin

If you are not able to pull Workloads from the AWS Security Hub Findings, it could be due to there being no data available to pull, it could be possible due to:

• No data available for pulling.
• No fields are mapped.

What to do:

1. Go to AWS Security Hub > Findings. Check if the findings are available to pull for the same time range as provided in the plugin configuration.
2. If the findings are available and still not pulled, check the Resource value for those findings. Only findings with the EC2 Instance or AwsEc2Instance Resource type are pulled.
3. If the Findings are available, make sure the fields are mapped in the plugin.

Note that if the plugin is updated to fetch additional fields, the existing records on the Records page won’t contain values for those new fields. The new fields will only be populated if the existing finding’s modified_time_dt field is updated; otherwise, only newly generated findings will include all fields.

Facing issues while configuring the new plugin

If you’re creating a new plugin with AWS IAM Roles Anywhere and face below error while configuring the plugin:

What to do:
This error could possibly mean that one of the Trust Anchor ARN, Role ARN, or Profile ARN has a different account ID, so you need to check that the provided parameters are generated from the same account, and have the same region.