Security Hub, Detective, and Automated Response

AWS Security Hub is a centralised security management service that aggregates findings from multiple AWS services and partner products. Think of it as a single pane of glass for your security posture. When you enable Security Hub, it automatically ingests findings (potential security issues) from AWS GuardDuty (a threat detection service that monitors for malicious activity), AWS Inspector (which scans for software vulnerabilities), AWS Macie (which discovers and protects sensitive data), and AWS Firewall Manager. It can also ingest findings from third-party tools like CrowdStrike or Palo Alto Networks.

Security Hub performs three key functions: it aggregates findings, it runs automated compliance checks using standards like the AWS Foundational Security Best Practices (FSBP) or the CIS AWS Foundations Benchmark (a set of security configuration rules), and it provides a dashboard to prioritise risks. Every finding in Security Hub has a severity rating (Critical, High, Medium, Low) and a status (New, In Progress, Suppressed).

AWS Detective is a completely separate service that does not replace Security Hub; it complements it. Detective is an investigation service that collects and analyses log data from sources like AWS CloudTrail (which records API calls), VPC Flow Logs (which capture network traffic metadata), and Amazon EKS audit logs. It uses machine learning and graph theory to create interactive visualisations called 'behaviour graphs' (findings and activity).

The magic of Detective is that it automatically builds a resource map of relationships – for example, it knows that user 'John' used an IAM role to launch an EC2 instance, which then made an API call to S3. This lets security analysts click through the chain of events without manually joining log files. Detective's purpose is to reduce the time to investigate a security incident from hours to minutes.

Automated response is the final piece. AWS offers several ways to respond automatically to Security Hub findings. The most common is to use Amazon EventBridge (formerly CloudWatch Events) to trigger an AWS Lambda function (a serverless code execution service) or an AWS Step Functions workflow when a specific finding arrives. For example, you might create a rule that says: 'If Security Hub receives a Critical finding from GuardDuty that indicates a compromised EC2 instance, automatically quarantine that instance by modifying its Security Group (a virtual firewall) or by detaching it from the network.'

You can also use AWS Systems Manager Automation documents to run pre-defined response playbooks, such as taking a forensic snapshot of a disk before isolating a resource. The key exam concept is that these three services form a pipeline: Detect (Security Hub collects findings), Investigate (Detective analyses the root cause), and Respond (Automated action is taken).

Why does this exist? Without these services, a security team would have to log into each individual service to see alerts, manually gather logs from multiple systems, and then manually execute commands to block an attack. This is slow and error-prone. Security Hub, Detective, and automated response replace this manual, fragmented process with a unified, automated, and fast system.

The exam will test you on exactly which service does what: Security Hub aggregates, Detective investigates, and EventBridge/Lambda/Systems Manager provide the automated response. They also love to test the requirement that Security Hub must be enabled in every region you want to monitor, and that it needs an IAM service-linked role (a special IAM role that gives Security Hub permission to call other AWS services on your behalf) to function.

Let's walk through a realistic incident at a company called 'QuickShop', an e-commerce platform running on AWS. QuickShop has enabled Security Hub, Detective, and automated response across their entire environment.

At 3:15 PM, a security engineer named Ana receives a Slack notification from her team's incident channel. The message says: 'Critical finding in Security Hub from GuardDuty: EC2 instance compromised.' Ana opens the Security Hub dashboard and sees the finding has a severity of 'Critical' and a status of 'New.' The finding title is 'UnauthorisedAccess:EC2/SSHBruteForce.' Security Hub has already enriched this finding with details including the instance ID, the region, the source IP address of the attacker, and the time of the first event.

Ana does not touch the command line. Instead, she opens AWS Detective. The instance in question appears in Detective's resource map. She clicks on the instance and Detective shows her a timeline of every API call made from that instance in the last 24 hours. She sees that five minutes before the brute force alert, a new IAM role was attached to the instance – an anomaly. Detective shows her the exact API call made to attach the role, and which user principal (possibly a compromised IAM user) initiated it. Ana can see the actor, the action, and the target resource all in one screen.

Ana now knows the attack chain: an attacker compromised a user's access key, used it to attach a privileged role to an EC2 instance, then SSH'd into that instance.

Meanwhile, automated response has been triggered. QuickShop has configured an EventBridge rule that watches for any Security Hub finding with severity 'Critical' and title containing 'SSHBruteForce.' The rule fires a Lambda function that immediately does two things: it changes the instance's Security Group to block all incoming traffic except from a whitelisted admin IP, and it tags the instance with 'Incident: Investigation.' The instance is effectively quarantined fifteen seconds after the alert was generated.

Ana now has a contained, quarantined instance and a full investigation trail provided by Detective. She creates an AWS Systems Manager automation document to take a memory dump and a disk snapshot of the instance for forensic analysis, then submits a report to the security operations centre.

The real-world benefits are clear: the incident was contained automatically in seconds, investigation took minutes instead of hours, and the security team did not have to manually query logs from multiple services.

It is important to note that deploying this requires careful planning. The team had to: create IAM roles with least privilege for the Lambda function so it could only modify Security Groups and tag instances, write the Lambda code, test the EventBridge rule in a staging environment, and ensure Detective was enabled in all regions where QuickShop runs workloads.