Configure AWS Security Hub for Arctic Wolf monitoring

You can configure Amazon Web Services (AWS)® Security Hub to collect security data from all of your AWS accounts and services to help you analyze your security trends and identify the highest priority security issues.

In addition to generating control findings, configuring Security Hub also allows Arctic Wolf® to collect findings from Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS IAM Access Analyzer, and AWS Firewall Manager.

These resources are required:

These actions are required:

Notify your Concierge Security® Team (CST) that you have enabled the AWS Security Hub integration.

Create the base stack

Note: If the AWS CloudTrail stack exists on this account already, you do not need to create the base stack.
  1. Complete Configure CloudTrail monitoring with no existing trails.
  2. When the stack has a status of CREATE_COMPLETE, search for and click CloudTrail.
  3. Select the newly created trail, and then delete it.

Configure AWS Security Hub

  1. Sign in to the AWS Management Console.
  2. Click Services > CloudFormation.
  3. Click Create Stack > With new resources (standard).
  4. On the Create stack page, click Template is ready, and then click Upload a template file.
  5. In the Upload a template file section, select the template that you downloaded and extracted in the prerequisites.
  6. Click Next.
  7. In the Stack name field, enter a unique name. For example, AWNSecurityHub.
  8. Click Next > Next.
  9. Read the information about changes caused by configuring the stack, and then select the Capabilities checkbox to acknowledge the changes.
  10. Click Submit.

    CloudFormation provides a preview of stack changes, which are prefixed with the Stack name property. This process usually takes 5-10 minutes to complete.

  11. Wait until the base stack and all nested stacks have a status of CREATE_COMPLETE before proceeding to the next step, to make sure that the CloudFormation stacks were successfully created.
  12. Contact your CST to verify that Arctic Wolf is processing logs from your S3 bucket.