--- title: "AWS Security Hub: HTTP Ingest" slug: "aws-security-hub-http" updated: 2025-11-28T14:41:10Z published: 2025-11-28T14:41:10Z canonical: "docs.databee.buzz/aws-security-hub-http" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # AWS Security Hub: HTTP Ingest AWS Security Hub centralizes and prioritizes security findings from AWS and third-party tools, providing a unified view of your security posture using compliance standards and a common format (ASFF). For detailed information refer to the [AWS Security Hub’s official documentation](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub-v2.html). **Integration** **Method**: HTTP Collector. Refer to [this article for API ingestion](/user-manual/docs/aws-security-hub) **Tables**: Data Security Finding [2006], Detection Finding [2004], Vulnerability Finding [2002], Compliance Finding [2003] This integration supports the following events. | **Event** | **Description** | | --- | --- | | Findings | Get the list of AWS Security Hub Finding Events | > [!NOTE] > **Note:** > > AWS Security Hub doesn’t follow a traditional versioning system. It is a continuously updated cloud service. ## Prerequisites - The user should have access to the AWS portal. - The user should have access to the Security Hub dashboard. - The user should have permissions to create EventBridge rules, connections, and API destinations. - The user should have access to the DataBee console. ## Configuration Overview 1. Create an [AWS Security Hub HTTP Collector data feed](/user-manual/docs/aws-security-hub-http#databee-configuration) in DataBee to receive and process Security Hub findings. 2. [Configure an EventBridge API Destination](/user-manual/docs/aws-security-hub-http#configure-an-eventbridge-api-destination) using the DataBee HTTP Collector URL and Authorization Key. 3. [Create an EventBridge Rule](/user-manual/docs/aws-security-hub-http#create-an-eventbridge-rule) forward findings from AWS Security Hub to the configured API Destination. The Event Bridge setup can be automated using Terraform scripts as described in this [section](/user-manual/docs/aws-security-hub-http#optional-eventbridge-configuration-via-terraform). ## DataBee Configuration 1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-vpz8db2x.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 2. Search for **AWS Security Hub** and click on it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-q77s60nw.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 3. Click on the **HTTP Collector** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-ayyjswq9.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-pqcz0f4m.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 5. In the configuration page, confirm the following and click **Next**. - Format: Select **JSON** data format option. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-1218k3p2.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 6. Use the **Copy to clipboard** button to copy the **Endpoint URL** and **Tenant ID** for later use, and then click **Generate New API Key**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-p558b0ui.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 7. Use the **Copy to clipboard** button to copy the **API Key** and keep it for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-a11wuz4d.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 8. Click **Submit**. 9. Go to **Data** tab > **Data Feeds** > Select the configured Data feed > Copy the **DataSource ID** for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-lkwsmz57.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) ## AWS Security Hub Configuration ### Configure an EventBridge API Destination 1. Log in to AWS using an account that has permissions to manage Amazon EventBridge and access AWS Security Hub findings. The user must have IAM permissions such as **events: *** (for creating and managing EventBridge rules) and securityhub:GetFindings (for accessing Security Hub findings) and open the **EventBridge console**. > [!NOTE] > **Note:** > > * means all permissions in that category. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-yan5eay2.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 2. In the left navigation pane, choose **Integration** > **API destinations**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-5jph8anz.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 3. Scroll down to the API destinations table and then choose **Create API destination**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-rtxynjhv.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 4. On **Create API destination**, 1. Enter a ‘Name’ for API Destination (The name must be unique to your account in the current Region) 2. In the ‘API destination endpoint’ field, paste the **HTTP URL** from [DataBee](/docs/aws-security-hub-http#creds) earlier. 3. Select the ‘HTTP method’ as **POST**. 4. In ‘Connection configuration’, select **Create a new connection**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-tjpefd89.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 5. For **Connection configuration**, 1. Provide a ‘Connection name’. 2. Under ‘Configure invocation’, keep **Public** as the ‘API Type’. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-6stttykz.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 6. Select **API Key** in the ‘Authorization type’. 1. Enter the ‘API key name’ as **Authorization**. 2. Paste the API key ‘value’ from [DataBee](/docs/aws-security-hub-http#authorization). 3. Click **Create**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-xkhmnf2q.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) ### Create an EventBridge Rule 1. Open the **Amazon EventBridge Console**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-b9v24kc6.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 2. In the navigation pane, click **Rules**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-hr8m0hrq.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 3. Click on **Create rule**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-cn66ttkk.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 4. Under **Define rule detail**, 1. Provide a rule ‘Name’. 2. Click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-n7g5sskz.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 5. Under **Build event pattern**, 1. Select **AWS events or EventBridge partner** events as an ‘Event source’. 2. Set the ‘Event source’ for **AWS services**. 3. Choose **Security Hub** as the ‘AWS service’. 4. Select **Finding Imported V2** in ‘Event type’. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-46iu5tq4.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 6. Click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-lrymwyz7.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 7. Under **Select target(s)**, 1. Choose **EventBridge API destination** as ‘Target type’. 2. Choose **Use an existing API destination** option for ‘API destination’ and select the API Destination created earlier in the API Destination section. 3. Under add ‘Header Parameters’, Add the following three header parameters: ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-rxe40yvd.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 1. Tenant ID **Key**: TenantID **Value**: Paste the Tenant ID from [DataBee](/docs/aws-security-hub-http#creds). 2. Authorization **Key**: Authorization **Value**: Paste the API Key from [DataBee](/docs/aws-security-hub-http#authorization). 3. Datasource ID **Key**: DatasourceID **Value**: Paste the Datasource ID from [DataBee](/docs/aws-security-hub-http#ds_id). 8. Click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-58abeonh.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 9. Under **Configure tags – optional**, Click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-806h3dzd.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) 10. Review all configuration details of the rule and click on **Create rule**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws-security-hubhttp-collector-image-tkpgufff.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A50Z&se=2026-11-15T01%3A04%3A50Z&sr=c&sp=r&sig=HgWQWw18RIT57cOpanrRI8b6REIvVeoV5EwoNjADmKM%3D) ## ## Optional: EventBridge Configuration via Terraform As an alternative, the EventBridge configuration can be automated by using Terraform scripts. The scripts can be found as files on the right hand column of this article. ### Prerequisite - Install Terraform by following the official guide: [Terraform Installation Guide.](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli#install-terraform) - Refer to the [Terraform AWS Provider documentation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#environment-variables). ### Configuration Steps 1. Set Up AWS Credentials 1. Configure the AWS credentials using the following environment variables: 1. AWS_ACCESS_KEY_ID 2. AWS_SECRET_ACCESS_KEY 2. For more details, see the Terraform AWS Provider Documentation. 2. Update Terraform Configuration Files 1. Update the variables defined in the **aws_securityhub_terraform.tfvars** file. 2. Update the region parameter in the AWS provider block within **aws_securityhub_main.tf** to match the target deployment region. 3. Deploy the Infrastructure 1. Execute the following Terraform commands in sequence: ```bash terraform init terraform apply ``` ## Troubleshooting Tips 1. **How can I check if my account has permission to manage EventBridge?** In the AWS Management Console, go to **EventBridge** → **Rules**. If you can view, create, or edit rules, your account has the required permissions. If the option is disabled or you see an “Access Denied” message, contact your administrator to verify your IAM permissions. 2. **Why am I not seeing Security Hub events in EventBridge?** Make sure Security Hub is enabled in the same region and that EventBridge has an active rule with the event source set to aws.securityhub. 3. **My rule is not triggering — what should I check?** Verify that the rule state is set to Enabled, the event pattern matches Security Hub findings, and the target (API destination) is active and reachable. 4. **How do I confirm that events are reaching my API destination?** In EventBridge → API destinations → Monitoring, check invocation metrics or use CloudWatch Logs to verify delivery attempts. 5. **What if I see “Access Denied” when creating a rule or destination?** Confirm that your IAM role includes the required actions: events:CreateConnection, events:CreateApiDestination, events:PutRule, and events:PutTargets. For troubleshooting guidance, refer to the official [DataBee HTTP Collector documentation](https://docs.databee.buzz/docs/http-collector). # ## Attachments - [aws_securityhub_main.tf](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws_securityhub_main.tf) - [aws_securityhub_terraform.tfvars](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws_securityhub_terraform.tfvars) - [aws_securityhub_variables.tf](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/aws_securityhub_variables.tf)