AWS Integration for Security Exposure Management reference information
Reference information for the AWS Integration for Security Exposure Management, including data field mappings, severity mappings, tables, script includes, and supported AWS regions.
Reference topics containing information about tables, roles, and properties installed with the integration.
The following tables are used by the AWS Integration for Security Exposure Management.
| Table | Description | ACLs |
|---|---|---|
sn_vul_aws_inspector_host_vuln_import | Import set for host vulnerabilities | Read: import_admin; Write: nobody; Create: nobody; Delete: nobody |
sn_vul_aws_inspector_container_vuln_import | Import set for container vulnerabilities | Read: import_admin; Write: nobody; Create: nobody; Delete: nobody |
sn_vul_aws_security_hub_host_vuln_import | Import set for Security Hub host findings | Read: import_admin; Write: nobody; Create: nobody; Delete: nobody |
sn_vul_aws_security_hub_container_vuln_import | Import set for Security Hub container findings | Read: import_admin; Write: nobody; Create: nobody; Delete: nobody |
sn_vul_aws_security_hub_test_results_import | Import set for test results | Read: import_admin |
sn_vul_aws_cvd_attributes | CVD attributes (CVSS, EPSS, and related data) | Read: sn_sec_cvd.read; Write: nobody; Create: nobody; Delete: nobody |
sn_vul_aws_integration | Integration records | Read: sn_vul_aws.read_integration; Write/Create/Delete: sn_vul_aws.configure_integration |
sn_vul_aws_configuration | Configuration records | Read: sn_vul_aws.read_integration; Write/Create/Delete: sn_vul_aws.configure_integration |
sn_vul_aws_regions | AWS regions reference | Read: sn_vul_aws.read_integration; Write: nobody |
sn_vul_nvd_entry | NVD entries (extended) | Existing ACLs |
sn_vul_third_party_entry | Third-party entries (extended) | Existing ACLs |
Script includes
The following script includes are used by the AWS Integration for Security Exposure Management.
| Script include | Description |
|---|---|
AWSIntegrationBase | Base class. Handles REST calls, pagination, and filter building for both Inspector and Security Hub. |
AWSUtil | Common utility methods including STS token retrieval, AWS Signature V4 signing, and filter processing for both integration types. |
AWSConfigUtil | Configuration management including credential saving and validation, and integration activation and deactivation. |
SGAwsApiAwsSignatureV4Generator | AWS Signature V4 signing implementation. |
AWSInspectorHostVulnerabilitiesIntegration | Extends AWSIntegrationBase for Inspector host findings. |
AWSInspectorContainerVulnerabilitiesIntegration | Extends AWSIntegrationBase for Inspector container findings. |
AWSInspectorHostVulnerabilityProcessor | Processes Inspector host findings. Creates Vulnerable Items (VITs) and Detections. |
AWSInspectorContainerVulnerabilityProcessor | Processes Inspector container findings. Creates Container Vulnerable Items (CVITs) and Findings. |
AWSSecurityHubHostVulnerabilitiesIntegration | Extends AWSIntegrationBase for Security Hub host findings. |
AWSSecurityHubContainerVulnerabilitiesIntegration | Extends AWSIntegrationBase for Security Hub container findings. |
AWSSecurityHubTestResultsIntegration | Extends AWSIntegrationBase for Security Hub test results. |
AWSSecurityHubHostVulnerabilitiesProcessor | Processes Security Hub host findings. Creates VITs and Detections. |
AWSSecurityHubContainerVulnerabilitiesProcessor | Processes Security Hub container findings. Creates CVITs and Findings. |
AWSSecurityHubTestResultsProcessor | Processes Security Hub configuration findings. Creates tests and test results. |
Supported AWS regions
The following AWS regions are supported by the integration.
| Region code | Region name |
|---|---|
us-east-1 | US East (N. Virginia) |
us-east-2 | US East (Ohio) |
us-west-1 | US West (N. California) |
us-west-2 | US West (Oregon) |
af-south-1 | Africa (Cape Town) |
ap-east-1 | Asia Pacific (Hong Kong) |
ap-south-1 | Asia Pacific (Mumbai) |
ap-south-2 | Asia Pacific (Hyderabad) |
ap-southeast-1 | Asia Pacific (Singapore) |
ap-southeast-2 | Asia Pacific (Sydney) |
ap-southeast-3 | Asia Pacific (Jakarta) |
ap-southeast-4 | Asia Pacific (Melbourne) |
ap-northeast-1 | Asia Pacific (Tokyo) |
ap-northeast-2 | Asia Pacific (Seoul) |
ap-northeast-3 | Asia Pacific (Osaka) |
ca-central-1 | Canada (Central) |
eu-central-1 | Europe (Frankfurt) |
eu-central-2 | Europe (Zurich) |
eu-west-1 | Europe (Ireland) |
eu-west-2 | Europe (London) |
eu-west-3 | Europe (Paris) |
eu-south-1 | Europe (Milan) |
eu-south-2 | Europe (Spain) |
eu-north-1 | Europe (Stockholm) |
il-central-1 | Israel (Tel Aviv) |
me-south-1 | Middle East (Bahrain) |
me-central-1 | Middle East (UAE) |
sa-east-1 | South America (Sao Paulo) |
us-gov-west-1 | AWS GovCloud (US-West) |