canonical: https://jentic.com/apis/amazonaws.com/aws-securityhub # AWS SecurityHub Jentic publishes the only available OpenAPI specification for AWS SecurityHub, keeping it validated and agent-ready. AWS Security Hub aggregates, normalises, and prioritises security findings from AWS services such as GuardDuty, Inspector, and Macie, plus integrated third-party products. Agents can ingest findings through BatchImportFindings, update finding status with BatchUpdateFindings, enable security standards like CIS and PCI DSS, run automated insights, and manage member accounts in a multi-account organisation. The API exposes 61 operations covering findings, controls, standards, insights, action targets, and finding aggregators. ## For AI agents Aggregate, query, and triage AWS security findings across accounts and standards. Agents can import findings, update workflow status, run insights, and manage Security Hub members. ## Scope Does not generate threat findings, run vulnerability scans, or perform forensic investigation - use to aggregate and triage findings produced by GuardDuty, Inspector, Macie, and third-party products only. ## Capabilities - Import findings from third-party products into Security Hub via BatchImportFindings - Update finding workflow status, severity, and notes with BatchUpdateFindings - Enable and disable security standards such as CIS, PCI DSS, and AWS FSBP - Query active findings with GetFindings using filters on severity, resource, and compliance status - Run and inspect Security Hub Insights to surface grouped findings by attribute - Manage Security Hub member accounts with CreateMembers, InviteMembers, and DisassociateMembers ## Use cases ### Centralised Multi-Account Findings Triage Security teams use Security Hub as the single pane of glass for findings across many AWS accounts. The administrator account invites member accounts, enables standards centrally, and queries findings filtered by severity and resource. BatchUpdateFindings is used to set workflow status (NEW, NOTIFIED, SUPPRESSED, RESOLVED) so that triage state is consistent across the organisation. Example prompt: Call GetFindings with a filter for SeverityLabel = CRITICAL and WorkflowStatus = NEW, then BatchUpdateFindings to set Workflow.Status = NOTIFIED for the matching finding IDs. ### Automated Compliance Posture Reporting Compliance teams enable standards (CIS, PCI DSS, NIST 800-53, AWS Foundational Security Best Practices) and use Security Hub controls to track which checks pass or fail. Agents can list enabled standards, fetch control statuses, and generate periodic reports without scraping the console. Example prompt: Call BatchEnableStandards for the CIS AWS Foundations Benchmark ARN, then BatchGetSecurityControls to retrieve the failed-control list for the current account. ### Third-Party Finding Ingestion Vendors and in-house scanners that produce ASFF-compliant findings push them to Security Hub via BatchImportFindings, giving operators a unified queue. CreateActionTarget defines custom actions that EventBridge rules can use to route specific findings to ticketing or chat systems. Example prompt: BatchImportFindings with a single ASFF document for an EC2 instance vulnerability, then CreateActionTarget named 'send-to-pagerduty' for routing high-severity findings. ### AI Agent Security Triage via Jentic AI agents using Jentic can investigate Security Hub findings on demand: pulling open critical findings, enriching them with resource context, and updating workflow status as triage proceeds. Through Jentic, the agent searches by intent, loads operation schemas, and executes calls without needing the AWS SDK or SigV4 signing logic. Example prompt: Search Jentic for 'list security hub findings filtered by severity', execute GetFindings with SeverityLabel = HIGH, then BatchUpdateFindings to add a Note for each finding with the agent's triage decision. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /findings/import | Import findings into Security Hub (BatchImportFindings) | | PATCH | /findings/batchupdate | Update workflow status, severity, and notes on findings | | POST | /standards/register | Enable one or more security standards | | POST | /standards/deregister | Disable one or more security standards | | POST | /securityControls/batchGet | Fetch security control details and status | | POST | /insights | Create a Security Hub Insight | | POST | /members | Add member accounts to a Security Hub organisation | | POST | /actionTargets | Create a custom action target for EventBridge routing | ## Key resources - **Findings** — ASFF-formatted security findings; managed via BatchImportFindings, BatchUpdateFindings, GetFindings - **Standards** — Compliance standards toggled with BatchEnableStandards and BatchDisableStandards - **Controls** — Individual checks within a standard; queried via BatchGetSecurityControls and BatchUpdateStandardsControlAssociations - **Insights** — Saved aggregations of findings; CreateInsight, GetInsightResults - **Members** — Multi-account membership managed via CreateMembers, InviteMembers, DisassociateMembers - **Action Targets** — Custom EventBridge action targets for finding routing ## Why Jentic - **Setup:** Wiring AWS Security Hub by hand means implementing AWS SigV4 signing, resolving the securityhub regional host, formatting findings in ASFF, and paginating across sixty-one operations with per-operation throttling. Through Jentic you install once, import AWS Security Hub from the API Directory, store your AWS access key and secret once, and your agent calls it. - **Permission scoping:** Security Hub carries finding identifiers, filters, and standards ARNs in the request body rather than in the URL path, so scope your agent to the operations it needs: for example allow GetFindings and BatchUpdateFindings for triage. You choose the operations it may call, so DisassociateMembers or BatchDisableStandards are not included unless you add them. - **Credential handling:** Your AWS access key and secret are stored once, encrypted, by your own Jentic One instance and each request is signed with SigV4 at execution time. They never enter the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list Security Hub findings filtered by severity' or 'mark a finding as resolved', and Jentic returns the matching operation like GetFindings or BatchUpdateFindings with its input schema so the agent calls it without scanning the full operation surface. ## Related APIs - **Amazon GuardDuty** — Threat detection service that produces findings consumed by Security Hub - **Amazon Detective** — Investigation graph that drills into the resources behind Security Hub findings - **AWS Audit Manager** — Continuous audit framework with mapped controls; useful when the primary need is audit evidence rather than findings ## FAQ ### Why is there no official OpenAPI spec for AWS SecurityHub? AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS SecurityHub via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the AWS SecurityHub use? Security Hub uses AWS Signature Version 4 with an access key, secret key, and the relevant IAM permissions (for example, securityhub:BatchImportFindings). Through Jentic, AWS credentials live encrypted in the vault and Jentic signs each call before sending it to the regional Security Hub endpoint. ### Can I import third-party security findings into Security Hub? Yes. BatchImportFindings accepts up to 100 findings per call in AWS Security Finding Format (ASFF). Each finding must include a ProductArn that is registered with Security Hub. Suppressed or resolved findings round-trip through BatchUpdateFindings. ### What are the rate limits for the AWS SecurityHub? AWS publishes per-operation throttling: BatchEnableStandards is 1 request per second (burst 1), GetFindings is 3 per second (burst 6), BatchImportFindings and BatchUpdateFindings are 10 per second (burst 30), UpdateStandardsControl is 1 per second (burst 5), and most other operations are 10 per second (burst 30). Throttled calls return ThrottlingException and should be retried with backoff. ### How do I update finding workflow status through Jentic? Through Jentic, search for 'update security hub finding status', load the BatchUpdateFindings input schema, and execute a PATCH against /findings/batchupdate with FindingIdentifiers and Workflow.Status set to NOTIFIED, SUPPRESSED, or RESOLVED. Jentic handles SigV4 signing for the underlying AWS call. ### Is AWS Security Hub free? Security Hub charges per security check evaluation and per finding ingested, with a 30-day free trial. Pricing depends on region; see https://aws.amazon.com/security-hub/pricing/ for the current rates. ### Can I limit what my agent is allowed to do with the AWS Security Hub API? Yes. Because you run Jentic One yourself, your own rules decide which of the 61 Security Hub operations and which AWS credentials the agent may use. Since Security Hub carries finding identifiers, filters, and standards ARNs in the request body rather than the URL path, you scope by operation: for a triage agent you might allow only GetFindings and BatchUpdateFindings, while operations like DisassociateMembers or BatchDisableStandards stay unavailable unless you add them. The agent can only call the operations you have granted.