AWS Security Hub
This source is currently in alpha. The interface and available tables may change.
Let AI connect your sources for you
Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.
Connect AWS Security Hub to PostHog to sync your data into the PostHog data warehouse for analysis and modeling.
Sync Security Hub CSPM findings, standards, controls, product integrations, member accounts, and custom insights from the configured AWS region.
Grant securityhub:GetFindings, securityhub:DescribeStandards, securityhub:GetEnabledStandards, securityhub:GetInsights, securityhub:DescribeStandardsControls, securityhub:ListSecurityControlDefinitions, securityhub:DescribeProducts, and securityhub:ListMembers to the IAM user or role.
Enter its access key ID and secret access key. Add a session token for temporary credentials.
Enable Security Hub CSPM in the selected region.
If you select an aggregation region, AWS can also return findings from linked regions.
Configuration
| Option | Description |
|---|---|
AWS access key IDType: text Required: True | |
AWS secret access keyType: password Required: True | |
AWS session tokenType: password Required: False | Temporary credentials expire. Reconnect with new credentials when the session token expires. |
AWS regionType: text Required: True |
Linking AWS Security Hub to PostHog
- Go to the Data pipeline page in PostHog
- Click New source and select AWS Security Hub
- Fill in the required configuration fields
- Click Next, select the tables you want to sync, and then press Import
Supported tables
| Table | Description | Sync method | Incremental field | Primary key |
|---|---|---|---|---|
findings | Security findings with severity, resources, compliance status, and workflow status. | Incremental, Full refresh | updated_at | — |
standards | Available security standards and their descriptions. | Full refresh | — | — |
enabled_standards | Enabled security standards and their subscription status. | Full refresh | — | — |
insights | Custom insights with their filters and grouping fields. AWS managed insights are excluded. | Full refresh | — | — |
standards_controls | Controls in each enabled standard, with enablement status, severity, and disablement reasons. | Full refresh | — | — |
security_control_definitions | Security control definitions with titles, severity, and remediation guidance. | Full refresh | — | — |
products | Product integrations that can send findings to Security Hub, with vendor names and descriptions. | Full refresh | — | — |
members | Member accounts of the Security Hub administrator account and their relationship status. | Full refresh | — | — |