SCS-C02 · Question #456
A company uses a collaboration application. A security engineer needs to configure automated alerts from AWS Security Hub in the us-west-2 Region for the application. The security engineer wants to…
The correct answer is C. Modify the value of the ProductArn attribute in the event pattern of the EventBridge rule to. To filter out specific findings, such as those from Amazon Inspector, EventBridge event patterns can be used to selectively route events. By updating the ProductArn attribute in the event pattern with anything-but for Amazon Inspector's ProductArn (arn:aws:securityhub:us-west…
Question
A company uses a collaboration application. A security engineer needs to configure automated alerts from AWS Security Hub in the us-west-2 Region for the application. The security engineer wants to receive an alert in a channel in the application every time Security Hub receives a new finding. The security engineer creates an AWS Lambda function to convert the message to the format that the application requires. The Lambda function also sends the message to the application's API. The security engineer configures a corresponding Amazon EventBridge rule that specifies the Lambda function as the target. After the EventBridge rule is implemented, the channel begins to constantly receive alerts from Security Hub. Many of the alerts are Amazon Inspector alerts that do not require any action. The security engineer wants to stop the Amazon Inspector alerts. Which solution will meet this requirement with the LEAST operational effort?
Options
- AUpdate the Lambda function code to find pattern matches of events from Amazon Inspector and
- BCreate a Security Hub custom action that automatically sends findings from all services except
- CModify the value of the ProductArn attribute in the event pattern of the EventBridge rule to
- DCreate an Amazon Simple Notification Service (Amazon SNS) topic to send messages to the
How the community answered
(57 responses)- A4% (2)
- B7% (4)
- C75% (43)
- D14% (8)
Explanation
To filter out specific findings, such as those from Amazon Inspector, EventBridge event patterns can be used to selectively route events. By updating the ProductArn attribute in the event pattern with anything-but for Amazon Inspector's ProductArn (arn:aws:securityhub:us-west- ), only findings from other services will trigger the Lambda function. This approach allows the security engineer to filter 2::product/aws/inspector out unnecessary alerts with minimal operational effort, avoiding the need for additional filtering in
Topics
Community Discussion
No community discussion yet for this question.