Improving the Response to Security Events
The previous section focused on improving security event detection. You are now ready to examine the measures to take to improve your response to security events.
Prioritizing Automated Responses to the Detection of Vulnerabilities
Based on the configuration policies that you’ve defined, Security Hub correlates the findings it collected from the various sources that you’ve integrated with it, such as AWS Config, Amazon GuardDuty, Amazon Macie, AWS Inspector, and others. Each finding has attributes documenting the context in which they were created and the issue they identified, such as severity level (from low to critical), workflow status (the status of your investigation regarding this finding), record state (is it active or has it been archived?), region, account, product (that reported the finding), resource (affected by the finding), and other aspects depending on the type of finding. You can then leverage these attributes...
