Integrate Prisma Cloud with AWS Security Hub

Learn how to integrate Prisma® Cloud with AWS Security Hub so that you can view and monitor your security posture on AWS Security Hub.

Integrate Prisma® Cloud with AWS Security Hub for centralized visibility into security and compliance risks associated with your cloud assets on the AWS Security Hub console.

As a part of the integration, Prisma Cloud monitors your AWS cloud assets. It sends alerts about resource misconfigurations, compliance violations, network security risks, and anomalous user activities directly to the AWS Security Hub console providing a centralized and comprehensive view of the cloud assets deployed on your AWS accounts.

Prisma Cloud integration with AWS Security Hub is not supported for US Gov Cloud regions.

Attach an AWS Security Hub read-only policy to your AWS role to enable this integration on the AWS console.
1. Log in to the AWS console and select IAM.
2. Select Roles and search for the role name used to onboard your account on Prisma Cloud.
3. Click on that role name and Add permissions > Attach Policies.
4. Enter SecurityHubRead as the search term.
5. Select AWSSecurityHubReadOnlyAccess and then Attach Policies.
Sign up for Prisma Cloud on AWS Security Hub.
1. Log in to the AWS console and select Security Hub.
2. Navigate to Integrations and enter Prisma Cloud Enterprise as the search term.
3. Find Palo Alto Networks: Prisma Cloud Enterprise and Accept findings.
Set up the AWS Security Hub Integration on Prisma Cloud.
Set up the AWS Security Hub as an integration channel on Prisma Cloud so that you can view security alerts and compliance status for all your AWS services from the AWS console.
1. Log in to Prisma Cloud.
2. Select Settings > Integrations & Notifications.
3. Add Integration > AWS Security Hub. A modal wizard will open, allowing you to add the details for the AWS Security Hub integration.
4. Set the Integration Name to the AWS account to which you assigned AWS Security Hub read-only access.
5. (tt:[Optional]) Enter a Description.
6. Select Regions.
  Make sure to select the region(s) where Prisma Cloud on AWS Security Hub is enabled for your cloud account, or else you will receive an error while testing the integration.
7. (tt:[Optional]) Select a Default Region.
  Make sure you select the default region to receive alert notifications for global resources. For example, if you want to receive alerts for IAM resources—which are global and not linked to any specific region—you must choose a default region. If you do not select a default region for global resources, you will not receive alerts.
8. Click Next, review the Summary, and then Test Integration.
9. Save Integration if the test is successful.
  Once you successfully set up the integration, you will find it listed on the Integrations page. You can View, Edit, or Delete the integration from the Actions panel. You can also check the integration status periodically by clicking on the Get Status link.
Modify an existing alert rule or create a new alert rule to specify when to send alert notifications.
If you have integrated an AWS Organization account with Security Hub on Prisma Cloud, it is considered a standalone account. This means you will only receive alerts for the master account on Security Hub, not its child accounts. To receive alerts for every child account linked to that master account, you must repeat Steps 1 through 3 and then configure alert rules for each account.
View Prisma Cloud alerts on AWS Security Hub.
1. Log in to the AWS console and select Security Hub.
2. Click Findings to view the alerts.
3. Select the Title to view details of the alert description.