AWS Security Hub

aws securityhub get-findings

Query AWS Security Hub security findings, the centralized view of the organization's multi-account posture.

Run it when you need the consolidated security view: Security Hub aggregates findings from GuardDuty, Inspector, Config, and its own security controls — and get-findings queries them with filters (severity, account, status). It's the central panel of the AWS posture: findings from all accounts in one place, with the severity and the control that generated them. In the AWS SOC, Security Hub is the console for security findings: filtering by high severity and by account gives the list of what needs investigation, and the SIEM integration (EventBridge) feeds findings into the incident flow.

Don't use it as a complete source: Security Hub aggregates what the integrated services generate — without the integrations enabled (GuardDuty, Config, Inspector) and without the security standards enabled (CIS, PCI), the hub is empty; the hub configuration (multi-account delegation, standards) is the prerequisite. The volume of findings is high (CIS controls generate hundreds): triage by severity and state management (NEW, SUPPRESSED) are part of the flow. And note: the hub shows findings, not the response — remediation (automated actions, runbook) is configured separately. For the detail of a specific finding, use get-findings with the ID or the integration with the source service.