AWS Security Hub Critical Severity Compliance Findings Sentinel

This sentinel continuously polls AWS Security Hub for active findings with CRITICAL severity. When critical findings are present, a Slack alert is sent with the count, sample finding titles, and the names of the security products that generated them, giving security and compliance teams immediate visibility into the most urgent open issues.

How it works

1. io.kestra.plugin.aws.cli.AwsCLI calls aws securityhub get-findings with filters for SeverityLabel=CRITICAL and RecordState=ACTIVE, capped to max_findings (default 25) items.
2. The JSON response is parsed with jq to extract the finding count, the first five finding titles, and the unique set of product names that generated the findings.
3. io.kestra.plugin.core.flow.If branches on findings_found. When true, a Slack message is sent with the count, sample titles, and products. When false, the flow logs a clean result.
4. A top-level errors block fires a Slack alert on any unhandled exception.

What you get

• Automated detection of active CRITICAL Security Hub findings every 15 minutes.
• Slack alerts with finding count, representative titles, and source product names.
• A configurable max_findings input to control how many findings are fetched per run.
• Full Kestra execution history for every sentinel check.

Who it's for

• Security engineers managing AWS Security Hub as a central compliance aggregator.
• Cloud security teams enforcing CIS, PCI DSS, or AWS Foundational Security Best Practices standards.
• Incident response teams needing real-time Slack alerts for critical compliance failures.

Why orchestrate this with Kestra

Security Hub can send events to EventBridge, but that requires configuring rules, targets, and SNS topics separately. Kestra consolidates the findings query, conditional branching, and Slack notification into a single declarative flow with retries, execution lineage, and namespace-scoped secrets.

Prerequisites

• An AWS IAM identity with securityhub:GetFindings permission.
• AWS Security Hub enabled in the target region.
• A Slack incoming webhook.

Secrets

• AWS_ACCESS_KEY_ID: AWS access key ID.
• AWS_SECRET_ACCESS_KEY: AWS secret access key.
• SLACK_WEBHOOK: Slack incoming webhook URL.

Quick start

1. Add AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and SLACK_WEBHOOK to your Kestra namespace secrets.
2. Set aws_region to the region where Security Hub is enabled.
3. Adjust max_findings if needed (default: 25).
4. Enable the schedule trigger or execute manually.

How to extend

• Add a second branch for HIGH severity findings with a separate alert channel.
• Loop across multiple regions using Kestra ForEach.
• Suppress known-false-positive finding titles by filtering the TITLES list before alerting.
• Persist finding details to S3 or a data warehouse for compliance trend analysis.

Links

• AWS Security Hub documentation
• Kestra AWS CLI plugin
• Kestra Slack plugin