AWS SecurityHub

Name: AWS SecurityHub API
Brand: AWS SecurityHub
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat DetectionapiKey61 EndpointsREST

Install Jentic One Beta

Connect the AWS SecurityHub to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS SecurityHub, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with AWS SecurityHub API.

Import findings from third-party products into Security Hub via BatchImportFindings

Update finding workflow status, severity, and notes with BatchUpdateFindings

Enable and disable security standards such as CIS, PCI DSS, and AWS FSBP

GET STARTED

Start building with AWS SecurityHub API

Explore with Jentic

View OpenAPI Document

For Agents

Aggregate, query, and triage AWS security findings across accounts and standards. Agents can import findings, update workflow status, run insights, and manage Security Hub members.

Use for: I need to import a finding from a third-party scanner into Security Hub, Mark a Security Hub finding as resolved, List all critical-severity findings in the last 24 hours, Enable the CIS AWS Foundations Benchmark standard

Not supported: Does not generate threat findings, run vulnerability scans, or perform forensic investigation - use to aggregate and triage findings produced by GuardDuty, Inspector, Macie, and third-party products only.

Jentic publishes the only available OpenAPI specification for AWS SecurityHub, keeping it validated and agent-ready. AWS Security Hub aggregates, normalises, and prioritises security findings from AWS services such as GuardDuty, Inspector, and Macie, plus integrated third-party products. Agents can ingest findings through BatchImportFindings, update finding status with BatchUpdateFindings, enable security standards like CIS and PCI DSS, run automated insights, and manage member accounts in a multi-account organisation. The API exposes 61 operations covering findings, controls, standards, insights, action targets, and finding aggregators.

Use Cases

Patterns agents use AWS SecurityHub API for, with concrete tasks.

★ Centralised Multi-Account Findings Triage

Security teams use Security Hub as the single pane of glass for findings across many AWS accounts. The administrator account invites member accounts, enables standards centrally, and queries findings filtered by severity and resource. BatchUpdateFindings is used to set workflow status (NEW, NOTIFIED, SUPPRESSED, RESOLVED) so that triage state is consistent across the organisation.

Call GetFindings with a filter for SeverityLabel = CRITICAL and WorkflowStatus = NEW, then BatchUpdateFindings to set Workflow.Status = NOTIFIED for the matching finding IDs.

Automated Compliance Posture Reporting

Compliance teams enable standards (CIS, PCI DSS, NIST 800-53, AWS Foundational Security Best Practices) and use Security Hub controls to track which checks pass or fail. Agents can list enabled standards, fetch control statuses, and generate periodic reports without scraping the console.

Call BatchEnableStandards for the CIS AWS Foundations Benchmark ARN, then BatchGetSecurityControls to retrieve the failed-control list for the current account.

Third-Party Finding Ingestion

Vendors and in-house scanners that produce ASFF-compliant findings push them to Security Hub via BatchImportFindings, giving operators a unified queue. CreateActionTarget defines custom actions that EventBridge rules can use to route specific findings to ticketing or chat systems.

BatchImportFindings with a single ASFF document for an EC2 instance vulnerability, then CreateActionTarget named 'send-to-pagerduty' for routing high-severity findings.

AI Agent Security Triage via Jentic

AI agents using Jentic can investigate Security Hub findings on demand: pulling open critical findings, enriching them with resource context, and updating workflow status as triage proceeds. Through Jentic, the agent searches by intent, loads operation schemas, and executes calls without needing the AWS SDK or SigV4 signing logic.

Search Jentic for 'list security hub findings filtered by severity', execute GetFindings with SeverityLabel = HIGH, then BatchUpdateFindings to add a Note for each finding with the agent's triage decision.

Key Endpoints

61 endpoints — jentic publishes the only available openapi specification for aws securityhub, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/findings/import

Import findings into Security Hub (BatchImportFindings)

PATCH

/findings/batchupdate

Update workflow status, severity, and notes on findings

POST

/standards/register

Enable one or more security standards

POST

/standards/deregister

Disable one or more security standards

POST

/securityControls/batchGet

Fetch security control details and status

POST

/insights

Create a Security Hub Insight

POST

/members

Add member accounts to a Security Hub organisation

POST

/actionTargets

Create a custom action target for EventBridge routing

POST

/findings/import

Import findings into Security Hub (BatchImportFindings)

PATCH

/findings/batchupdate

Update workflow status, severity, and notes on findings

POST

/standards/register

Enable one or more security standards

POST

/standards/deregister

Disable one or more security standards

POST

/securityControls/batchGet

Fetch security control details and status

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your AWS access key and secret are stored once, encrypted, by your own Jentic One instance and each request is signed with SigV4 at execution time. They never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'list Security Hub findings filtered by severity' or 'mark a finding as resolved', and Jentic returns the matching operation like GetFindings or BatchUpdateFindings with its input schema so the agent calls it without scanning the full operation surface.

Time to first call

FAQs

Specific to using AWS SecurityHub API through Jentic.

Why is there no official OpenAPI spec for AWS SecurityHub?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS SecurityHub via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the AWS SecurityHub use?

Security Hub uses AWS Signature Version 4 with an access key, secret key, and the relevant IAM permissions (for example, securityhub:BatchImportFindings). Through Jentic, AWS credentials live encrypted in the vault and Jentic signs each call before sending it to the regional Security Hub endpoint.

Can I import third-party security findings into Security Hub?

Yes. BatchImportFindings accepts up to 100 findings per call in AWS Security Finding Format (ASFF). Each finding must include a ProductArn that is registered with Security Hub. Suppressed or resolved findings round-trip through BatchUpdateFindings.

What are the rate limits for the AWS SecurityHub?

AWS publishes per-operation throttling: BatchEnableStandards is 1 request per second (burst 1), GetFindings is 3 per second (burst 6), BatchImportFindings and BatchUpdateFindings are 10 per second (burst 30), UpdateStandardsControl is 1 per second (burst 5), and most other operations are 10 per second (burst 30). Throttled calls return ThrottlingException and should be retried with backoff.

How do I update finding workflow status through Jentic?

Through Jentic, search for 'update security hub finding status', load the BatchUpdateFindings input schema, and execute a PATCH against /findings/batchupdate with FindingIdentifiers and Workflow.Status set to NOTIFIED, SUPPRESSED, or RESOLVED. Jentic handles SigV4 signing for the underlying AWS call.

Is AWS Security Hub free?

Security Hub charges per security check evaluation and per finding ingested, with a 30-day free trial. Pricing depends on region; see https://aws.amazon.com/security-hub/pricing/ for the current rates.

Can I limit what my agent is allowed to do with the AWS Security Hub API?

Yes. Because you run Jentic One yourself, your own rules decide which of the 61 Security Hub operations and which AWS credentials the agent may use. Since Security Hub carries finding identifiers, filters, and standards ARNs in the request body rather than the URL path, you scope by operation: for a triage agent you might allow only GetFindings and BatchUpdateFindings, while operations like DisassociateMembers or BatchDisableStandards stay unavailable unless you add them. The agent can only call the operations you have granted.

AWS SecurityHub

Connect the AWS SecurityHub to your agent

Capabilities

Start building with AWS SecurityHub API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs