---
title: AWS security integration
source: https://docs.newrelic.com/docs/vulnerability-management/getting-started/integrations/aws
---

You can import AWS Security Hub findings into New Relic to achieve a single, unified view of vulnerabilities. The process uses EventBridge to post findings from AWS Security reporting services via an AWS API Destination.

After completing these steps, you will see new vulnerabilities detected by AWS Security tools in your New Relic account in real time, and you'll be able to build out analytics dashboards and enable alerts on newly detected issues.

You can also import AWS GuardDuty and Inspector findings and view them through custom dashboards or queries using NRDB.

## Prerequisites

To send AWS security data to New Relic:

-   [Enable AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html) on your AWS account.
-   Obtain a New Relic [license key](https://docs.newrelic.com/docs/accounts-partnerships/install-new-relic/account-setup/license-key) for the account you want to report data to.

## Create an API destination for ingest

### Create API destination [#create-api-destination]

1.  In your AWS UI navigate to **EventBridge > Integrations > API destinations > Create API destination**.
2.  Fill in the prompts.
3.  Construct your endpoint using the pattern below, and enter it into API destination endpoint:

    ```
    https://security-ingest-processor.service.newrelic.com/v1/security/webhooks/awssecurityhub?Api-Key=NEW_RELIC_LICENSE_KEY
    ```

    > #### ⚠️ IMPORTANT
    >
    > Use the appropriate endpoint based on your region:
    >
    > -   EU: `https://security-ingest-processor.service.eu.newrelic.com/v1/security/webhooks/awssecurityhub?Api-Key=NEW_RELIC_LICENSE_KEY`
    > -   JP: `https://security-ingest-processor.service.jp.newrelic.com/v1/security/webhooks/awssecurityhub?Api-Key=NEW_RELIC_LICENSE_KEY`
4.  Select **POST** as the HTTP method.
5.  Select **Create a new connection**.

### Create a new connection [#create-new-connection]

1.  Fill in the fields in the new prompt.
2.  For **Destination** select **Other**.
3.  For **Authorization type** select **API Key**.
4.  For **API Key Name** type `Api-Key` and paste your New Relic license key as the value.

## Create an EventBridge rule

Once you've created an API destination for ingest, create an Eventbridge rule to forward security-related events to an API destination for New Relic's ingest.

### Define rule detail [#define-rule-detail]

1.  In your AWS UI navigate to **EventBridge > Rules > Create Rule**.
2.  Enter a name in the name field, such as `SecurityEvent_NewRelicSIP_EventForwarder_Rule`.
3.  Enter a description, such as `Forwards Security Hub, GuardDuty, and Inspector events to the New Relic Security Ingest Processor (SIP)`.
4.  For event bus, select `default`.
5.  For rule type, select `Rule with an event pattern`.
6.  Select **Next**.

### Build event pattern [#build-event-pattern]

1.  In the new pane select **AWS events or EventBridge partner events** as the event source.
2.  Optional: Choose any Security Hub sample event from the dropdown to test your rule against.
3.  For the event pattern, enter the select the custom patterns pane and input a pattern. For example the pattern below matches events from Security Hub, Guard Duty, and Inspector:

    ```json
    {
      "detail-type": [
        {
          "prefix": "Security Hub"
        },
        {
          "prefix": "GuardDuty Finding"
        },
        {
          "prefix": "Inspector2"
        }
      ]
    }
    ```

### Select the API destination as the rule target [#select-api-destination]

1.  For **Target types**, select **EventBridge API destination**.
2.  For **API destination**, select **Use an existing API destination**.
3.  Using the dropdown, select the API destination you created in step 1.
4.  For execution role, select **Create a new role for this specific resource**.

### Configure tags (Optional) [#configure-tags]

Configure your tags as needed.

### Review and Create [#review]

Review all your selections and make any changes as necessary.

### Review in NRDB [#review-in-nrdb]

To review logs ingested via AWS Event Bridge, you can use the following NRQL query:

````sql
FROM Vulnerability SELECT * WHERE source LIKE 'AWS%' SINCE 3 MONTHS AGO
```

Note that GuardDuty and Inspector results will only show this way, while SecurityHub vulnerabilities will be visible in New Relic's Security RX (if available).

````