Insights and Custom Finding Actions

A long list of normalized findings is still hard to act on. Security Hub adds two tools to turn that list into focused action: insights that group related findings, and custom actions that let you trigger workflows from selected findings.

A Security Hub insight is a saved grouping of findings collected by a filter and a "group by" attribute. For example, an insight could group active findings by resource to reveal which resources have the most problems. Insights surface patterns that single findings hide.

Security Hub ships with managed insights out of the box, such as "AWS resources with the most findings" or "S3 buckets with public access". These pre-built groupings give immediate value, highlighting hotspots without you defining anything.

You can also build custom insights tailored to your concerns, filtering on any ASFF field and grouping by another. A team might create an insight for High-severity findings grouped by account, focusing attention exactly where their risk lies.

Grouping converts noise into priorities. Instead of scrolling thousands of findings, an insight tells you "these five resources account for most of the risk." This drives remediation toward the highest-impact fixes, supporting the prioritization the exam values.

A custom action in Security Hub is a named trigger you attach to findings. When an analyst selects findings and chooses that action, Security Hub emits an event to EventBridge. This is the bridge from human triage to automated response.

Each custom action has its own ARN and produces an EventBridge event carrying the selected findings. An EventBridge rule then routes that event to a target, such as a Lambda function, a Step Functions workflow, or a ticketing integration, to remediate or escalate.

Custom actions enable analyst-initiated response: a human reviews and then clicks to remediate. For fully automatic response, you instead match findings directly with EventBridge rules so action happens without a person. Knowing both patterns helps you pick the right one.

Security Hub also offers automation rules that automatically update findings, for example raising severity or changing workflow status when criteria match. These rules refine the finding stream before it ever reaches an analyst or downstream automation.

Automation rules act when a finding matches defined criteria on ASFF fields, then apply changes like setting severity, updating workflow status, or adding a note. For example, a rule could automatically suppress low-severity findings from a known test account. This refines the stream consistently, before analysts or downstream automation ever see it.

To choose between patterns, ask whether a human should review first. Custom actions suit judgment-heavy responses an analyst initiates; direct EventBridge rules suit clear-cut, high-volume findings that should be remediated instantly without waiting. Many teams combine both: auto-remediate the obvious, and route the ambiguous to analysts via custom actions.

Connect findings to response.

Security Hub insights group findings by a filter and attribute (managed or custom) to reveal where risk concentrates. Custom actions let an analyst send selected findings to EventBridge for response, while direct EventBridge rules enable fully automatic remediation and automation rules auto-update findings. Together they turn aggregated findings into workflows.