Xray Integration with AWS Security Hub

JFrog Xray's integration brings Xray’s security and license violations intel inside AWS Security Hub. With this integration, you can:

• Get a single consolidated view of all license compliance and security vulnerabilities.
• Collect comprehensive scanning, analysis, and response to the license violations and security vulnerabilities that impact open source software associated with services, container images, helm charts, and other binaries.

How it Works

The Xray AWS Security Hub Integration takes the Xray webhook data, transforms it into an AWS Security Finding format, and imports the data into the Security Hub. The integration keeps track of findings that were already imported so that when the same violations are detected, they will be updated in the Security Hub.

The integration uses AWS serverless technology (Lambda, SQS, DynamoDb) to provide easy deployment and management. By deploying to your own AWS account, Xray data does not transit through third party systems.

Read more about the integration on our Github page.

Support

If you need help with this integration, contact [email protected].

Xray Integration with AWS Security Hub Configuration Overview

This topic describes how to integrate Slack with Artifactory and Xray.

Requirements

• Your organization should have a self-hosted or cloud instance of the JFrog Platform.
• You must be a user with Admin permissions to create a webhook for Xray.
• Your organization must have an active subscription to AWS.

Configuration Overview

To work with the integration, do the following:

Deploy Xray Integration in AWS Security Hub

1. From the AWS Serverless Application Repository, search for jfrog and select the jfrog-xray-security-hub-integration application.

2. Click Deploy to start the deployment process.

3. In the Application settings section, enter the parameters.

4. When you are ready, click the Deploy button. This will deploy the application to your AWS account for that region.

   After the application is deployed, you will be provided with a URL (e.g. https://i0fl689f46.execute-api.us-west-1.amazonaws.com/prod/send). This is the URL that Xray will send data to. Make a note of this for later reference.

Accept Findings for the Security Hub Integration in AWS

1. In the AWS Security Hub Integration page, search for jfrog and select the JFrog Xray integration.

2. Click the Accept findings button to allow the security findings to be sent from the integration application installed above.

   Now the integration is ready to receive data from Xray.

Set up Webhook for JFrog Xray Setup with AWS Security Hub

1. Follow the instructions on configuring Xray Webhook.

2. For the URL, enter the URL from the Serverless Application deployment process from above.

3. Clear out the User Name and Password fields in the Basic Auth section and, as shown in the image above, add the following two custom headers:

4. Click Create to create the webhook.

5. Associate this webhook with a policy that is attached to a watch so that it will be triggered when violations are detected during a scan.

   Now Xray is ready to send data to the integration and Security Hub.