chore(aws): enhance metadata for securityhub service (#9409)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>

prowler/CHANGELOG.md

@@ -26,6 +26,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Update AWS Organizations service metadata to new format [(#9384)](https://github.com/prowler-cloud/prowler/pull/9384)
 - Update AWS Resource Explorer v2 service metadata to new format [(#9386)](https://github.com/prowler-cloud/prowler/pull/9386)
 - Update AWS SageMaker service metadata to new format [(#9407)](https://github.com/prowler-cloud/prowler/pull/9407)
+- Update AWS Security Hub service metadata to new format [(#9409)](https://github.com/prowler-cloud/prowler/pull/9409)
 
 ---
 

prowler/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled.metadata.json

@@ -1,29 +1,34 @@
 {
   "Provider": "aws",
   "CheckID": "securityhub_enabled",
-  "CheckTitle": "Check if Security Hub is enabled and its standard subscriptions.",
+  "CheckTitle": "Security Hub is enabled with standards or integrations configured",
   "CheckType": [
-    "Logging and Monitoring"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards"
   ],
   "ServiceName": "securityhub",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:securityhub:region:account-id:hub/hub-id",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "Other",
   "ResourceGroup": "security",
-  "Description": "Check if Security Hub is enabled and its standard subscriptions.",
-  "Risk": "AWS Security Hub gives you a comprehensive view of your security alerts and security posture across your AWS accounts.",
-  "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable.html",
+  "Description": "**AWS Security Hub** is `ACTIVE` in the Region and has at least one enabled **security standard** or connected **integration**. Otherwise, it is either not enabled or enabled without standards/integrations.",
+  "Risk": "Absent **Security Hub coverage** or standards, security signals are fragmented and **control checks** don't run. High-risk findings can be missed or delayed, enabling data exfiltration, persistence, and lateral movement. This reduces **visibility** and undermines **confidentiality, integrity, and availability** across accounts/Regions.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws securityhub enable-security-hub --enable-default-standards",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "",
+      "NativeIaC": "```yaml\n# CloudFormation: Enable Security Hub and at least one standard\nResources:\n  <example_resource_name>Hub:\n    Type: AWS::SecurityHub::Hub\n    # Critical: Enables Security Hub in this account/Region\n\n  <example_resource_name>Standard:\n    Type: AWS::SecurityHub::Standard\n    Properties:\n      StandardsArn: arn:aws:securityhub:<REGION>::standards/aws-foundational-security-best-practices/v/1.0.0  # Critical: enables a standard so the check passes\n```",
+      "Other": "1. Open the AWS console and go to Security Hub\n2. If prompted (first use): click Enable Security Hub and keep the default standards selected, then choose Enable\n3. If Security Hub is already enabled: go to Security standards and enable AWS Foundational Security Best Practices\n4. Wait for the status to show Enabled",
+      "Terraform": "```hcl\n# Enable Security Hub\nresource \"aws_securityhub_account\" \"<example_resource_name>\" {}\n\n# Critical: Enable at least one standard so the check passes\nresource \"aws_securityhub_standards_subscription\" \"<example_resource_name>_fsbp\" {\n  standards_arn = \"arn:aws:securityhub:<REGION>::standards/aws-foundational-security-best-practices/v/1.0.0\" # Enables AWS FSBP\n}\n```"
     },
     "Recommendation": {
-      "Text": "Security Hub is Regional. When you enable or disable a security standard, it is enabled or disabled only in the current Region or in the Region that you specify.",
-      "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable.html"
+      "Text": "- Enable in all required accounts/Regions\n- Turn on relevant **standards** (`AWS FSBP`, `CIS`)\n- Connect AWS and third-party **integrations**\n- Use **central configuration** and **least privilege**\n- Automate triage and monitor continuously for **defense in depth**",
+      "Url": "https://hub.prowler.com/check/securityhub_enabled"
     }
   },
   "Categories": [],