What happened
AWS Security Hub now lets you export findings to Amazon S3 as CSV or as JSON in the Open Cybersecurity Schema Framework (OCSF) format. You start the export on demand from any findings page in the console, such as Threats, Vulnerabilities or Posture Management, and Security Hub writes the result to a bucket in your account. It is available in every Region where Security Hub is available.
Why it matters
Many small teams end up needing findings outside the console. An auditor asks for evidence, a customer questionnaire wants a list of open issues, or a manager wants to see the numbers in a spreadsheet. Until now the usual answer was a script or pipeline that someone wrote once and nobody wanted to maintain. AWS says this export removes the need to build that extraction yourself.
CSV suits people who want to filter and share findings in a spreadsheet. OCSF JSON suits teams that want to load findings into other tooling and keep a consistent schema.
There are still things to think about. An export is a copy of sensitive data: findings can reveal weak spots in your setup. Once it lands in S3, the bucket’s access rules, encryption and retention matter as much as the data. The source describes an on-demand export from the console, so check the user guide for whether and how you can automate it before you plan a recurring process.
What to do this week
- Decide who actually needs findings outside the console, and for what: audit evidence, customer reviews, or internal reporting.
- Create or pick a dedicated S3 bucket for exports. Block public access, turn on encryption and limit who can read it.
- Set a lifecycle rule so old exports do not sit there indefinitely.
- Try one export in each format and see which one your auditors or tools can use without extra conversion.
- Read the Security Hub user guide section on findings export and note any limits that affect your use case.
Need a hand?
If you want help turning Security Hub output into audit evidence that holds up, or tidying the buckets and permissions around it, our Security & Compliance work covers exactly this. The first call is free and it is with an engineer, not a salesperson.
Source: AWS Security Hub now exports findings to S3 in CSV or JSON format
Related service: Security & Compliance