Amazon CloudWatch expanded its security monitoring capabilities by supporting ingestion of AWS Security Hub Cloud Security Posture Management (CSPM) findings directly into CloudWatch Logs using standardized AWS Security Finding Format (ASFF) and Open Cybersecurity Schema Framework (OCSF). This development enables security teams to centrally query, filter, and analyze security alerts and metrics across multiple accounts and regions through CloudWatch Logs Insights and integration with Amazon S3 Tables for enhanced analytics.
With organization-wide enablement rules, customers can automatically route Security Hub findings to CloudWatch Logs for entire organizations or selected accounts, promoting uniform security observability within AWS commercial regions. While AWS claims this integration helps customers identify and respond to threats faster, independent evaluation of operational impact was not specified.
Source & further reading
Amazon CloudWatch now supports ingesting Security Hub CSPM findings with organization-wide enablement ↗Source published 2026-03-31. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.