...

•  A Network Load Balancer (NLB) is deployed in a private subnet of a VPC. The NLB will not be internet-facing.
• An Auto Scaling Group (ASG) is deployed, which is responsible for auto deployment, and scaling of the BH virtual appliance (AMI).
  • Minimum of 1 instance is deployed
  • Maximum is set at 6
  • Running Instances are increased by 1, when Average Network Bytes In exceeds 500 MB in a 10 minute window
  • Running Instances are decreased by 1, when Average Network Bytes In stays below 500 MB in a 10 minute window
  • Running Instance count can never be 0
• Instances are associated with an Instance Profile, which have the following policies attached to them:
  • arn:aws:iam::aws:policy/SecurityAudit
  • arn:aws:iam::aws:policy/ViewOnlyAccess
• The NLB FQDN will be registered as Traffic Mirror Target.

Integrations (SecurityHub and Lambda)

Blue Hexagon can be configured to publish its findings to an AWS SNS topic in your account. A finding received on the topic triggers an AWS Lambda to either:

...