Cloud security integration

Verified exposure intelligence in AWS Security Hub

LeakData maps eligible findings to ASFF, assumes a least-privilege customer role with a unique External ID, and sends no monitored email, breach name, password, exposed value, or raw record.

Status
Customer-private connector; AWS catalog listing is pending.
LeakData access
Enterprise with SIEM integration access.
Provider
Security Hub enabled in the target account and Region; permission to deploy the setup stack.
Configure connector AWS partner guide

ASFF-ready connector

01

A narrow, auditable delivery path

  1. 01

    Verify ownership

    Only active personal email monitors are eligible, and only when the address is ownership-verified (account or dedicated email verification) or belongs to one of your verified domains.

  2. 02

    Recheck evidence

    Every source must remain verified and at or above the configured threshold before each delivery or retry.

  3. 03

    Minimize payload

    LeakData replaces identity and internal monitor IDs with a stable opaque reference and sends generic counts only.

  4. 04

    Import with temporary access

    A 15-minute STS session calls only BatchImportFindings in the selected customer account and Region.

Sent to Security Hub

  • ASFF schema version, stable finding ID, and timestamps
  • Opaque monitor reference and verified source count
  • Configured source threshold and privacy boundary metadata
  • Informational or low provider severity without claiming active compromise

Never sent

  • Monitored email address or user identity
  • Breach, leak, or source name
  • Password, hash, exposed value, or raw record
  • Domain-level, family, social, or ineligible monitor data
02

Customer-controlled setup

  1. 1

    Enable AWS Security Hub in the target account and Region.

  2. 2

    Prepare the connector in LeakData and download the generated CloudFormation template.

  3. 3

    Deploy the stack in the exact account and Region shown in LeakData.

  4. 4

    Return to LeakData and run connection verification before findings are enabled.

Integration status

The connector supports the customer-private Security Hub product ARN for controlled custom-provider use. A public LeakData product ARN and AWS Integrations catalog listing are enabled only after AWS partner approval; this page does not claim that approval has already been granted.