Aggregate and normalize findings from AWS Security Hub

Steps

1. Enable Security Hub in the aggregator account and enable cross-region aggregation if you want findings from multiple regions consolidated into one region
2. In a multi-account organization, designate an administrator account and use the organization integration to automatically enroll member accounts so their findings are forwarded
3. Call GetFindings with a Filters object to query findings by ProductName, ComplianceStatus, SeverityLabel, WorkflowStatus, and RecordState; combine with SortCriteria for ordered results
4. Paginate results using the NextToken in the response; each page returns up to 100 findings by default
5. Update finding workflow status (NOTIFIED, SUPPRESSED, RESOLVED) via BatchUpdateFindings to reflect investigation state without modifying the original product finding
6. Create Security Hub Insights (saved filter queries) for recurring views like all open critical findings from a specific product, and subscribe an EventBridge rule to the findings import event for automation