AWS Security Hub Adds CSV and JSON Findings Export to Amazon S3
AWS Security Hub can now export findings to Amazon S3 in CSV or OCSF JSON for audit reporting and security analysis.
AWS announced on October 9, 2026 that Security Hub findings can be exported to Amazon S3 as CSV or JSON using the Open Cybersecurity Schema Framework.
Exports can be initiated from findings pages including Threats, Exposure, Vulnerabilities, Posture Management, Sensitive Data and All Findings.
CSV supports manual review and spreadsheet-based reporting. Exported security data may be sensitive and should have appropriate sharing and retention controls.
OCSF JSON provides a structured format that may simplify ingestion by downstream analytics systems, although schema compatibility should still be tested.
Administrators can export selected findings to an S3 bucket in their account. Access permissions, encryption and lifecycle settings remain important.
An exported snapshot can support audit evidence, but it does not automatically reflect later changes in the underlying findings. Record the capture date and scope.
AWS says the feature is available in all regions where Security Hub is supported, subject to normal account and permission requirements.
This release improves reporting and analysis workflows rather than introducing a new detection engine.