Features
Real-time AWS security monitoring, without the noise
bearhug streams Security Hub and GuardDuty findings from your accounts as they happen. When a new critical or high-severity issue appears, you receive an email that explains it in plain English, so you can act in minutes instead of discovering it at your next audit.
Production Account · 31 March 2026
A real-time alert email, written in plain English.
How real-time alerts work
When you connect an AWS account, bearhug sets up an Amazon EventBridge rule that sends Security Hub and GuardDuty findings to bearhug as they are raised. There is nothing to poll and no nightly scan to wait for. New findings appear in your dashboard as AWS reports them.
When a new critical or high-severity finding appears, bearhug sends an email alert that explains the issue in plain English and links straight to the finding. Lower-severity findings are still tracked in the dashboard, so your inbox only hears about the issues that need attention now.
Setting up AWS security alerts yourself
You can build basic alerting with AWS services alone. Create an Amazon SNS topic with an email subscription, and click the confirmation link SNS sends, because nothing is delivered until the subscription is confirmed. Then create an Amazon EventBridge rule that matches Security Hub CSPM findings by severity and sends them to the topic. When both services are enabled, GuardDuty findings also flow into Security Hub CSPM, so one rule can cover both:
{"source": ["aws.securityhub"], "detail-type": ["Security Hub Findings - Imported"], "detail": {"findings": {"Severity": {"Label": ["CRITICAL", "HIGH"]}}}}The rule fires when findings are updated as well as when they are new, the emails contain the raw finding JSON, and unless you use cross-Region aggregation you need a rule in every Region you use, so most teams add filtering and formatting before relying on it. See EventBridge for Security Hub CSPM. bearhug sets this up during onboarding and sends the alert in plain English instead.
What bearhug monitors
bearhug builds on AWS-native detection. AWS Security Hub checks your configuration against security best-practice controls, which catches misconfigurations such as public S3 buckets or unrestricted security groups. Amazon GuardDuty watches for threats and unusual behaviour, such as unexpected access to your data.
bearhug brings both sources together in one dashboard, explains every finding and alerts you to the ones that matter most.
Because findings stream in continuously, bearhug also catches the changes that happen between audits: a security group opened for a quick test and never closed, or a bucket policy changed during a busy release. Those are the issues that usually go unnoticed until a customer or an auditor finds them.
Why teams use real-time alerts
Act in minutes, not months
Hear about a new critical issue as soon as AWS reports it, rather than months later during an audit or a customer security review.
Alerts without the noise
Only new critical and high-severity findings trigger an email. Everything else waits in the dashboard until you are ready for it.
Explained in the email itself
Each alert explains what happened and why it matters in plain English, so whoever reads it can decide what to do next.
Real-time alert questions
A new critical or high-severity finding from AWS Security Hub or Amazon GuardDuty in one of your connected AWS accounts.
No. Medium, low and informational findings are tracked in the dashboard without sending an email, so alerts stay focused on the issues that need attention now.
No. The CloudFormation stack you deploy during onboarding creates the Amazon EventBridge rule that sends findings to bearhug.
Create an Amazon EventBridge rule that matches Security Hub CSPM findings with a critical or high severity label, and send them to an Amazon SNS topic with an email subscription, confirming the subscription from the email SNS sends. GuardDuty findings flow into Security Hub CSPM, so one rule can cover both. Without cross-Region aggregation you need a rule in each Region, and the emails contain raw finding JSON.
Explore more bearhug features
Start monitoring your AWS accounts in real time
Connect your AWS account in under five minutes, and bearhug streams findings to you as Security Hub and GuardDuty raise them. 14-day free trial. The paid plan is $100 per AWS account per month.
No credit card. No procurement. Starts from your AWS console.