Skip to content

v1.0.0

Choose a tag to compare

View all tags
@sgtoj sgtoj released this 03 Nov 18:16
· 6 commits to main since this release
v1.0.0
e2f5650
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

1.0.0 (2025-11-03)

Initial release of the AWS Security Hub v2 Slack integration bot.

Overview

AWS Lambda function that sends Security Hub v2 findings to Slack via EventBridge. Centralizes security alerts from GuardDuty, Inspector, Macie, IAM Access Analyzer, and Security Hub CSPM using the OCSF format.

Key Features

  • ✅ Multi-service support (GuardDuty, Inspector, Macie, IAM Access Analyzer, Security Hub CSPM)
  • ✅ OCSF native format for Security Hub v2
  • ✅ Rich Slack messages with severity, category, resource details, and remediation links
  • ✅ EventBridge integration with severity filtering
  • ✅ Federated access support (IAM Identity Center)
  • ✅ Configurable via environment variables

Quick Start

# Build Lambda
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -C cmd/lambda -o dist/bootstrap

# Deploy to AWS Lambda with required env vars:
# - APP_SLACK_TOKEN
# - APP_SLACK_CHANNEL

# Create EventBridge rule targeting the Lambda function

Requirements

  • AWS Security Hub v2 (not compatible with original Security Hub CSPM)
  • Slack workspace with bot token (chat:write scope)
  • Go 1.24+ (for building from source)

Documentation

See README.md for full deployment instructions.

Note: This is for Security Hub v2 only. It uses OCSF format and is NOT backwards compatible with the original AWS Security Hub (ASFF format).

Assets 2
Loading