Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve the SHARR notification messages to include more relevant info for administrators receiving the events #185

Open
thesuavehog opened this issue Dec 13, 2023 · 2 comments
Labels
enhancement New feature or request triaged Has been triaged by solutions team

Comments

@thesuavehog
Copy link

Is your feature request related to a problem? Please describe.

In a multi-account AWS Organization, when remediating a number of accounts, the notifications that SHARR sends out after remediation is attempted could be much more useful. Information like the Account Alias to help know immediately which account was affected, a link to the Finding so you don't have to copy and paste as much, and the Note from the remediation are all useful things that will save administrators time.

Describe the feature you'd like

Additional properties int he SHARR notifications such as:

  • Account Alias
  • Note that is attached to the Finding when it is remediated
  • The Execution Id from the Remediation so it's clear exactly which workflow this notification was generated by
  • The State of the workflow (SUCCESS | QUEUED | RESOLVED | PENDING | FAILED) so that better filtering on the SNS Topic subscriptions can be applied to reduce the noise from running a large number of remediations
  • A direct link out to the Finding applicable to the specific Notification so you don't have to go copy-pasting and searching for it
@thesuavehog thesuavehog added the enhancement New feature or request label Dec 13, 2023
thesuavehog added a commit to thesuavehog/automated-security-response-on-aws that referenced this issue Dec 13, 2023
@tmekari tmekari added the triaged Has been triaged by solutions team label Dec 18, 2023
@thesuavehog
Copy link
Author

Note: I just noticed that AWS has added the AwsAccountName property into the Finding JSON definition. I am not sure under what conditions this field is added (or not) since it is marked as Optional.

If it is essentially always included, then the changes in the PR for this issue could get updated to default to using that value and skip the aws_api_client.get_connection('organizations').list_accounts() call ... but even in my local fork I have left in the extra call as the fallback when the AwsAccountName is not in the Finding data.

@dadmukta
Copy link
Member

dadmukta commented Feb 7, 2024

Thank you for this request. we will add it to our backlog and consider it in a future release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request triaged Has been triaged by solutions team
Projects
None yet
Development

No branches or pull requests

3 participants