{"id":29777393,"url":"https://github.com/cruxstack/aws-guardduty-slack-integration-go","last_synced_at":"2025-07-27T11:04:33.068Z","repository":{"id":303827262,"uuid":"1016839377","full_name":"cruxstack/aws-guardduty-slack-integration-go","owner":"cruxstack","description":null,"archived":false,"fork":false,"pushed_at":"2025-07-09T16:07:23.000Z","size":0,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-09T16:52:02.612Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cruxstack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-09T15:50:12.000Z","updated_at":"2025-07-09T16:07:26.000Z","dependencies_parsed_at":"2025-07-09T17:03:27.827Z","dependency_job_id":null,"html_url":"https://github.com/cruxstack/aws-guardduty-slack-integration-go","commit_stats":null,"previous_names":["cruxstack/aws-guardduty-integration-slack"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/cruxstack/aws-guardduty-slack-integration-go","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Faws-guardduty-slack-integration-go","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Faws-guardduty-slack-integration-go/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Faws-guardduty-slack-integration-go/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Faws-guardduty-slack-integration-go/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cruxstack","download_url":"https://codeload.github.com/cruxstack/aws-guardduty-slack-integration-go/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Faws-guardduty-slack-integration-go/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267347334,"owners_count":24072656,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-27T02:00:11.917Z","response_time":82,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-07-27T11:04:32.300Z","updated_at":"2025-07-27T11:04:33.062Z","avatar_url":"https://github.com/cruxstack.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-guardduty-integration-slack\n\nAWS Lambda function that listens to **Amazon GuardDuty** findings via **Amazon\nEventBridge** and publishes clean, threaded messages to Slack. Ideal when you\nneed near-real-time alerts that SOC teams can triage directly inside Slack\nwithout extra tooling.\n\n## Features\n\n* **native eventbridge trigger** – GuardDuty events invoke the function directly\n* **rich slack threads** – each finding opens a thread with severity, region,\n  account and a “view in console” button\n* **severity awareness** – low/medium/high/critical color-coding follows AWS\n  docs\n* **config-driven** – all behavior controlled by environment variables\n\n---\n\n## Deployment\n\n### Prerequisites\n\n* AWS account with GuardDuty enabled in at least one region\n* Slack App with a Bot Token (`chat:write` scope) installed in your workspace\n* Go ≥ 1.24\n* AWS CLI configured for the deployment account\n\n### Steps\n\n```bash\ngit clone https://github.com/cruxstack/aws-guardduty-integration-slack.git\ncd aws-guardduty-integration-slack\n\n# build static Linux binary for lambda\nGOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o bootstrap\n\n# package\nzip deployment.zip bootstrap\n```\n\n## Required Environment Variables\n\n| name                  | example                                    | purpose                                                      |\n| --------------------- | ------------------------------------------ | ------------------------------------------------------------ |\n| `APP_SLACK_TOKEN`     | `xoxb-…`                                   | slack bot token (store in secrets manager)                   |\n| `APP_SLACK_CHANNEL`   | `C000XXXXXXX`                              | channel id to post findings                                  |\n| `APP_AWS_CONSOLE_URL` | `https://us-east-1.console.aws.amazon.com` | base console url (optional; defaults to region-specific uri) |\n| `APP_DEBUG_ENABLED`   | `true`                                     | verbose logging \u0026 event dump                                 |\n\n## Create Lambda Function\n\n1. **IAM role**\n   * `AWSLambdaBasicExecutionRole` managed policy\n   * no additional AWS API permissions are required\n2. **Lambda config**\n   * Runtime: `al2023provided.al2023` (provided.al2 also works)\n   * Handler: `bootstrap`\n   * Architecture: `x86_64` or `arm64`\n   * Upload `deployment.zip`\n   * Set environment variables above\n3. **EventBridge rule**\n   ```json\n   {\n     \"source\": [\"aws.guardduty\"],\n     \"detail-type\": [\"GuardDuty Finding\"]\n   }\n   ```\n   Target: the Lambda function.\n4. **Slack App**\n   * Add `chat:write` and `chat:write.public`\n   * Custom bot avatar: upload GuardDuty logo in the Slack App *App Icon*\n     section.\n\n\n## Local Developemnt\n\n### Test with Samples\n\n```bash\ncp .env.example .env # edit the values\ngo run .\n```\n\nThe sample runner replays `fixtures/samples.json` and posts to Slack exactly as\nthe live Lambda would.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcruxstack%2Faws-guardduty-slack-integration-go","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcruxstack%2Faws-guardduty-slack-integration-go","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcruxstack%2Faws-guardduty-slack-integration-go/lists"}