{"id":16272306,"url":"https://github.com/ventz/guardduty-slack-notify","last_synced_at":"2025-09-16T16:32:09.742Z","repository":{"id":70234210,"uuid":"211228333","full_name":"ventz/guardduty-slack-notify","owner":"ventz","description":"Lambda for AWS GuardDuty Slack Notifications","archived":false,"fork":false,"pushed_at":"2022-12-16T13:47:04.000Z","size":1109,"stargazers_count":4,"open_issues_count":1,"forks_count":4,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-09T13:12:57.756Z","etag":null,"topics":["amazon","amazon-web-services","aws-lambda","cloudwatch","guardduty","javascript","logs","nodejs","notifications","security","slack","slack-webhook","sns-topic"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ventz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-09-27T03:25:49.000Z","updated_at":"2023-02-08T14:10:02.000Z","dependencies_parsed_at":"2023-05-11T02:45:21.928Z","dependency_job_id":null,"html_url":"https://github.com/ventz/guardduty-slack-notify","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ventz%2Fguardduty-slack-notify","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ventz%2Fguardduty-slack-notify/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ventz%2Fguardduty-slack-notify/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ventz%2Fguardduty-slack-notify/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ventz","download_url":"https://codeload.github.com/ventz/guardduty-slack-notify/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":233279523,"owners_count":18652172,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amazon","amazon-web-services","aws-lambda","cloudwatch","guardduty","javascript","logs","nodejs","notifications","security","slack","slack-webhook","sns-topic"],"created_at":"2024-10-10T18:17:14.163Z","updated_at":"2025-09-16T16:32:04.249Z","avatar_url":"https://github.com/ventz.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Amazon Lambda for GuardDuty Slack Notifications\n\n/*\n  Copyright (Apache License 2.0): Ventz Petkov\n  Repository: https://github.com/ventz/guardduty-slack-notify\n  Initial Release: 9-15-2019                                                       \n*/\n\nConfigure in 4 easy steps, and make sure to edit Lambda function with\nyour own Slack Incoming Webhook URL.\n\n## Guard Duty\n1.) Enable GuardDuty and configure 5-minute subsequent findings:\n\nNotifications for subsequent finding occurrences – By default, for\nevery finding with a unique finding ID, GuardDuty aggregates all\nsubsequent occurrences of a particular finding that take place in\n6-hour intervals into a single event. GuardDuty then sends a\nnotification about these subsequent occurrences based on this event.\nIn other words, by default, for the subsequent occurrences of the\nexisting findings, GuardDuty sends notifications based on CloudWatch\nevents every 6 hours. You can configure this for: 15 minutes, 1 hour,\nor the default 6 hours. It is recommended to use 15 minutes (via GuardDuty\nConsole -\u003e Settings)!\n\n\n## CloudWatch -\u003e SNS -\u003e Lambda Handler (Slack Notifications)\nYou can enable the next three steps in the Console via point-and-click, or via the CLI:\n\n2.) Enable CloudWatch rule to send events for all GuardDuty findings:\n```\naws events put-rule --name GuardDuty --event-pattern \"{\\\"source\\\":[\\\"aws.guardduty\\\"]}\"\n```\n\n3.) Attach the Lambda function as a target foro the rule:\n```\naws events put-targets --rule GuardDuty --targets Id=1,Arn=arn:aws:lambda:us-east-1:111122223333:function:\u003cyour_function_name\u003e\n```\n\n4.) Add permissions to invoke the target:\n```\naws lambda add-permission --function-name \u003cyour_function\u003e --statement-id 1 --action 'lambda:InvokeFunction' --principal events.amazonaws.com\n```\n\n\n# Useful Documents:\n\n### Examples:\nhttps://docs.aws.amazon.com/guardduty/latest/ug/guardduty_sns.html\n\n### See about format:\nhttps://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html#guardduty_findings_cloudwatch_format\n\n### One example (for EC2):\nhttps://aws.amazon.com/premiumsupport/knowledge-center/guardduty-cloudwatch-sns-rule/\n\n### This is the Full Documentation/JSON explanation:\nhttps://docs.aws.amazon.com/guardduty/latest/ug/guardduty-ug.pdf\n(For CLI Automation of Cloud Watch, SNS, and Lambda)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fventz%2Fguardduty-slack-notify","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fventz%2Fguardduty-slack-notify","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fventz%2Fguardduty-slack-notify/lists"}