aws-solutions / automated-security-response-on-aws

Automated Security Response on AWS is an add-on solution that works with AWS Security Hub to provide a ready-to-deploy architecture and a library of automated playbooks. The solution makes it easier for AWS Security Hub customers to resolve common security findings and to improve their security posture in AWS.
https://aws.amazon.com/solutions/implementations/aws-security-hub-automated-response-and-remediation/
Apache License 2.0
359 stars 102 forks source link

Improve the SHARR notification messages to include more relevant info for administrators receiving the events #185

Open thesuavehog opened 7 months ago

thesuavehog commented 7 months ago

Is your feature request related to a problem? Please describe.

In a multi-account AWS Organization, when remediating a number of accounts, the notifications that SHARR sends out after remediation is attempted could be much more useful. Information like the Account Alias to help know immediately which account was affected, a link to the Finding so you don't have to copy and paste as much, and the Note from the remediation are all useful things that will save administrators time.

Describe the feature you'd like

Additional properties int he SHARR notifications such as:

thesuavehog commented 7 months ago

Note: I just noticed that AWS has added the AwsAccountName property into the Finding JSON definition. I am not sure under what conditions this field is added (or not) since it is marked as Optional.

If it is essentially always included, then the changes in the PR for this issue could get updated to default to using that value and skip the aws_api_client.get_connection('organizations').list_accounts() call ... but even in my local fork I have left in the extra call as the fallback when the AwsAccountName is not in the Finding data.

dadmukta commented 5 months ago

Thank you for this request. we will add it to our backlog and consider it in a future release.