Add AWS SES alert target

matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

https://matano.dev

Apache License 2.0

1.42k stars 98 forks source link

Add AWS SES alert target #145

Closed kai-ten closed 1 year ago

kai-ten commented 1 year ago

I know, email in 2023... Jira is next, just needed a place to start. Initially was going to extend the SNS Alert Forwarder with a Python SES lambda, then thought it may be helpful to build the email pattern at the expense of a little extra dev time.

The integrations/destinations/ses.yml config looks like the following:

name: soc_distro

type: ses
properties:
  from: Matano Alert <source@domain.com>
  to:
    - target1@domain.com
    - target2@domain.com

The resulting email output looks like:

kai-ten commented 1 year ago

Ahh great callout! Let me get that added in tomorrow, took the easy manual route