# AWS Security Hub发送Slack告警通知

## 创建custom action发送findings到Slack

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FtQukah9xNwlHJILDKv9l%2Fimage.png?alt=media&#x26;token=67b6415f-9420-463d-943e-8e36a7059a7d" alt=""><figcaption></figcaption></figure>

跟着workshop中 [4.2 Create a custom action to send findings to Slack](https://catalog.us-east-1.prod.workshops.aws/workshops/adccbda9-ceaf-47a8-843b-cf231281b635/en-US/module4/4-2-slack-integration)。其中注意，在EventBridge创建规则的时候：

A - 事件类型选&#x62E9;**“Security Hub Findings - Custom Action”**，表示是<mark style="color:red;">**手动触发**</mark>的，需要在控制台勾选指定的告警，然后选择这个操作才会触发event，特定的自定义操作ARN填写刚才创建好的自定义操作ARN。

B - 事件类型选&#x62E9;**"Security Hub Findings - Imported"**， 表示当有新的findings出现会<mark style="color:red;">**自动触发**</mark>事件，可以根据自己的需要配置筛选条件，比如过滤合规状态，威胁等级，Findings的产品来源如GuardDuty等。

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FB9zZkpGdJwpgNtdhR7am%2FScreenshot%202023-05-18%20at%2012.56.20.png?alt=media&#x26;token=732d0747-ad20-4f44-8c17-b570faa4ac4e" alt=""><figcaption></figcaption></figure>

## 参考资料

\[Github] [Alerting AWS Security Hub Findings](https://github.com/lorenzocampo/alerting-securityhub-findings)

[Security Hub Workshop](https://catalog.us-east-1.prod.workshops.aws/workshops/adccbda9-ceaf-47a8-843b-cf231281b635/en-US) - [4.2 Create a custom action to send findings to Slack](https://catalog.us-east-1.prod.workshops.aws/workshops/adccbda9-ceaf-47a8-843b-cf231281b635/en-US/module4/4-2-slack-integration)
