v1.1.1

1.1.1 (2025-11-22)

Bug Fixes

• remove unneeded comment (46eef00)

v1.1.0

1.1.0 (2025-11-19)

Features

• include finding id in slack message (204ed31)

Bug Fixes

• build shv2 console urls (d2fb852)

v1.0.1

1.0.1 (2025-11-05)

Bug Fixes

• update eventbridge filter for securityhub v2 events (26da4ca)

v1.0.0

1.0.0 (2025-11-03)

Initial release of the AWS Security Hub v2 Slack integration bot.

Overview

AWS Lambda function that sends Security Hub v2 findings to Slack via EventBridge. Centralizes security alerts from GuardDuty, Inspector, Macie, IAM Access Analyzer, and Security Hub CSPM using the OCSF format.

Key Features

• ✅ Multi-service support (GuardDuty, Inspector, Macie, IAM Access Analyzer, Security Hub CSPM)
• ✅ OCSF native format for Security Hub v2
• ✅ Rich Slack messages with severity, category, resource details, and remediation links
• ✅ EventBridge integration with severity filtering
• ✅ Federated access support (IAM Identity Center)
• ✅ Configurable via environment variables

Quick Start

# Build Lambda
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -C cmd/lambda -o dist/bootstrap

# Deploy to AWS Lambda with required env vars:
# - APP_SLACK_TOKEN
# - APP_SLACK_CHANNEL

# Create EventBridge rule targeting the Lambda function

Requirements

• AWS Security Hub v2 (not compatible with original Security Hub CSPM)
• Slack workspace with bot token (chat:write scope)
• Go 1.24+ (for building from source)

Documentation

See README.md for full deployment instructions.

---

Note: This is for Security Hub v2 only. It uses OCSF format and is NOT backwards compatible with the original AWS Security Hub (ASFF format).

v0.1.1

0.1.1 (2025-11-03)

Development

• add ci workflow to lint and test (69632d0)

v0.1.0

0.1.0 (2025-11-03)