slack

slack copied to clipboard

Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

User wants to receive GHAS webhook events with the payload for secrets, code-scanning and dependabot and have it display in chat.

This will allow security teams to get notified of repo level alerts on repositories that they maybe aren't subscribed to and take remediation steps like rotating a secret or triaging a known security vulnerability.

Describe the solution you'd like A clear and concise description of what you want to happen.

Webhook alerts for GHAS flow into Team/slack -

https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#code_scanning_alert

https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#repository_vulnerability_alert

https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#secret_scanning_alert

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

We shoot these events into other reporting services, there's no need per se to have them in Chat but some users like to use chatops models more than others so this just supports however teams are structured for security response.

Additional context Add any other context or screenshots about the feature request here.

+1 from me, if it bumps priority. Q2 FY23 is rather far...

+1 this is a basic ask of most modern security tools, disappointing to see this feature not already available in GHAS

we also need this since there is no other good way to get security alerts

+1 to this, specifically to get dependabot alerts

ability to subscribe to all security notifications would be great

Any news on this feature ? Would be great to have those secret detection alerts in Slack.

I ended up writing a bash script to parse and post them directly with an api key. Can share if you like.

On Fri, 13 Oct 2023 at 23:12, Ben @.***> wrote:

Any news on this feature ? Would be great to have those secret detection alerts in Slack.

— Reply to this email directly, view it on GitHub https://github.com/integrations/slack/issues/1353#issuecomment-1761414537, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABJWVX4NR2ZB7TMUHOPNUCLX7EV2LANCNFSM5NYM5WQA . You are receiving this because you commented.Message ID: @.***>

@5UP4F15H I'd be interested to see it

Had that issue as well, got it to work using AWS API GW and Lambda https://github.com/liavar1/GHAStoSlack