Consider adding requestParameters
to aws_rule_context()
helper
#1401
Labels
enhancement
New feature or request
requestParameters
to aws_rule_context()
helper
#1401
Problem
When an alert from an AWS detection rule is sent to a destination, the alert context does not include
requestParameters
, which contains critical details relevant to the AWS alert and subsequent incident response.Proposed Enhancement
The
requestParameters
can be added to theaws_rule_context()
helper helper function, like:def aws_rule_context(event: dict): return { "eventName": event.get("eventName", "<MISSING_EVENT_NAME>"), "eventSource": event.get("eventSource", "<MISSING_ACCOUNT_ID>"), "awsRegion": event.get("awsRegion", "<MISSING_AWS_REGION>"), "recipientAccountId": event.get("recipientAccountId", "<MISSING_ACCOUNT_ID>"), + "requestParameters": event.get("requestParameters", "<MISSING_REQUEST_PARAMETERS>"), "sourceIPAddress": event.get("sourceIPAddress", "<MISSING_SOURCE_IP>"), "userAgent": event.get("userAgent", "<MISSING_USER_AGENT>"), "userIdentity": event.get("userIdentity", "<MISSING_USER_IDENTITY>"), }
Workaround
The workaround would be to clone the managed rule, just to extend the
alert_context()
, like:But this approach has a few notable downsides:
Not sure if there is another workaround available that achieves the desired outcome without these downsides.
Happy to submit a Pull Request if the proposed solution is acceptable.
The text was updated successfully, but these errors were encountered: