in EC2 Auto Clean Room Forensics/Lambda-Functions/sendIsolationNotification.py [0:0]
def formatMyMessage(instanceID, targetGroupArn):
slack_message = {
"attachments": [
{
"fallback": "Required plain-text summary of the attachment.",
"color": "#b7121a",
"title": "High Alert!! \n Security Incident detected \n Instance Isolated due to security incident detected by guard duty from ALB : " + instanceID ,
"text": "",
"fields":[{
"value": "Next Steps : " + '\n 1. Snapshot of the volume will be created \n 2. Snapshot will be mounted into volume for Forsensic Analysis \n 3. New Forensic Instance will be created and the volume will be mounted for forensic analysis \n 4. Forensic report will sent to security channel'
},
{
"value": "Instance under isolation: " + instanceID
},
{
"value": "TargetGroup ARN where instance is drained from : " + targetGroupArn
}]
}
]
}
return slack_message