title: Integrate security hub findings with slack using python lambda
body: <p>I am trying to integrate AWS security hub findings with slack using python lambda function. For this I am following the github code written in node.js - <a href="https://github.com/aws-samples/aws-security-hub-workshop/blob/master/lambda/sechub-to-slack.js" rel="nofollow noreferrer">https://github.com/aws-samples/aws-security-hub-workshop/blob/master/lambda/sechub-to-slack.js</a>
  By referring above code, I am trying to develop same lambda function using python3.8 (To be honest not having that much expertise in python) but I'm getting attribute error as below;</p>
  <p>AttributeError -&gt;</p>
  <pre><code>Response
  {
    &quot;errorMessage&quot;: &quot;'dict' object has no attribute 'detail'&quot;,
    &quot;errorType&quot;: &quot;AttributeError&quot;,
    &quot;requestId&quot;: &quot;d9412001-715f-46b7-b8a7-3c9aa5a522a8&quot;,
    &quot;stackTrace&quot;: [
      &quot;  File \&quot;/var/task/lambda_function.py\&quot;, line 103, in lambda_handler\n    processEvent(event)\n&quot;,
      &quot;  File \&quot;/var/task/lambda_function.py\&quot;, line 23, in processEvent\n    finding = event.detail.findings[0].Types[0]\n&quot;
    ]
  }
  </code></pre>
  <p>Code -&gt;</p>
  <pre><code>import json
  import urllib
  from urllib.parse import urlparse, parse_qs, urlencode
  from urllib.request import Request, urlopen
  
  webhook_url = &quot;https://hooks.slack.com/services/******&quot;
  slack_channel = &quot;project-lambda&quot;
  
  def postMessage(message):
  
      body = json.dumps(message).encode('utf-8')
      headers = {'Content-Type': 'application/json'}
      req = urllib.request.Request(webhook_url, body, headers)
      resp = urllib.request.urlopen(req)
      
      response = resp.read()
      print (response)
      
  def processEvent(event):
      #message = event
      consoleUrl = &quot;https://console.aws.amazon.com/securityhub&quot;
      finding = event.detail.findings[0].Types[0]
      findingDescription = event.detail.findings[0].Description
      findingTime = event.detail.findings[0].UpdatedAt
      # findingTimeEpoch = math.floor(new Date(findingTime) / 1000)
      findingTitle = event.detail.findings[0].Title
      account = event.detail.findings[0].AwsAccountId
      region = event.detail.findings[0].Resources[0].Region
      type = event.detail.findings[0].Resources[0].Type
      resourceId = event.detail.findings[0].Resources[0].Id
      messageId = event.detail.findings[0].Resources[0].Id
      # lastSeen = &quot;&lt;!date^${findingTimeEpoch}^{date} at {time} | ${findingTime}&gt;&quot;
      color = &quot;#7CD197&quot;
      severity = &quot;&quot;
      if 1 &lt;= event.detail.findings[0].Severity.Normalized and event.detail.findings[0].Severity.Normalized &lt;= 39:
          severity = 'LOW'
          color = '#879596'
      elif 40 &lt;= event.detail.findings[0].Severity.Normalized and event.detail.findings[0].Severity.Normalized &lt;= 69:
          severity = 'MEDIUM'
          color = '#ed7211'
      elif 70 &lt;= event.detail.findings[0].Severity.Normalized and event.detail.findings[0].Severity.Normalized &lt;= 89:
          severity = 'HIGH'
          color = '#ed7211'
      elif 90 &lt;= event.detail.findings[0].Severity.Normalized and event.detail.findings[0].Severity.Normalized &lt;= 100:
          severity = 'CRITICAL'
          color = '#ff0209'
      else:
          severity = 'INFORMATIONAL'
          color = '#007cbc'
      attachment = [{
          &quot;fallback&quot;: finding + &quot; - {consoleUrl}/home?region=&quot; + &quot;{region}#/findings?search=id%3D{messageId}&quot;,
          &quot;pretext&quot;: &quot;*AWS SecurityHub finding in {region} for Account: {account}*&quot;,
          &quot;title&quot;: finding,
          &quot;title_link&quot;: &quot;{consoleUrl}/home?region={region}#/research&quot;,
          &quot;text&quot;: findingDescription,
          &quot;fields&quot;: [{
              &quot;title&quot;: &quot;Title&quot;,
              &quot;value&quot;: findingTitle,
              &quot;short&quot;: True
          },
              {
                  &quot;title&quot;: &quot;Severity&quot;,
                  &quot;value&quot;: severity,
                  &quot;short&quot;: True
          },
              {
                  &quot;title&quot;: &quot;Region&quot;,
                  &quot;value&quot;: region,
                  &quot;short&quot;: True
          },
              {
                  &quot;title&quot;: &quot;Resource Type&quot;,
                  &quot;value&quot;: type,
                  &quot;short&quot;: True
          },
              {
                  &quot;title&quot;: &quot;Resource ID&quot;,
                  &quot;value&quot;: resourceId,
                  &quot;short&quot;: True
          },
              {
                  &quot;title&quot;: &quot;Last Seen&quot;,
                  &quot;value&quot;: None,
                  &quot;short&quot;: True
          }
          ],
          &quot;mrkdwn_in&quot;: [&quot;pretext&quot;],
          &quot;color&quot;: color
      }]
      slackMessage = {
          &quot;channel&quot;: slack_channel,
          &quot;text&quot;: &quot;&quot;,
          &quot;attachments&quot;: attachment,
          &quot;username&quot;: 'SecurityHub',
          &quot;mrkdwn&quot;: True,
          &quot;icon_url&quot;: 'https://raw.githubusercontent.com/aws-samples/amazon-securityhub-to-slack/master/images/gd_logo.png'
      }
  
      postMessage(slackMessage)
  
  def lambda_handler(event, context):
      processEvent(event)
  </code></pre>
  <p>Am I missing something in event handler?</p>