Just built a simple webhook to push Anomali high-severity alerts to Slack.

Alright, so we've been running Anomali ThreatStream for a while now, and while the UI is fine for analysts during business hours, the high-severity alerts just weren't getting the attention they needed fast enough, especially off-hours. The built-in notification options felt a bit clunky for our SRE/on-call workflow. I wanted those critical alerts to hit a dedicated Slack channel immediately, with enough context for whoever's on call to start triaging.

I ended up writing a simple Python webhook handler that sits between Anomali and Slack. The core idea is to use Anomali's ability to send alerts via HTTP POST (you can set this up in the Notification Profiles). My service filters for only high-severity stuff, formats a decent Slack message with key fields, and pushes it out. Here's the basic flow and the main chunk of the code.

First, you need to configure Anomali to send alerts to your webhook endpoint. In the Notification Profile, set the Webhook URL to your service's endpoint. The payload comes in as JSON. My service is a simple Flask app, but you could use anything. The key part is parsing Anomali's alert schema and filtering.

```python
from flask import Flask, request, jsonify
import requests
import os

app = Flask(__name__)
SLACK_WEBHOOK_URL = os.environ.get('SLACK_WEBHOOK_URL')
SEVERITY_THRESHOLD = 80 # Anomali's severity score, 80+ is "high"

@app.route('/webhook/anomali', methods=['POST'])
def anomali_webhook():
data = request.json
# Anomali's alert payload structure
alert = data.get('alert', {})
severity = alert.get('severity', 0)

if severity >= SEVERITY_THRESHOLD:
# Extract key info
alert_id = alert.get('id', 'N/A')
title = alert.get('title', 'No Title')
description = alert.get('description', '')[:200]
created = alert.get('created', '')
link = alert.get('link', '#')

slack_payload = {
"blocks": [
{
"type": "header",
"text": {
"type": "plain_text",
"text": f"🚨 Anomali High Severity Alert"
}
},
{
"type": "section",
"fields": [
{
"type": "mrkdwn",
"text": f"*Alert ID:*n{alert_id}"
},
{
"type": "mrkdwn",
"text": f"*Severity:*n{severity}"
}
]
},
{
"type": "section",
"text": {
"type": "plain_text",
"text": f"{title}nn{description}"
}
},
{
"type": "actions",
"elements": [
{
"type": "button",
"text": {
"type": "plain_text",
"text": "Open in Anomali"
},
"url": link
}
]
}
]
}
# Post to Slack
requests.post(SLACK_WEBHOOK_URL, json=slack_payload)
return jsonify({"status": "forwarded"}), 200
else:
return jsonify({"status": "ignored, low severity"}), 200

if __name__ == '__main__':
app.run(host='0.0.0.0', port=5000)
```

Deployment-wise, I just threw this in a Docker container and deployed it as a Kubernetes Deployment behind a Service. Made sure to set the `SLACK_WEBHOOK_URL` as a Secret. The whole thing took maybe an afternoon to get right, including testing with some mocked alert data.

Some gotchas I ran into:
* Anomali's webhook payload structure isn't super well-documented; I had to inspect a few real alerts to get the field mapping right.
* You need to handle authentication on your webhook endpoint, either via a simple token check in the request header (which Anomali can send) or network-level firewalling.
* Make sure your Flask app is production-ready (use gunicorn, proper logging, etc.) – this example is just the bare bones.

Now the on-call gets a clean, actionable Slack message immediately for anything serious, and they can jump straight into the investigation. It's been running solid for a couple of months now. If you've built something similar, curious how you handled deduplication or added more context like related IoCs.