We needed a way to automatically open Jira tickets for critical cloud resource misconfigurations found by InsightCloudSec. The built-in alerting wasn't enough; we require a formal tracking ticket for any high-severity finding (public S3 buckets, unencrypted RDS, security groups with 0.0.0.0/0).
Built a webhook integration that parses InsightCloudSec findings and creates tickets via the Jira API. The key was filtering noise and ensuring the ticket contains all context needed for remediation.
Core components of our Lambda function (Python):
```python
def lambda_handler(event, context):
# Parse webhook payload from InsightCloudSec
finding = json.loads(event['body'])
# Filter for HIGH/CRITICAL severity only
if finding['severity'] not in ['HIGH', 'CRITICAL']:
return
# Map to Jira fields
ticket_data = {
"fields": {
"project": {"key": "CLDSEC"},
"summary": f"{finding['resource_name']} - {finding['finding_type']}",
"description": f"Resource: {finding['resource_id']}nAccount: {finding['cloud_account']}nn{finding['description']}",
"issuetype": {"name": "Bug"},
"priority": {"name": "High"}
}
}
# Post to Jira API
requests.post(JIRA_URL, json=ticket_data, auth=(JIRA_USER, JIRA_API_KEY))
```
Results:
* Reduced time from detection to ticket creation from ~4 hours (manual process) to under 2 minutes.
* Ensures 100% of critical findings enter our ticketing system; no more missed alerts.
* Added mandatory fields (cloud account ID, resource ARN) to prevent back-and-forth with engineers.
Main pitfall: Initially triggered on *all* findings, overwhelming the team. The severity filter is mandatory.
- Patched.