Vision One's API is decent, but their webhook-to-Slack setup docs are a snooze-fest. Had to cobble together a proper bridge script that actually formats alerts usefully. The default JSON payload is... verbose.
Here's the meat of it. Runs in a pod as a simple Python service. Filters out the noise and slaps a priority tag on critical stuff.
```python
# visionone-slack-bridge.py
import os
import json
from flask import Flask, request
import requests
from datetime import datetime
app = Flask(__name__)
SLACK_WEBHOOK = os.environ['SLACK_WEBHOOK']
def parse_alert(v1_data):
# Extract the bits we actually care about
severity = v1_data.get('severity', 'medium').upper()
title = v1_data.get('ruleName', 'No Title')
account = v1_data.get('accountName', 'N/A')
time = v1_data.get('createdDateTime', datetime.utcnow().isoformat())
# Build a clean Slack block
blocks = [
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": f"*{title}*\n• Account: `{account}`\n• Severity: `{severity}`\n• Time: {time}"
}
}
]
return {"blocks": blocks}, severity
@app.route('/webhook', methods=['POST'])
def webhook():
data = request.json
slack_msg, severity = parse_alert(data)
requests.post(SLACK_WEBHOOK, json=slack_msg)
return '', 200
if __name__ == '__main__':
app.run(host='0.0.0.0', port=8080)
```
Deploy it with a simple K8s manifest or Helm chart. Now the on-call doesn't hate me. Pro tip: add a filter to ignore low-sev policy warnings unless they're from prod. Cuts the chatter by 70%.