Opsgenie: Extra Properties (Security hub payload)

[Radzhiv Apasov]

Hello all,

I'm trying to extract information about findings' resources from the "Message" field and present it in a human-readable format. Specifically, I want to retrieve details from the "findings" array, specifically the "Resources" object within it. 

 Link : Integrate Opsgenie with Amazon Security Hub | Opsgenie | Atlassian Support  

I tried  {{_parsedData.findings.substringBetween("Resources=[{","}]") }}

 and I got "Partition=aws, Type=AwsRdsDbCluster, Details={AwsRdsDbCluster={StorageEncrypted=true, ClusterCreateTime=2023-08-22T12:53:42.289Z, ActivityStreamStatus=stopped, HttpEndpointEnabled=false, EngineMode=provisioned, Port=5432, DbClusterResourceId=cluster-fjfjfgfjgfjgf, VpcSecurityGroups=[{Status=active, VpcSecurityGroupId=sg-087086795565858"

so very close, is it any other way to get this as a regular text not json? I actually need only Id within findings-->Resources  or actually info I Provided will work to.

I'm seeking guidance on the correct approach to achieve my goal of making the alert more human-readable and extracting information from the "Message" field's "findings" section. Any assistance or insights you can provide would be greatly appreciated.

[Tejaswi G]

Thank you for reaching out to the Atlassian Community. Unfortunately cannot dot parase the arrays in the payload. We recommend you to further fine-tune your filter condition used in the subsctring function to get the ID from the findings or your can also use the extract function and pass a regex to get the required field. You can refer our documentation for more details.

https://support.atlassian.com/opsgenie/docs/regular-expressions-for-improved-alert-filtering/