Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Opsgenie: Extra Properties (Security hub payload)

Radzhiv Apasov August 22, 2023

Hello all,

I'm trying to extract information about findings' resources from the "Message" field and present it in a human-readable format. Specifically, I want to retrieve details from the "findings" array, specifically the "Resources" object within it. 

security hub.JPG

 Link : Integrate Opsgenie with Amazon Security Hub | Opsgenie | Atlassian Support  


I tried  {{_parsedData.findings.substringBetween("Resources=[{","}]") }}

 and I got "Partition=aws, Type=AwsRdsDbCluster, Details={AwsRdsDbCluster={StorageEncrypted=true, ClusterCreateTime=2023-08-22T12:53:42.289Z, ActivityStreamStatus=stopped, HttpEndpointEnabled=false, EngineMode=provisioned, Port=5432, DbClusterResourceId=cluster-fjfjfgfjgfjgf, VpcSecurityGroups=[{Status=active, VpcSecurityGroupId=sg-087086795565858"

so very close, is it any other way to get this as a regular text not json? I actually need only Id within findings-->Resources  or actually info I Provided will work to.


I'm seeking guidance on the correct approach to achieve my goal of making the alert more human-readable and extracting information from the "Message" field's "findings" section. Any assistance or insights you can provide would be greatly appreciated.

1 answer

0 votes
Tejaswi G
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
August 24, 2023

Thank you for reaching out to the Atlassian Community. Unfortunately cannot dot parase the arrays in the payload. We recommend you to further fine-tune your filter condition used in the subsctring function to get the ID from the findings or your can also use the extract function and pass a regex to get the required field. You can refer our documentation for more details.

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events