We are excited to announce the new Notification capability in Security Advisor.

The lifecycle activities of a typical security and compliance posture management—or any cybersecurity framework—will include detecting threats and responding to those security events.

IBM Cloud Security Advisor is the go-to security console for posture management. You can view and analyse the threats, vulnerabilities, and findings from your security tools in one dashboard with Security Advisor.

We are excited to announce the new Notification capability in Security Advisor to alert security focals on critical findings.

To get started, you can add a notification channel and then configure it to use a webhook URL. Security Advisor notifies you by invoking the actions that you specify in the webhook. For example, you might run playbook to trigger PagerDuty or forward the findings to a SIEM product for further investigation.

Try it out!

Ready to try out notifications for yourself? You can use the sample code that we’ve provided that runs on Node.js, or you can walk through while using your own code.

Create a Cloud Function

A Cloud Function is a piece of code that runs only in response to a trigger, which means that you don’t have to pay for or maintain servers while they’re idle. To get started, go to the Functions dashboard in the IBM Cloud GUI:

  1. Select the Actions tab, click Create, and then click Create new action.
  2. Give the action a name and choose the default.
  3. Select a runtime. If you’re using the sample, select Node.js.
  4. Click Create. Now you’re ready to add code.
  5. Add your own or use the sample code that we’ve provided. 
  6. Retrieve web action URL—click on the action you created in the Actions Page. Retrieve the web action URL by following the Endpoints in the left navigation of the resulting page.

Add a notification channel

Now that you have a Function and a web action URL, you’re ready to connect the action to Security Advisor.

  1. Open your Security Advisor dashboard and select Notification channels from the navigation.
  2. Click Add notification channel and provide a name.
  3. Select Webhook from the Method drop-down.
  4. Enter the web action URL that you obtained from the Cloud Functions UI.
  5. Click Save.

Now, you can see the channel in your notification channel list.

Test the configuration

To ensure that your configuration is set up correctly, click Test connection in the overflow menu of the channel that you created. Security Advisor sends a notification that contains fake data to your Cloud Function. If everything is configured correctly, your Function runs.

From now on, whenever a new finding is received by Security Advisor for your account, a GitHub issue is created or a Slack alert is sent based on the severity of the finding.

Feedback and questions

We’d love to hear your feedback and questions. For technical questions, check out Stack Overflow with the security-advisor and ibm-cloud tags. For non-technical questions, use IBM developerWorks with the security-advisor tag. To get started for free, see the IBM Cloud Security Dashboard.


More from Announcements

IBM TechXchange underscores the importance of AI skilling and partner innovation

3 min read - Generative AI and large language models are poised to impact how we all access and use information. But as organizations race to adopt these new technologies for business, it requires a global ecosystem of partners with industry expertise to identify the right enterprise use-cases for AI and the technical skills to implement the technology. During TechXchange, IBM's premier technical learning event in Las Vegas last week, IBM Partner Plus members including our Strategic Partners, resellers, software vendors, distributors and service…

Introducing Inspiring Voices, a podcast exploring the impactful journeys of great leaders

< 1 min read - Learning about other people's careers, life challenges, and successes is a true source of inspiration that can impact our own ambitions as well as life and business choices in great ways. Brought to you by the Executive Search and Integration team at IBM, the Inspiring Voices podcast will showcase great leaders, taking you inside their personal stories about life, career choices and how to make an impact. In this first episode, host David Jones, Executive Search Lead at IBM, brings…

IBM watsonx Assistant and NICE CXone combine capabilities for a new chapter in CCaaS

5 min read - In an age of instant everything, ensuring a positive customer experience has become a top priority for enterprises. When one third of customers (32%) say they will walk away from a brand they love after just one bad experience (source: PWC), organizations are now applying massive investments to this experience, particularly with their live agents and contact centers.  For many enterprises, that investment includes modernizing their call centers by moving to cloud-based Contact Center as a Service (CCaaS) platforms. CCaaS solutions…

See what’s new in SingleStoreDB with IBM 8.0

3 min read - Despite decades of progress in database systems, builders have compromised on at least one of the following: speed, reliability, or ease. They have two options: one, they could get a document database that is fast and easy, but can’t be relied on for mission-critical transactional applications. Or two, they could rely on a cloud data warehouse that is easy to set up, but only allows lagging analytics. Even then, each solution lacks something, forcing builders to deploy other databases for…