Creating a Slack notification when new vulnerabilities are detected

Using the WebSphere Automation Swagger UI, the Slack Block Kit builder, and Mustache syntax, create a process that sends a notification to a webhook that results in a Slack message. The notification contains the details of any new vulnerabilities that WebSphere Automation detects.

Before you begin

If you plan to implement variables or conditional processing, make sure that you are familiar with Mustache syntax External link icon.

Examining the WebSphere Automation resource notification

The expected result of this tutorial is that Slack displays messages with information that is passed from newly created resource notifications in WebSphere Automation. For this tutorial, the resource notification contains the details for the creation of a new vulnerability record when a new vulnerability is detected in a managed server. In the following example resource notification, the value of the type parameter is create; the object that is created is a vulnerability.

{
    "type": "CREATE",
    "vulnerability": {
        "id": "70357d34-411d-3321-a60f-ede653897a55",
        "name": "6557248 : server1@defected1.example.com",
        "description": "Multiple vulnerabilities exist in the Apache Log4j (CVE-2022-23302, CVE-2022-23305, CVE-2022-23307) library used by IBM WebSphere Application Server in the Admin Console and UDDI Registry application. The same Apache library is also used by the IBM WebSphere Application Server Liberty for z/OS in features zosConnect-1.0 and zosConnect-1.2. All vulnerabilities have been addressed previously by removing all existing Apache Log4j versions.",
        "assetId": "1a5d141a-3294-3ff3-9182-5ae1d4f3465d",
        "securityBulletinId": "23c15e59-1ef9-3eb5-a175-0845597cdbc1",
        "resolved": false,
        "cves": [
            {
                "id": "CVE-2022-23302",
                "description": "Apache Log4j could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in JMSSink. By sending specially-crafted JNDI requests using TopicConnectionFactoryBindingName configuration, an attacker could exploit this vulnerability to execute arbitrary code on the system.",
                "cvssBaseScore": 8.8
            },
            {
                "id": "CVE-2022-23305",
                "description": "Apache Log4j is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the JDBCAppender, which could allow the attacker to view, add, modify or delete information in the back-end database.",
                "cvssBaseScore": 6.5
            },
            {
                "id": "CVE-2022-23307",
                "description": "Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the in Apache Chainsaw component. By sending specially-crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.",
                "cvssBaseScore": 9.8
            }
        ],
        "remediations": [
            {
                "startVersion": "9.0.0.0",
                "endVersion": "9.0.5.10",
                "operator": "OR",
                "iFixes": [
                    "PH42762"
                ],
                "fixPack": "9.0.5.11",
                "additionalInstallationInstructions": "https://www.ibm.com/support/pages/node/6557248"
            }
        ],
        "links": {
            "self": {
                "rel": "self",
                "href": "https://cpd-websphere-automation.apps.wsa-412.example.com/vulnerabilities/70357d34-411d-3321-a60f-ede653897a55",
                "type": "application/json",
                "title": "self"
            },
            "asset": {
                "rel": "related",
                "href": "https://cpd-websphere-automation.apps.wsa-412.example.com/assets/1a5d141a-3294-3ff3-9182-5ae1d4f3465d",
                "type": "application/json",
                "title": "asset"
            },
            "securityBulletin": {
                "rel": "related",
                "href": "https://cpd-websphere-automation.apps.wsa-412.example.com/bulletins/23c15e59-1ef9-3eb5-a175-0845597cdbc1",
                "type": "application/json",
                "title": "securityBulletin"
            }
        },
        "created": "2023-05-17T10:10:29Z",
        "createdBy": "vulnerability-manager",
        "updated": "2023-05-17T10:10:29Z",
        "updatedBy": "vulnerability-manager",
        "secondsExposed": 1379
    }
}

Information that is of interest includes the CVE IDs, the CVSS scores, the affected server, the description of the vulnerability, and the URL of the security bulletin.

Defining the process and the expected result

The result is to have a Slack webhook target receive information about new high-severity CVEs, and to display that information in a new Slack message.

  1. Open a web browser to the Slack Block Kit builder.
    https://app.slack.com/block-kit-builder/
  2. Use the block kit builder to construct a message that displays text in the format that you like. This Slack message is constructed using the following example.
    Example Slack message about a vulnerability that is detected in a managed server
    {
	"blocks": [
		{
			"type": "section",
			"text": {
				"type": "mrkdwn",
				"text": ":alert1: WebSphere Automation detected a vulnerability for CVE <https://www.ibm.com/support/pages/node/6525706|CVE-2021-44228> (CVSS base score 10.0) on server *server1* on host *defected1.example.com*."
			}
		},
		{
			"type": "divider"
		},
		{
			"type": "section",
			"text": {
				"type": "mrkdwn",
				"text": "*CVE Information*\nApache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam."
			}
		},
		{
			"type": "divider"
		},
		{
			"type": "actions",
			"elements": [
				{
					"type": "button",
					"text": {
						"type": "plain_text",
						"text": "View Bulletin",
						"emoji": true
					},
					"value": "click_me",
					"url": "https://www.ibm.com/support/pages/node/6525706"
				},
				{
					"type": "button",
					"text": {
						"type": "plain_text",
						"text": "View All server1 CVEs",
						"emoji": true
					},
					"value": "click_me_123",
					"url": "https://cpd-websphere-automation.example.com/websphereauto/websphere/1a5d141a-3294-3ff3-9182-5ae1d4f3465d/vulnerabilities/cves"
				}
			]
		}
	]
}
  3. After you have the Slack message structured correctly, you can substitute variables using Mustache syntax. Make these substitutions for the parameters that you want to send from the WebSphere Automation event.
    {
    "channel": "<your_Slack_channel>",
    "blocks": [
      {
        "type": "header",
        "text": {
          "type": "plain_text",
          "text": "Vulnerability Detected"
        }
      },
      {
        "type": "divider"
      },
      {
        "type": "section",
        "text": {
          "type": "mrkdwn",
          "text": "{{icon}} WebSphere Automation detected a vulnerability for CVE <{{bulletinUrl}}|{{cveId}}> (CVSS base score {{cvssBaseScore}}) on {{#isJdk}}JDK *{{productName}}*{{/isJdk}}{{^isJdk}}server *{{serverName}}*{{/isJdk}} on host *{{hostName}}*."
        }
      },
      {
        "type": "divider"
      },
      {
        "type": "section",
        "text": {
          "type": "mrkdwn",
          "text": "*CVE Information*\n{{{@wsa_eq_cveSummary}}}"
        }
      },
      {
        "type": "actions",
        "elements": [
          {
            "type": "button",
            "text": {
              "type": "plain_text",
              "text": "View Bulletin"
            },
            "value": "click_me",
            "url": "{{bulletinUrl}}"
          }{{^isJdk}},
          {
            "type": "button",
            "text": {
              "type": "plain_text",
              "text": "View All CVEs for {{serverName}}"
            },
            "value": "click_me_123",
            "url": "https://cpd-websphere-automation.example.com/websphereauto/websphere/{{serverId}}/vulnerabilities/cves"
          }
          {{/isJdk}}
        ]
      },
      {
        "type": "divider"
      }
    ]
  }

Setting up the webhook action

Use the WebSphere Automation Swagger UI to create a webhook action. For more information, see creating a webhook action.

In the body parameter, create a comma-separated list of the JSON elements that you created in the Slack Block Kit Builder. Quotation marks in the value of the body parameter must be escaped with the backslash character. Use the Mustache notation (double curly braces) for the variable names that you created.

{
    "id": "74313a6b-a163-4f7d-833b-31bf4f12670a",
    "name": "Vulnerability Slack Notification Action",
    "description": "POSTs a notification to Slack when triggered",
    "type": "webhook",
    "enabled": true,
    "configuration": {
      "targetUrl": "https://hooks.slack.com/services/12345/12345/12345",
      "method": "POST",
      "contentType": "application/json",
      "headers": [],
      "body": "{ \"channel\": \"<your_Slack_channel>\", \"blocks\": [ { \"type\": \"header\", \"text\": { \"type\": \"plain_text\", \"text\": \"Vulnerability Detected\" } }, { \"type\": \"divider\" }, { \"type\": \"section\", \"text\": { \"type\": \"mrkdwn\", \"text\": \"{{icon}} WebSphere Automation detected a vulnerability for CVE <{{bulletinUrl}}|{{cveId}}> (CVSS base score {{cvssBaseScore}}) on {{#isJdk}}JDK *{{productName}}*{{/isJdk}}{{^isJdk}}server *{{serverName}}*{{/isJdk}} on host *{{hostName}}*.\" } }, { \"type\": \"divider\" }, { \"type\": \"section\", \"text\": { \"type\": \"mrkdwn\", \"text\": \"*CVE Information*\\n{{{@wsa_eq_cveSummary}}}\" } }, { \"type\": \"actions\", \"elements\": [ { \"type\": \"button\", \"text\": { \"type\": \"plain_text\", \"text\": \"View Bulletin\" }, \"value\": \"click_me\", \"url\": \"{{bulletinUrl}}\" }{{^isJdk}}, { \"type\": \"button\", \"text\": { \"type\": \"plain_text\", \"text\": \"View All CVEs for {{serverName}}\" }, \"value\": \"click_me_123\", \"url\": \"https://cpd-websphere-automation.example.com/websphereauto/websphere/{{serverId}}/vulnerabilities/cves\" } {{/isJdk}} ] }, { \"type\": \"divider\" } ] }"
    }
}

Testing the webhook action

To test the webhook action, open the WebSphere Automation Swagger UI and use the PATCH /action/{actionId} control to pass hard-coded values to Slack. For more information, see Creating an action.

Enter the action ID into the actionId text field. Use the actionId value that the Swagger UI assigned the action when you created it.

Enter the following JSON code into the Request body field:

{
   "operation": "invoke-action",
   "variables": {
      "hostName": "example.com",
      "cveSummary": "Example CVE summary",
      "bulletinUrl": "https://www.ibm.com/support/pages/node/6525706",
      "cveId": "CVE-2021-44228",
      "icon": ":alert1:",
      "serverName": "server1",
      "cvssBaseScore": "10",
      "isJdk": "false",
      "serverId": "1a5d141a-3294-3ff3-9182-5ae1d4f3465d",
      "productName": "WebSphere Application Server"
   }
}

Click Execute.

Ensure that the server response code has a value of 200. A successful response also has "successful": true in the response body.

Open the Slack channel and confirm that a new message is created.

Creating the resource trigger

Follow instructions to create a resource trigger. Refer to the following example resource trigger.

Set the value of the actionId parameter to the action ID that is assigned to the action by the Swagger UI.

In the variableMappings section, create variables matching those that are defined in the action and incident table. For each variable, create JSONata expressions that evaluate to a booleanhttps://try.jsonata.org/ External link icon or to a value that you want to pass to the webhook.

{
    "id": "46e65c6e-8c9d-4fe9-90fb-ac5ca2303fae",
    "name": "Vulnerability Created Trigger",
    "description": "Triggers the Slack Notification action when a vulnerability with a CVE that has a CVSS base score greater than 9 is created.",
    "actionId": "<your_Slack_Notification_action_id>",
    "type": "resource",
    "enabled": true,
    "configuration": {
      "resourceType": "vulnerability",
      "operation": "create"
    },
    "variableMappings": {
      "hostName": "$asset.hostName",
      "cveSummary": "($maxCvssBaseScore := $max(vulnerability.cves.cvssBaseScore); vulnerability.cves[cvssBaseScore = $maxCvssBaseScore][0].description)",
      "bulletinUrl": "$bulletin.url",
      "cveId": "($maxCvssBaseScore := $max(vulnerability.cves.cvssBaseScore); vulnerability.cves[cvssBaseScore = $maxCvssBaseScore][0].id)",
      "icon": "($maxCvssBaseScore := $max(vulnerability.cves.cvssBaseScore); $maxCvssBaseScore > 0 and $maxCvssBaseScore <= 3.9 ? ':warning:' : ($maxCvssBaseScore >= 4 and $maxCvssBaseScore <= 6.9 ? ':standup_ibm_status_major_warning_orange:' : ($maxCvssBaseScore >= 7 and $maxCvssBaseScore <= 8.9 ? ':ibm-warning-filled:' : ':alert1:')))",
      "serverName": "$asset.serverName",
      "cvssBaseScore": "$number($max(vulnerability.cves.cvssBaseScore))",
      "isJdk": "$asset.type = 'jdk'",
      "serverId": "$asset.id",
      "productName": "$asset.productName"
    }
}

Descriptions for the various JSONata expressions are as follows.

  • cveSummary: The description of the CVE in the resource notification with the highest CVSS score.
  • cveId: The CVE ID for the CVE in the resource notification with the highest CVSS score.
  • icon: An icon that is indicative of the urgency of the CVE with the highest CVSS score; a warning symbol displays for a CVSS score of 3.9 or less, a major warning for 4.0 to 6.9, and an alert for greater than 7.0
  • cvssBaseScore: The highest CVSS score of the CVEs in the resource notification.

The following variables use context variables. For more information, see Trigger resource.

  • isJDK: a boolean that evaluates to true if the CVE is set as affecting the Java Developer Kit.
  • productName: the name of the product with the vulnerability.
  • servername: the name of the server with the vulnerability.
  • hostname: the hostname of the runtime with the vulnerability.
  • bulletinUrl: the URL for the security bulletin for the vulnerability.

Enable the resource trigger by using the Swagger UI to run its JSON code. For more information, see Creating a resource trigger.

What to do next

Now that the resource trigger is enabled, the Slack notification action is only invoked when WebSphere Automation detects a new CVE in a managed asset. If you have recently installed a fix for such a CVE by using the WebSphere Automation UI, you can use WebSphere Automation to uninstall the fix to create the proper conditions. After verifying the proper operation of the Slack notification action, reinstall the fix to obviate the exposure.