# GCP Security Command Center Alerts to Lark Notification

This project is a Google Cloud Function that forwards security alerts from Google Cloud Security Command Center (SCC) to Lark (formerly Feishu) via webhook notifications.

## Overview

The function listens for Cloud Events published by SCC findings and transforms them into richly formatted messages sent to a Lark webhook. It parses the security finding details and creates structured notifications with severity indicators, resource information, and remediation recommendations.

## Features

- Receives Cloud Events from Google Cloud Security Command Center
- Parses and formats security findings for better readability
- Sends rich notifications to Lark with color-coded severity levels
- Includes detailed information such as:
  - Finding category and description
  - Severity level (Critical, High, Medium, Low)
  - Affected resource information
  - Analysis and explanation
  - Recommendation for remediation
  - Direct link to the finding in SCC console

## Prerequisites

- Google Cloud Platform account with Security Command Center enabled
- Lark (Feishu) group chat with webhook integration configured
- Go 1.24+
- Google Cloud Functions environment

## Dependencies

- `github.com/GoogleCloudPlatform/functions-framework-go`
- `github.com/cloudevents/sdk-go/v2`

See [go.mod](go.mod) for complete dependency information.

## How It Works

1. SCC publishes findings to a Pub/Sub topic
2. Google Cloud Function is triggered by the Pub/Sub message via Cloud Events
3. The function processes the finding data:
   - Normalizes source properties
   - Parses resource information
   - Extracts explanation and recommendation
4. Constructs a richly formatted message card for Lark
5. Sends the notification to Lark via webhook

## Environment Variables

| Variable | Description | Required |
|----------|-------------|----------|
| `LARK_WEBHOOK_URL` | The webhook URL for your Lark group chat | Yes |

## Installation

1. Clone this repository
2. Set up your Google Cloud Function with the provided code
3. Configure the environment variable `LARK_WEBHOOK_URL` with your Lark webhook URL
4. Deploy the function to Google Cloud Functions

## Deployment

```bash
gcloud functions deploy scc-to-lark-notification \
  --runtime go124 \
  --trigger-topic YOUR_SCC_PUBSUB_TOPIC \
  --set-env-vars LARK_WEBHOOK_URL=https://your-lark-webhook-url
```

## Message Format

Notifications sent to Lark include:
- Color-coded headers based on severity (Red for Critical, Orange for High/Medium, Blue for Low)
- Key information fields (severity, time, project, location)
- Resource details
- Description, analysis, and recommendation
- Action button linking to the SCC console

## Supported Severity Levels

- **Critical**: Red notification (sent)
- **High**: Dark orange notification (sent)
- **Medium**: Orange notification (sent)
- **Low**: Blue notification (filtered out by default)

Note: Low severity alerts are currently filtered out and not sent to Lark to reduce noise.

## Contributing

Feel free to submit issues or pull requests to improve this integration.