Amazon Inspector alert integration

Amazon Inspector sends an Inspector2 Finding event to Amazon EventBridge when it finds a new vulnerability or a finding changes state. The Flashduty AWS EventBridge integration recognizes these events: each finding becomes one alert, and the alert recovers automatically when the status becomes CLOSED or SUPPRESSED. No separate Inspector integration is needed: create an AWS EventBridge integration in Flashduty, then create an EventBridge rule that forwards Inspector events to it.

Configure in AWS

Create an API destination that points to Flashduty in Amazon EventBridge

API destination (recommended)
SNS topic

Where: Amazon EventBridge › Integration › API destinations › Connections › Create connection

Field	Value
Connection name (required)	`Flashduty`
Destination type (required, under Authorization)	`Other`
Authorization type (required)	`API Key`
API key name (required)	`Flashduty`
Value (required)	`{integration_key}`, the `integration_key` in the push URL

Click Create to save.Where: Amazon EventBridge › Integration › API destinations › Create API destination

Field	Value
Name (required)	`Flashduty`
API destination endpoint (required)	`{integration_url}`
HTTP method (required)	`POST`
Connection type (required)	`Use an existing connection`, then select the `Flashduty` connection created above

Click Create to save.

Where: Amazon SNS › Subscriptions › Create subscription (if the topic does not exist yet, go to Topics › Create topic first and set Type to Standard)

Field	Value
Topic ARN (required)	The SNS topic that forwards EventBridge events
Protocol (required)	`HTTPS`
Endpoint (required)	`{integration_url}`, which must be the push URL of this integration

Click Create subscription and wait until the subscription status is Confirmed. Flashduty only visits subscription confirmation URLs on sns.<region>.amazonaws.com, sns.<region>.amazonaws.com.cn and sns.<region>.amazonaws.eu. For the full SNS topic and subscription steps, see the AWS CloudWatch integration.

Create a rule for Inspector events in Amazon EventBridge

Where: Amazon EventBridge › Rules › Create rule › Advanced Builder

Field	Value
Builder (when the console offers a choice)	`Advanced Builder`
Name (required)	A name of your choice, for example `Flashduty-Inspector`
Event bus	`AWS default event bus`
Rule type (required)	`Rule with an event pattern`, then click Next
Event source (required)	`AWS events or EventBridge partner events`
Creation method / Method (required)	`Custom pattern (JSON editor)`
Event pattern (required)	Paste the event pattern below, then click Next
Target type (required)	`EventBridge API destination`, choose `Use an existing API destination` and the `Flashduty` one created in the previous step (for the SNS method choose `AWS service` › `SNS topic` and that topic)
Execution role (required)	`Create a new role for this specific resource`
Input transformer	Do not configure; send the full event

Event pattern:

{
  "source": ["aws.inspector2"],
  "detail-type": ["Inspector2 Finding"]
}

To keep only high-severity findings, filter on severity:

{
  "source": ["aws.inspector2"],
  "detail-type": ["Inspector2 Finding"],
  "detail": {
    "severity": ["HIGH", "CRITICAL"]
  }
}

Do not add "status": ["ACTIVE"] to the pattern. The notification example in the Amazon Inspector documentation uses it to receive only active findings, but it also filters out the CLOSED event sent when a finding is closed, so Flashduty never receives the recovery and the alert cannot recover.

Other Inspector events (Inspector2 Scan, Inspector2 Coverage, Inspector2 AutoEnable) are not findings and should not be forwarded to Flashduty; the detail-type above already excludes them.Inspector emits events to the default event bus of each Region where it is enabled, so create the rule in every such Region.

Send a test Inspector event and confirm

Where: A terminal that can reach the Flashduty push URLThe rule only forwards events that AWS really emits. To verify right away, POST a test event shaped like the real one to the push URL:

curl -X POST '{integration_url}' \
  -H 'Content-Type: application/json' \
  -d '{"version":"0","id":"flashduty-test-1","detail-type":"Inspector2 Finding","source":"aws.inspector2","account":"123456789012","region":"us-east-1","resources":[],"detail":{"findingArn":"arn:aws:inspector2:us-east-1:123456789012:finding/flashduty-test","status":"ACTIVE","severity":"HIGH","type":"PACKAGE_VULNERABILITY","title":"Flashduty integration test","awsAccountId":"123456789012","resources":[{"id":"i-0123456789abcdef0","type":"AWS_EC2_INSTANCE"}]}}'

Send it again with status set to CLOSED to confirm that the alert recovers automatically. A few seconds later, go back to Flashduty. The integration shows a latest event time, which means the setup works.

Field mapping

The mapping below is how Flashduty processes these AWS EventBridge events:

Inspector field	Flashduty
`detail.findingArn`	Alert Key. The ID stays the same when a finding is updated, so later events merge into one alert
`detail.status`	`CLOSED` or `SUPPRESSED` recovers the alert; `ACTIVE` triggers or updates it
`detail.title`	Label `summary` (the alert title is always `aws.inspector2 / Inspector2 Finding`)
`detail.severity`	Label `inspector_severity`; the alert severity is always Warning, and an alert pipeline can rewrite it based on this label
`detail.type`	Label `finding_type` (for example `PACKAGE_VULNERABILITY`, `NETWORK_REACHABILITY`, `CODE_VULNERABILITY`)
`detail.resources[0].id`, `detail.resources[0].type`	Labels `resource`, `resource_type`
`detail.awsAccountId`, `detail.findingArn`, `detail.status`	Labels `aws_account_id`, `finding_arn`, `finding_status`
Event `source`, `region`, `account`, `detail-type`, `detail`, `resources`	Labels `source`, `region`, `account`, `check`, `detail`, `resources`

Recovery and deduplication

Inspector sends another event for the same findingArn when a vulnerability is fixed or a finding changes state. When status is CLOSED (fixed) or SUPPRESSED, Flashduty closes the alert.
If the account is an Inspector delegated administrator, findings of member accounts are also delivered to it; use the label aws_account_id to tell the source account.
If an event lacks detail.findingArn, Flashduty returns HTTP 400.
The detail of code vulnerability findings contains file paths and detector names, which end up in the alert through the detail label.

Troubleshooting

The API destination call fails: confirm the endpoint is the full push URL including integration_key and that HTTP method is POST
Alerts do not recover: check whether the rule’s event pattern filters on status, and whether the target has an Input transformer (the full event must be sent)
Findings from a Region are missing: Inspector only emits events to the event bus of its own Region; create a rule in every Region where Inspector is enabled

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

Amazon Inspector alert integration

In Flashduty On-call

Use a dedicated integration

Use a shared integration

Configure in AWS

Field mapping

Recovery and deduplication

Troubleshooting