Turn security alerts into Jira tickets and Slack messages

from slack_sdk import WebClient
from slack_sdk.errors import SlackApiError
from clickruntime import on_event, credentials, http, notify, state

JIRA, SITE = "https://api.atlassian.com/ex/jira/your-cloud-id", "https://acme.atlassian.net/browse/"
adf = lambda text: {"type": "doc", "version": 1, "content": [{"type": "paragraph", "content": [{"type": "text", "text": text}]}]}

def jira(method, path, **kw):
    resp = http.request(method, JIRA + path, headers={"Authorization": f"Bearer {credentials.connection('jira', 'work')}", "Accept": "application/json"}, **kw)
    return resp.raise_for_status() or (resp.json() if resp.content else None)

@on_event
def handle(event):
    alert = event.json or {}
    done = state.get("alerts") or {}
    if alert.get("id") in done:
        return {"issue": done[alert["id"]], "duplicate": True}
    issue = jira("POST", "/rest/api/3/issue", json={"fields": {"project": {"key": "SEC"}, "issuetype": {"name": "Task"},
                 "summary": f"[{alert.get('severity', 'alert')}] {alert.get('title', 'Security alert')}"[:250], "labels": ["security-alert"],
                 "description": adf(f"{alert.get('description', '')}\nUser: {alert.get('user_email', '-')}\nSource: {alert.get('source', '-')}")}})
    notify.slack(f"Security alert {alert.get('title')} ({alert.get('user_email', 'no user')}) <{SITE}{issue['key']}|{issue['key']}>", channel="#security")
    if alert.get("user_email"):
        slack = WebClient(token=credentials.connection("slack", "work"))
        try:
            uid = slack.users_lookupByEmail(email=alert["user_email"])["user"]["id"]
            slack.chat_postMessage(channel=uid, text=f"Hi, our security tools noticed: {alert.get('title')}. Was this you? Please reply in #security.")
        except SlackApiError:
            notify.slack(f"Could not find {alert['user_email']} in Slack for {issue['key']}", channel="#security")
    done[alert.get("id")] = issue["key"]
    state.set("alerts", done)
    return {"issue": issue["key"]}