Log security events as Jira tasks and Notion records

from clickruntime import on_event, credentials, http, notify, state

JIRA, SITE = "https://api.atlassian.com/ex/jira/your-cloud-id", "https://acme.atlassian.net/browse/"
adf = lambda text: {"type": "doc", "version": 1, "content": [{"type": "paragraph", "content": [{"type": "text", "text": text}]}]}

def jira(method, path, **kw):
    resp = http.request(method, JIRA + path, headers={"Authorization": f"Bearer {credentials.connection('jira', 'work')}", "Accept": "application/json"}, **kw)
    return resp.raise_for_status() or (resp.json() if resp.content else None)
def notion(method, path, **kw):
    resp = http.request(method, f"https://api.notion.com/v1{path}", headers={
        "Authorization": f"Bearer {credentials.secret('NOTION_TOKEN')}", "Notion-Version": "2022-06-28"}, **kw)
    return resp.raise_for_status() or resp.json()

LOG = "your-notion-database-id"

@on_event
def handle(event):
    alert = event.json or {}
    seen = state.get("seen") or []
    if alert.get("id") in seen:
        return {"duplicate": True}
    key = jira("POST", "/rest/api/3/issue", json={"fields": {"project": {"key": "SEC"}, "issuetype": {"name": "Task"},
               "summary": f"[{alert.get('severity', 'info')}] {alert.get('title', 'Security event')}"[:250], "description": adf(alert.get("details", ""))}})["key"]
    notion("POST", "/pages", json={"parent": {"database_id": LOG}, "properties": {
        "Name": {"title": [{"text": {"content": alert.get("title", "Security event")}}]}, "Source": {"select": {"name": alert.get("source", "unknown")}},
        "Severity": {"select": {"name": alert.get("severity", "info")}}, "Received": {"date": {"start": event.received_at}}, "Jira": {"url": SITE + key}}})
    notify.slack(f"Security event logged: {alert.get('title')} ({key})", channel="#security")
    state.set("seen", (seen + [alert.get("id")])[-1000:])
    return {"issue": key}