diff --git a/functions/notify_slack.py b/functions/notify_slack.py index 4139725..66929a9 100644 --- a/functions/notify_slack.py +++ b/functions/notify_slack.py @@ -139,7 +139,8 @@ def format_aws_security_hub(message: Dict[str, Any], region: str) -> Dict[str, A # Switch Status From New To Notified To Prevent Repeated Messages try: compliance_status = finding["Compliance"].get("Status", "UNKNOWN") - if compliance_status == "FAILED": + workflow_status = finding["Workflow"].get("Status", "UNKNOWN") + if compliance_status == "FAILED" and workflow_status == "NEW": notified = SECURITY_HUB_CLIENT.batch_update_findings( FindingIdentifiers=[{ 'Id': finding.get('Id'),