Automated Container Image Vulnerability Triage and Slack Notifier

This script parses structured JSON vulnerability reports produced by container security tools like Trivy or Grype, isolating critical CVSS issues and formatting alert payloads. Internally, it reads raw scanner file streams, filters CVE arrays by score thresholds and exploit availability, constructs rich JSON schema objects, and sends HTTP POST webhooks to communication channels using Python urllib standard libraries.

Integrating this tool into container build pipelines prevents vulnerable container images from reaching runtime registries. It eliminates manual triage by automatically extracting actionable remediation steps, target package versions, and official fix availability, directly dispatching ticket details to engineering teams.

Storing webhook endpoint URLs directly within source repositories poses a credential leakage hazard; endpoints must always be loaded via runtime environment variables. Large vulnerability lists can trigger rate limiting on destination webhook APIs or exceed payload size restrictions, necessitating payload chunking and filtering. Relying solely on raw CVSS scores without checking EPSS metrics can lead to false urgency on non-exploitable vulnerabilities.

> System.Execute()

import json, urllib.request, os

def process_scan_and_notify(report_path, webhook_url):
    with open(report_path) as f:
        scan_data = json.load(f)
    
    vulnerabilities = []
    for result in scan_data.get("Results", []):
        for vuln in result.get("Vulnerabilities", []):
            if vuln.get("Severity") == "CRITICAL":
                vulnerabilities.append(f"*ID:* {vuln['VulnerabilityID']} | *Pkg:* {vuln['PkgName']} | *Fixed:* {vuln.get('FixedVersion', 'N/A')}")
    
    if vulnerabilities:
        payload = {"text": f":warning: *Critical Vulnerabilities Found:* {len(vulnerabilities)}\n" + "\n".join(vulnerabilities[:10])}
        req = urllib.request.Request(webhook_url, data=json.dumps(payload).encode('utf-8'), headers={'Content-Type': 'application/json'})
        urllib.request.urlopen(req)
        print(f"[+] Alert dispatched. Total Criticals: {len(vulnerabilities)}")

process_scan_and_notify("trivy_report.json", os.environ["SLACK_WEBHOOK_URL"])

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-03AE41F93C96