Automate Security Incident Triage with GPT-4o-mini and Gmail Notifications

About

What this workflow does Automatically triages inbound security findings (e.g., from AWS Security Hub via EventBridge → SNS → Webhook), classifies them with an LLM, generates a 3-step remediation plan, and emails a compact incident brief. Pipeline: Webhook → Clean_Finding (normalize) → Classify (LLM) → Plan (LLM) → Gmail (email). You can substitute Microsoft Teams, Slack, etc. Normalizes the incoming finding JSON (title, description, account, resource id/type, updated_at). Uses an LLM to assig