first commit
This commit is contained in:
commit
731bbfd13b
2
.env
Executable file
2
.env
Executable file
@ -0,0 +1,2 @@
|
||||
DISCORD_WEBHOOK=https://discord.com/api/webhooks/1233074098939232286/zc-9n4LsTxSSMjg3aSUmvvAfne1Jqs-IqOA6G4ZUi1zluvmK2NOmCaO1u8KjaQ1PovVB
|
||||
|
||||
169
custom-active-response.py
Executable file
169
custom-active-response.py
Executable file
@ -0,0 +1,169 @@
|
||||
#!/usr/bin/python3
|
||||
# Copyright (C) 2015-2022, Wazuh Inc.
|
||||
# All rights reserved.
|
||||
|
||||
# This program is free software; you can redistribute it
|
||||
# and/or modify it under the terms of the GNU General Public
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
|
||||
import os
|
||||
import sys
|
||||
import json
|
||||
import datetime
|
||||
from pathlib import PureWindowsPath, PurePosixPath
|
||||
|
||||
if os.name == 'nt':
|
||||
LOG_FILE = "C:\\Program Files (x86)\\ossec-agent\\active-response\\active-responses.log"
|
||||
else:
|
||||
LOG_FILE = "/var/ossec/logs/active-responses.log"
|
||||
|
||||
ADD_COMMAND = 0
|
||||
DELETE_COMMAND = 1
|
||||
CONTINUE_COMMAND = 2
|
||||
ABORT_COMMAND = 3
|
||||
|
||||
OS_SUCCESS = 0
|
||||
OS_INVALID = -1
|
||||
|
||||
class message:
|
||||
def __init__(self):
|
||||
self.alert = ""
|
||||
self.command = 0
|
||||
|
||||
|
||||
def write_debug_file(ar_name, msg):
|
||||
with open(LOG_FILE, mode="a") as log_file:
|
||||
ar_name_posix = str(PurePosixPath(PureWindowsPath(ar_name[ar_name.find("active-response"):])))
|
||||
log_file.write(str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')) + " " + ar_name_posix + ": " + msg +"\n")
|
||||
|
||||
|
||||
def setup_and_check_message(argv):
|
||||
|
||||
# get alert from stdin
|
||||
input_str = ""
|
||||
for line in sys.stdin:
|
||||
input_str = line
|
||||
break
|
||||
|
||||
write_debug_file(argv[0], input_str)
|
||||
|
||||
try:
|
||||
data = json.loads(input_str)
|
||||
except ValueError:
|
||||
write_debug_file(argv[0], 'Decoding JSON has failed, invalid input format')
|
||||
message.command = OS_INVALID
|
||||
return message
|
||||
|
||||
message.alert = data
|
||||
|
||||
command = data.get("command")
|
||||
|
||||
if command == "add":
|
||||
message.command = ADD_COMMAND
|
||||
elif command == "delete":
|
||||
message.command = DELETE_COMMAND
|
||||
else:
|
||||
message.command = OS_INVALID
|
||||
write_debug_file(argv[0], 'Not valid command: ' + command)
|
||||
|
||||
return message
|
||||
|
||||
|
||||
def send_keys_and_check_message(argv, keys):
|
||||
|
||||
# build and send message with keys
|
||||
keys_msg = json.dumps({"version": 1,"origin":{"name": argv[0],"module":"active-response"},"command":"check_keys","parameters":{"keys":keys}})
|
||||
|
||||
write_debug_file(argv[0], keys_msg)
|
||||
|
||||
print(keys_msg)
|
||||
sys.stdout.flush()
|
||||
|
||||
# read the response of previous message
|
||||
input_str = ""
|
||||
while True:
|
||||
line = sys.stdin.readline()
|
||||
if line:
|
||||
input_str = line
|
||||
break
|
||||
|
||||
write_debug_file(argv[0], input_str)
|
||||
|
||||
try:
|
||||
data = json.loads(input_str)
|
||||
except ValueError:
|
||||
write_debug_file(argv[0], 'Decoding JSON has failed, invalid input format')
|
||||
return message
|
||||
|
||||
action = data.get("command")
|
||||
|
||||
if "continue" == action:
|
||||
ret = CONTINUE_COMMAND
|
||||
elif "abort" == action:
|
||||
ret = ABORT_COMMAND
|
||||
else:
|
||||
ret = OS_INVALID
|
||||
write_debug_file(argv[0], "Invalid value of 'command'")
|
||||
|
||||
return ret
|
||||
|
||||
|
||||
def main(argv):
|
||||
|
||||
write_debug_file(argv[0], "Started")
|
||||
|
||||
# validate json and get command
|
||||
msg = setup_and_check_message(argv)
|
||||
|
||||
if msg.command < 0:
|
||||
sys.exit(OS_INVALID)
|
||||
|
||||
if msg.command == ADD_COMMAND:
|
||||
|
||||
""" Start Custom Key
|
||||
At this point, it is necessary to select the keys from the alert and add them into the keys array.
|
||||
"""
|
||||
|
||||
alert = msg.alert["parameters"]["alert"]
|
||||
keys = [alert["rule"]["id"]]
|
||||
|
||||
""" End Custom Key """
|
||||
|
||||
action = send_keys_and_check_message(argv, keys)
|
||||
|
||||
# if necessary, abort execution
|
||||
if action != CONTINUE_COMMAND:
|
||||
|
||||
if action == ABORT_COMMAND:
|
||||
write_debug_file(argv[0], "Aborted")
|
||||
sys.exit(OS_SUCCESS)
|
||||
else:
|
||||
write_debug_file(argv[0], "Invalid command")
|
||||
sys.exit(OS_INVALID)
|
||||
|
||||
""" Start Custom Action Add """
|
||||
|
||||
with open("ar-test-result.txt", mode="a") as test_file:
|
||||
test_file.write("Active response triggered by rule ID: <" + str(keys) + ">\n")
|
||||
|
||||
""" End Custom Action Add """
|
||||
|
||||
elif msg.command == DELETE_COMMAND:
|
||||
|
||||
""" Start Custom Action Delete """
|
||||
|
||||
os.remove("ar-test-result.txt")
|
||||
|
||||
""" End Custom Action Delete """
|
||||
|
||||
else:
|
||||
write_debug_file(argv[0], "Invalid command")
|
||||
|
||||
write_debug_file(argv[0], "Ended")
|
||||
|
||||
sys.exit(OS_SUCCESS)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main(sys.argv)
|
||||
144
wazuh-discord-notifier.py
Executable file
144
wazuh-discord-notifier.py
Executable file
@ -0,0 +1,144 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# This script is free software.
|
||||
#
|
||||
# Copyright (C) 2024, Rudi Klein.
|
||||
# All rights reserved.
|
||||
#
|
||||
# This program is free software; you can redistribute it
|
||||
# and/or modify it under the terms of the GNU General Public
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
#
|
||||
# This script is executed by the active response script (custom-active-response.py), which is triggered by rules firing.
|
||||
#
|
||||
# Discord is a voice, video and text communication service used by over a hundred million people to hang out and talk
|
||||
# with their friends and communities. It allows for receiving message using webhooks.
|
||||
# For more information: https://discord.com.
|
||||
|
||||
import requests
|
||||
import getopt
|
||||
import sys
|
||||
import os
|
||||
from dotenv import load_dotenv
|
||||
from os import getenv
|
||||
from os.path import join, dirname
|
||||
|
||||
from wazuh_notifier_lib import set_env as se
|
||||
from wazuh_notifier_lib import set_time as st
|
||||
from wazuh_notifier_lib import import_config as ic
|
||||
from wazuh_notifier_lib import view_config as vc
|
||||
|
||||
# Get path values
|
||||
wazuh_path, ar_path, config_path = se()
|
||||
|
||||
# Get time value
|
||||
now_message, now_logging = st()
|
||||
|
||||
# Retrieve webhook from .env
|
||||
try:
|
||||
dotenv_path = join(dirname(__file__), '.env')
|
||||
load_dotenv(dotenv_path)
|
||||
if not os.path.isfile(dotenv_path): raise Exception(dotenv_path, "file not found")
|
||||
discord_webhook = os.getenv("DISCORD_WEBHOOK")
|
||||
|
||||
|
||||
except Exception as err:
|
||||
# output error, and return with an error code
|
||||
print(str(Exception(err.args)))
|
||||
exit(err)
|
||||
|
||||
# the POST builder. Prepares https and sends the request.
|
||||
|
||||
|
||||
def discord_command(n_server, n_sender, n_destination, n_priority, n_message, n_tags, n_click):
|
||||
|
||||
x_message = (now_message +
|
||||
"\n\n" + "**__" + n_message + "__**\n\n" +
|
||||
"Priority: " + n_priority + "\n" +
|
||||
"Tags: " + n_tags + "\n\n" + n_click
|
||||
)
|
||||
n_data = {"username": n_sender,"embeds": [{"description": x_message, "title": n_destination}]}
|
||||
|
||||
result = requests.post(n_server, json=n_data)
|
||||
|
||||
|
||||
# Remove 1st argument from the list of command line arguments
|
||||
argument_list: list = sys.argv[1:]
|
||||
|
||||
# Short options
|
||||
options: str = "u:s:p:m:t:c:hv"
|
||||
|
||||
# Long options
|
||||
long_options: list = ["server=", "sender=", "destination=", "priority=", "message=", "tags=", "click=", "help", "view"]
|
||||
|
||||
# Setting some basic defaults.
|
||||
d_sender: str = "Security message"
|
||||
d_destination: str = "WAZUH (IDS)"
|
||||
d_priority: str = "5"
|
||||
d_message: str = "Test message"
|
||||
d_tags: str = "informational, testing, hard-code"
|
||||
d_click: str = "https://google.com"
|
||||
|
||||
# Use the values from the config yaml if available. Overrides the basic defaults.
|
||||
server = discord_webhook
|
||||
sender = d_sender if (ic("discord_sender") is None) else ic("discord_sender")
|
||||
destination = d_destination if (ic("discord_destination") is None) else ic("discord_destination")
|
||||
priority = d_priority if (ic("discord_priority") is None) else ic("discord_priority")
|
||||
message = d_message if (ic("discord_message") is None) else ic("discord_message")
|
||||
tags = d_tags if (ic("discord_tags") is None) else ic("discord_tags")
|
||||
click = d_click if (ic("discord_click") is None) else ic("discord_click")
|
||||
|
||||
help_text: str = """
|
||||
-u, --server is the webhook URL of the Discord server. It is stored in .env.
|
||||
-s, --sender is the sender of the message, either an app name or a person. The default is "Security message".
|
||||
-d, --destination is the destination (actually the originator) of the message, either an app name or a person. Default is "Wazuh (IDS)"
|
||||
-p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.
|
||||
-m, --message is the text of the message to be sent. Default is "Test message", but may include --tags and/or --click.
|
||||
-t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded".
|
||||
-c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.
|
||||
-h, --help shows this help message. Must have no value argument.
|
||||
-v, --view show config.
|
||||
"""
|
||||
|
||||
# Get params during execution. Params found here, override minimal defaults and/or config settings.
|
||||
try:
|
||||
# Parsing argument
|
||||
arguments, values = getopt.getopt(argument_list, options, long_options)
|
||||
|
||||
# checking each argument
|
||||
for current_argument, current_value in arguments:
|
||||
|
||||
if current_argument in ("-h", "--help"):
|
||||
print(help_text)
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-v", "--view"):
|
||||
vc()
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-s", "--sender"):
|
||||
sender = current_value
|
||||
|
||||
elif current_argument in ("-d", "--destination"):
|
||||
destination = current_value
|
||||
|
||||
elif current_argument in ("-p", "--priority"):
|
||||
priority = current_value
|
||||
|
||||
elif current_argument in ("-m", "--message"):
|
||||
message = current_value
|
||||
|
||||
elif current_argument in ("-t", "--tags"):
|
||||
tags = current_value
|
||||
|
||||
elif current_argument in ("-c", "--click"):
|
||||
click = current_value
|
||||
|
||||
except getopt.error as err:
|
||||
# output error, and return with an error code
|
||||
print(str(err))
|
||||
|
||||
# Finally, execute the POST request
|
||||
discord_command(discord_webhook, sender, destination, priority, message, tags, click)
|
||||
|
||||
66
wazuh-notifier-config.yaml
Executable file
66
wazuh-notifier-config.yaml
Executable file
@ -0,0 +1,66 @@
|
||||
---
|
||||
#start of yaml
|
||||
|
||||
# This is the yaml config file for both the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py.
|
||||
# The yaml needs to be in the same folder as the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py
|
||||
|
||||
# COMMON configuration settings start here.
|
||||
# 1 = messages will be sent through this message server. 0 = messages will NOT be sent through this message server.
|
||||
|
||||
discord_enabled: 1
|
||||
ntfy_enabled: 1
|
||||
|
||||
# COMMON configuration settings start here.
|
||||
|
||||
|
||||
# NTFY configuration settings start here.
|
||||
# The default values refer to the hard-coded defaults, if no yaml configuration is found.
|
||||
#
|
||||
# -u, --server is the URL of the NTFY server, ending with a "/". Default is https://ntfy.sh/.
|
||||
# -s, --sender is the sender of the message, either an app name or a person. Default is "Wazuh (IDS)".
|
||||
# -d, --destination is the NTFY subscription, to send the message to. Default is none.
|
||||
# -p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.
|
||||
# -m, --message is the text of the message to be sent. Default is "Test message".
|
||||
# -t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded".
|
||||
# -c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.
|
||||
# -h, --help shows this help message. Must have no value argument.
|
||||
# -v, --view show config.
|
||||
|
||||
ntfy_server: "https://ntfy.sh/"
|
||||
ntfy_sender: "Wazuh (IDS)"
|
||||
ntfy_destination: "none"
|
||||
ntfy_priority: "5"
|
||||
ntfy_message: "Test message"
|
||||
ntfy_tags: "information, testing, yaml"
|
||||
ntfy_click: "https://google.com"
|
||||
|
||||
# NTFY configuration settings ends here.
|
||||
|
||||
# DISCORD configuration settings start here.
|
||||
# The default values refer to the hard-coded defaults, if no yaml configuration is found.
|
||||
|
||||
# -u, --server is the webhook URL of the Discord server. It is stored in .env.
|
||||
# -s, --sender is the sender of the message, either an app name or a person. The default is "Security message".
|
||||
# -d, --destination is the destination (actually the originator) of the message, either an app name or a person. Default is "Wazuh (IDS)"
|
||||
# -p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.
|
||||
# -m, --message is the text of the message to be sent. Default is "Test message", but may include --tags and/or --click.
|
||||
# -t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded".
|
||||
# -c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.
|
||||
# -h, --help shows this help message. Must have no value argument.
|
||||
# -v, --view show config.
|
||||
|
||||
discord_server: "not used. The webhook (server) is a secret stored in .env"
|
||||
discord_sender: "Security message"
|
||||
discord_destination: "WAZUH (IDS)"
|
||||
discord_priority: "5"
|
||||
discord_message: "Test message"
|
||||
discord_tags: "informational, testing, yaml"
|
||||
discord_click: "https://google.com"
|
||||
|
||||
# DISCORD configuration settings ends here.
|
||||
|
||||
#end of yaml
|
||||
...
|
||||
|
||||
|
||||
|
||||
132
wazuh-ntfy-notifier.py
Executable file
132
wazuh-ntfy-notifier.py
Executable file
@ -0,0 +1,132 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# This script is free software.
|
||||
#
|
||||
# Copyright (C) 2024, Rudi Klein.
|
||||
# All rights reserved.
|
||||
#
|
||||
# This program is free software; you can redistribute it
|
||||
# and/or modify it under the terms of the GNU General Public
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
#
|
||||
# This script is executed by the active response script (custom-active-response.py), which is triggered by rules firing.
|
||||
#
|
||||
# ntfy (pronounced notify) is a simple HTTP-based pub-sub notification service.
|
||||
# It allows you to send notifications to your phone or desktop via scripts from any computer, and/or using a REST API.
|
||||
# It's infinitely flexible, and 100% free software. For more information: https://ntfy.sh.
|
||||
|
||||
import json
|
||||
import requests
|
||||
import getopt
|
||||
import sys
|
||||
|
||||
from wazuh_notifier_lib import set_env as se
|
||||
from wazuh_notifier_lib import set_time as st
|
||||
from wazuh_notifier_lib import import_config as ic
|
||||
from wazuh_notifier_lib import view_config as vc
|
||||
|
||||
# Get path values
|
||||
wazuh_path, ar_path, config_path = se()
|
||||
|
||||
# Get time value
|
||||
now_message, now_logging = st()
|
||||
|
||||
# the POST builder
|
||||
|
||||
|
||||
def ntfy_command(n_server, n_sender, n_destination, n_priority, n_message, n_tags, n_click):
|
||||
n_header = ""
|
||||
if n_sender != "": n_header = n_header + '"Title"' + ": " + '"' + n_sender + '"' + ", "
|
||||
if n_tags != "": n_header = n_header + '"Tags"' + ": " + '"' + n_tags + '"' + ", "
|
||||
if n_click != "": n_header = n_header + '"Click"' + ": " + '"' + n_click + '"' + ", "
|
||||
if n_priority != "": n_header = n_header + '"Priority"' + ": " + '"' + n_priority + '"'
|
||||
n_header = json.loads("{" + n_header + "}")
|
||||
x_message = now_message + "\n\n" + n_message
|
||||
|
||||
# todo POST the request **** NEEDS future TRY ****
|
||||
requests.post(n_server + n_destination, data=x_message, headers=n_header)
|
||||
|
||||
# Remove 1st argument from the list of command line arguments
|
||||
argument_list = sys.argv[1:]
|
||||
|
||||
# Short options
|
||||
options: str = "u:s:d:p:m:t:c:hv"
|
||||
|
||||
# Long options
|
||||
long_options: list = ["server=", "sender=", "destination=", "priority=", "message=", "tags=", "click", "help", "view"]
|
||||
|
||||
# Setting some minimal defaults in case the yaml config isn't available
|
||||
d_server: str = "https://ntfy.sh/"
|
||||
d_sender: str = "Security message"
|
||||
d_destination: str = "phil_alerts"
|
||||
d_priority: str = "5"
|
||||
d_message: str = "Test message"
|
||||
d_tags: str = "informational, testing, hard-coded"
|
||||
d_click: str = "https://google.com"
|
||||
|
||||
# Use the values from the config yaml if available. Overrides the minimal defaults.
|
||||
server = d_server if (ic("ntfy_server") is None) else ic("ntfy_server")
|
||||
sender = d_sender if (ic("ntfy_sender") is None) else ic("ntfy_sender")
|
||||
destination = d_destination if (ic("ntfy_destination") is None) else ic("ntfy_destination")
|
||||
priority = d_priority if (ic("ntfy_priority") is None) else ic("ntfy_priority")
|
||||
message = d_message if (ic("ntfy_message") is None) else ic("ntfy_message")
|
||||
tags = d_tags if (ic("ntfy_tags") is None) else ic("ntfy_tags")
|
||||
click = d_click if (ic("ntfy_click") is None) else ic("ntfy_click")
|
||||
|
||||
help_text: str = """
|
||||
-u, --server is the URL of the NTFY server, ending with a "/". Default is https://ntfy.sh/.
|
||||
-s, --sender is the sender of the message, either an app name or a person. Default is "Wazuh (IDS)".
|
||||
-d, --destination is the NTFY subscription, to send the message to. Default is none.
|
||||
-p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.
|
||||
-m, --message is the text of the message to be sent. Default is "Test message".
|
||||
-t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded".
|
||||
-c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.
|
||||
-h, --help shows this help message. Must have no value argument.
|
||||
-v, --view show config.
|
||||
"""
|
||||
|
||||
# Get params during execution. Params found here, override minimal defaults and/or config settings.
|
||||
try:
|
||||
# Parsing argument
|
||||
arguments, values = getopt.getopt(argument_list, options, long_options)
|
||||
|
||||
# Checking each argument
|
||||
for current_argument, current_value in arguments:
|
||||
|
||||
if current_argument in ("-h", "--help"):
|
||||
print(help_text)
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-v", "--view"):
|
||||
vc()
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-u", "--server"):
|
||||
server = current_value
|
||||
|
||||
elif current_argument in ("-s", "--sender"):
|
||||
sender = current_value
|
||||
|
||||
elif current_argument in ("-d", "--destination"):
|
||||
destination = current_value
|
||||
|
||||
elif current_argument in ("-p", "--priority"):
|
||||
priority = current_value
|
||||
|
||||
elif current_argument in ("-m", "--message"):
|
||||
message = current_value
|
||||
|
||||
elif current_argument in ("-t", "--tags"):
|
||||
tags = current_value
|
||||
|
||||
elif current_argument in ("-c", "--click"):
|
||||
click = current_value
|
||||
|
||||
except getopt.error as err:
|
||||
# output error, and return with an error code
|
||||
print(str(err))
|
||||
|
||||
# Finally, execute the POST request
|
||||
ntfy_command(server, sender, destination, priority, message, tags, click)
|
||||
|
||||
63
wazuh_notifier_lib.py
Executable file
63
wazuh_notifier_lib.py
Executable file
@ -0,0 +1,63 @@
|
||||
import os
|
||||
import time
|
||||
import yaml
|
||||
from dotenv import load_dotenv
|
||||
|
||||
|
||||
# Set structured timestamp.
|
||||
|
||||
|
||||
def set_time():
|
||||
now_message = time.strftime('%a, %d %b %Y %H:%M:%S')
|
||||
now_logging = time.strftime('%Y/%m/%d %H:%M:%S')
|
||||
return now_message, now_logging
|
||||
|
||||
# Define paths
|
||||
|
||||
|
||||
def set_env():
|
||||
|
||||
wazuh_path = os.path.abspath(os.path.join(__file__, "../../.."))
|
||||
ar_path = '{0}/logs/active-responses.log'.format(wazuh_path)
|
||||
config_path = 'wazuh-notifier-config.yaml'.format(wazuh_path)
|
||||
|
||||
return wazuh_path, ar_path, config_path
|
||||
|
||||
|
||||
def import_config(key):
|
||||
try:
|
||||
_, _, config_path = set_env()
|
||||
|
||||
with open(config_path, 'r') as ntfier_config:
|
||||
config: dict = yaml.safe_load(ntfier_config)
|
||||
value: str = config.get(key)
|
||||
return value
|
||||
except (FileNotFoundError, PermissionError, OSError):
|
||||
return None
|
||||
|
||||
|
||||
# Showing yaml config
|
||||
|
||||
def view_config():
|
||||
|
||||
_, _, config_path = set_env()
|
||||
|
||||
try:
|
||||
with open(config_path, 'r') as ntfier_config:
|
||||
print(ntfier_config.read())
|
||||
except (FileNotFoundError, PermissionError, OSError):
|
||||
print(config_path + " does not exist or is not accessible")
|
||||
return
|
||||
|
||||
|
||||
# Logging the Wazuh active Response request
|
||||
|
||||
|
||||
def ar_log():
|
||||
now = set_time()
|
||||
_, ar_path, _ = set_env()
|
||||
msg = '{0} {1} {2}'.format(now, os.path.realpath(__file__), 'Post JSON Alert')
|
||||
f = open(ar_path, 'a')
|
||||
f.write(msg + '\n')
|
||||
f.close()
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user