From e75f857739a9a7ffd80012a65bea0cf57103ab13 Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 12:35:18 +0200 Subject: [PATCH 01/17] fixed --- wazuh-notify-go/.env | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 wazuh-notify-go/.env diff --git a/wazuh-notify-go/.env b/wazuh-notify-go/.env deleted file mode 100644 index cecf3fc..0000000 --- a/wazuh-notify-go/.env +++ /dev/null @@ -1,2 +0,0 @@ -DISCORD_URL=https://discord.com/api/webhooks/1237526475306176572/kHGnaQiM8qWOfdLIN1LWqgq3dsfqiHtsfs-Z5FralJNdX5hdw-MOPf4zzIDiFVjcIat4 -NTFY_URL=https://ntfy.sh/__KleinTest \ No newline at end of file From 0f612598c0c28e3f874085bc5e5bdd1cd61b5dae Mon Sep 17 00:00:00 2001 From: Rudi Klein Date: Mon, 27 May 2024 12:40:39 +0200 Subject: [PATCH 02/17] Tomli branch --- wazuh-notify-config.toml | 79 ++++++++++++++++++++++ wazuh-notify-python/wazuh-notify.py | 2 +- wazuh-notify-python/wazuh_notify_module.py | 58 ++++++++-------- 3 files changed, 109 insertions(+), 30 deletions(-) create mode 100644 wazuh-notify-config.toml diff --git a/wazuh-notify-config.toml b/wazuh-notify-config.toml new file mode 100644 index 0000000..ef0c386 --- /dev/null +++ b/wazuh-notify-config.toml @@ -0,0 +1,79 @@ +############################################################################################################# +# This is the TOML config file for wazuh-notify (active response) for both the Python and Go implementation # +############################################################################################################# + +[general] +# Platforms in this string with comma seperated values are triggered. +targets = "slack, ntfy, discord" + +# Platforms in this string will enable sending the full event information. +full_alert = "" + +# Exclude rule events that are enabled in the ossec.conf active response definition. +# These settings provide an easier way to disable events from firing the notifiers. +excluded_rules = "99999, 00000" +excluded_agents = "99999" + +# The next 2 settings are used to add information to the messages. +sender = "Wazuh (IDS)" +click = "https://documentation.wazuh.com/" + +# Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) +# https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html +# Enter threat_map as lists of integers, mention_threshold as integer and color as Hex integer +[[priority_map]] +threat_map = [15, 14, 13, 12] +mention_threshold = 1 +color = 0xec3e40 # Red, SEVERE + +[[priority_map]] +threat_map = [11, 10, 9] +mention_threshold = 1 +color = 0xff9b2b # Orange, HIGH + +[[priority_map]] +threat_map = [8, 7, 6] +mention_threshold = 5 +color = 0xf5d800 # Yellow, ELEVATED + +[[priority_map]] +threat_map = [5, 4] +mention_threshold = 20 +color = 0x377fc7 # Blue, GUARDED + +[[priority_map]] +threat_map = [3, 2, 1, 0] +mention_threshold = 20 +color = 0x01a465 # Green, LOW + +################ End of priority mapping ################################## + +# Following parameter defines the markdown characters to emphasise the parameter names in the notification messages +[markdown_emphasis] +slack = "*" +ntfy = "**" +discord = "**" + +################################################################################## +# From here on the settings are ONLY used by the Python version of wazuh-notify. # +################################################################################## + +[python] + +# The next settings are used for testing and troubleshooting. + +# Test mode will add the example event in wazuh-notify-test-event.json instead of the message received through wazuh. +# This enables testing for particular events when the test event is customized. +test_mode = true + +# Enabling this parameter provides more logging to the wazuh-notifier log. +extended_logging = 2 + +# Enabling this parameter provides extended logging to the console. +extended_print = 2 + +# Below settings provide for a window that enable/disables events from firing the notifiers. +excluded_days = "" + +# Enter as a tuple of string values. Be aware of your regional settings. +excluded_hours = ["23:59", "00:00"] diff --git a/wazuh-notify-python/wazuh-notify.py b/wazuh-notify-python/wazuh-notify.py index b1c273e..ec4c462 100755 --- a/wazuh-notify-python/wazuh-notify.py +++ b/wazuh-notify-python/wazuh-notify.py @@ -29,7 +29,7 @@ def main(): arguments = get_arguments() # Check if we are in test mode (test_mode setting in config yaml). If so, load test event instead of live event. - if config.get("test_mode"): + if config.get('python', 'test_mode'): logger(1, config, me, him, "Running in test mode: using test message wazuh-notify-test-event.json") diff --git a/wazuh-notify-python/wazuh_notify_module.py b/wazuh-notify-python/wazuh_notify_module.py index 2b04b38..e173917 100755 --- a/wazuh-notify-python/wazuh_notify_module.py +++ b/wazuh-notify-python/wazuh_notify_module.py @@ -8,7 +8,7 @@ import time from os.path import join, dirname from sys import _getframe as frame -import yaml +import tomli from dotenv import load_dotenv @@ -17,10 +17,10 @@ from dotenv import load_dotenv # config_path = wazuh-notify-config.yaml def set_environment() -> tuple: - - set_wazuh_path = os.path.abspath(os.path.join(__file__, "../../..")) + set_wazuh_path = os.path.abspath(os.path.join(__file__, "../..")) + # set_wazuh_path = os.path.abspath(os.path.join(__file__, "../../..")) set_log_path = '{0}/logs/wazuh-notify.log'.format(set_wazuh_path) - set_config_path = '{0}/etc/wazuh-notify-config.yaml'.format(set_wazuh_path) + set_config_path = '{0}/etc/wazuh-notify-config.toml'.format(set_wazuh_path) return set_wazuh_path, set_log_path, set_config_path @@ -58,13 +58,13 @@ def logger(level, config, me, him, message): # Compare the extended_print log level in the configuration to the log level of the message. - if config.get('extended_print') >= level: + if config.get('python').get('extended_print', 0) >= level: print(log_line) try: # Compare the extended_logging level in the configuration to the log level of the message. - if config.get("extended_logging") >= level: + if config.get('python').get('extended_logging', 0) >= level: with open(logger_log_path, mode="a") as log_file: log_file.write(log_line + "\n") @@ -129,28 +129,28 @@ def get_config(): try: _, _, this_config_path = set_environment() - with open(this_config_path, 'r') as ntfier_config: - config: dict = yaml.safe_load(ntfier_config) + with open(this_config_path, 'rb') as ntfier_config: + config: dict = tomli.load(ntfier_config) except (FileNotFoundError, PermissionError, OSError): logger(2, config, me, him, "Error accessing configuration file: " + this_config_path) logger(2, config, me, him, "Reading configuration file: " + this_config_path) - config['targets'] = config.get('targets', 'discord, ntfy, slack') - config['full_alert'] = config.get('full_alert', '') - config['excluded_rules'] = config.get('excluded_rules', '') - config['excluded_agents'] = config.get('excluded_agents', '') + config['targets'] = config.get('general').get('targets', 'discord, slack, ntfy') + config['full_alert'] = config.get('general').get('full_alert', False) + config['excluded_rules'] = config.get('general').get('excluded_rules', '') + config['excluded_agents'] = config.get('general').get('excluded_agents', '') config['priority_map'] = config.get('priority_map', []) - config['sender'] = config.get('sender', 'Wazuh (IDS)') - config['click'] = config.get('click', 'https://wazuh.org') - config['md_e'] = config.get('markdown_emphasis', '') + config['sender'] = config.get('general').get('sender', 'Wazuh (IDS)') + config['click'] = config.get('general').get('click', 'https://wazuh.com') + config['md_e'] = config.get('general').get('markdown_emphasis', '') - config['excluded_days'] = config.get('excluded_days', '') - config['excluded_hours'] = config.get('excluded_hours', '') - config['test_mode'] = config.get('test_mode', False) - config['extended_logging'] = config.get('extended_logging', True) - config['extended_print'] = config.get('extended_print', True) + config['excluded_days'] = config.get('python').get('excluded_days', '') + config['excluded_hours'] = config.get('python').get('excluded_hours', '') + config['test_mode'] = config.get('python').get('test_mode', False) + config['extended_logging'] = config.get('python').get('extended_logging', 0) + config['extended_print'] = config.get('python').get('extended_print', 0) return config @@ -348,17 +348,17 @@ def exclusions_check(config, alert): # Check the exclusion records from the configuration yaml. - ex_hours: tuple = config.get('excluded_hours') + ex_hours: tuple = config.get('python', 'excluded_hours') # Start hour may not be later than end hours. End hour may not exceed 00:00 midnight to avoid day jump. - + ################################################ ex_hours = [ex_hours[0], "23:59"] if (ex_hours[1] >= '23:59' or ex_hours[1] < ex_hours[0]) else ex_hours # Get some more exclusion records from the config. - ex_days = config.get('excluded_days') - ex_agents = config.get("excluded_agents") - ex_rules = config.get("excluded_rules") + ex_days = config.get('python').get('excluded_days') + ex_agents = config.get('general').get("excluded_agents") + ex_rules = config.get('general').get("excluded_rules") # Check agent and rule from within the event. @@ -459,7 +459,7 @@ def construct_basic_message(config, arguments, caller: str, data: dict) -> str: # Include a specific control sequence for markdown bold parameter names. - md_map = config.get('markdown_emphasis') + md_map = config.get('python').get('markdown_emphasis', '') md_e = md_map[caller] # If the --message (-m) argument was fulfilled, use this message to be sent. @@ -500,11 +500,11 @@ def build_notification(caller, config, arguments, notification, alert, priority, logger(2, config, me, him, caller + " notification being constructed.") - md_map = config.get('markdown_emphasis') + md_map = config.get('python').get('markdown_emphasis', '') md_e = md_map[caller] - click: str = config.get('click') - sender: str = config.get('sender') + click: str = config.get('general').get('click', 'https://wazuh.com') + sender: str = config.get('general').get('sender', 'Wazuh (IDS)') priority: str = str(priority) tags = (str(alert['rule']['groups']).replace("[", "") .replace("]", "") From 1557a1dd072ebad7aa65cd28dd03f3666eecfd1c Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 13:01:39 +0200 Subject: [PATCH 03/17] yaml to toml --- wazuh-notify-go/go.mod | 2 ++ wazuh-notify-go/go.sum | 2 ++ wazuh-notify-go/main.go | 2 +- wazuh-notify-go/notification/discord.go | 10 +++--- wazuh-notify-go/notification/ntfy.go | 10 +++--- wazuh-notify-go/notification/slack.go | 19 +++-------- wazuh-notify-go/services/filters.go | 4 +-- wazuh-notify-go/services/init.go | 34 ++++++++++---------- wazuh-notify-go/types/types.go | 41 +++++++++++++++--------- wazuh-notify-go/wazuh-notify-config.yaml | 2 +- 10 files changed, 65 insertions(+), 61 deletions(-) diff --git a/wazuh-notify-go/go.mod b/wazuh-notify-go/go.mod index 5897e35..463f281 100644 --- a/wazuh-notify-go/go.mod +++ b/wazuh-notify-go/go.mod @@ -6,3 +6,5 @@ require ( github.com/joho/godotenv v1.5.1 gopkg.in/yaml.v2 v2.4.0 ) + +require github.com/BurntSushi/toml v1.4.0 // indirect diff --git a/wazuh-notify-go/go.sum b/wazuh-notify-go/go.sum index f7e7502..4261ff8 100644 --- a/wazuh-notify-go/go.sum +++ b/wazuh-notify-go/go.sum @@ -1,3 +1,5 @@ +github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0= +github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= diff --git a/wazuh-notify-go/main.go b/wazuh-notify-go/main.go index 3e34362..1be83a6 100644 --- a/wazuh-notify-go/main.go +++ b/wazuh-notify-go/main.go @@ -10,7 +10,7 @@ import ( func main() { inputParams := services.InitNotify() - for _, target := range strings.Split(inputParams.Targets, ",") { + for _, target := range strings.Split(inputParams.General.Targets, ", ") { switch target { case "discord": log.Log(target) diff --git a/wazuh-notify-go/notification/discord.go b/wazuh-notify-go/notification/discord.go index 4241b36..0360ad0 100644 --- a/wazuh-notify-go/notification/discord.go +++ b/wazuh-notify-go/notification/discord.go @@ -17,7 +17,7 @@ func SendDiscord(params types.Params) { var embedDescription string - if slices.Contains(strings.Split(params.FullAlert, ","), "discord") { + if slices.Contains(strings.Split(params.General.FullAlert, ","), "discord") { fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") @@ -31,7 +31,7 @@ func SendDiscord(params types.Params) { "```\n\n" + "Priority: " + strconv.Itoa(params.Priority) + "\n" + "Tags: " + params.Tags + "\n\n" + - params.Click + params.General.Click } else { embedDescription = "\n\n" + "**Timestamp: **" + time.Now().Format(time.DateTime) + "\n" + @@ -44,15 +44,15 @@ func SendDiscord(params types.Params) { "\n\n" + "Priority: " + strconv.Itoa(params.Priority) + "\n" + "Tags: " + params.Tags + "\n\n" + - params.Click + params.General.Click } message := types.Message{ - Username: params.Sender, + Username: params.General.Sender, Content: params.Mention, Embeds: []types.Embed{ { - Title: params.Sender, + Title: params.General.Sender, Description: embedDescription, Color: params.Color, }, diff --git a/wazuh-notify-go/notification/ntfy.go b/wazuh-notify-go/notification/ntfy.go index c408d95..f9eb109 100644 --- a/wazuh-notify-go/notification/ntfy.go +++ b/wazuh-notify-go/notification/ntfy.go @@ -15,7 +15,7 @@ func SendNtfy(params types.Params) { var payload string - if slices.Contains(strings.Split(params.FullAlert, ","), "discord") { + if slices.Contains(strings.Split(params.General.FullAlert, ","), "discord") { fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") @@ -39,14 +39,14 @@ func SendNtfy(params types.Params) { req, _ := http.NewRequest("POST", os.Getenv("NTFY_URL"), strings.NewReader(payload)) req.Header.Set("Content-Type", "text/plain") - if params.Sender != "" { - req.Header.Add("Title", params.Sender) + if params.General.Sender != "" { + req.Header.Add("Title", params.General.Sender) } if params.Tags != "" { req.Header.Add("Tags", params.Tags) } - if params.Click != "" { - req.Header.Add("Click", params.Click) + if params.General.Click != "" { + req.Header.Add("Click", params.General.Click) } if params.Priority != 0 { req.Header.Add("Priority", strconv.Itoa(params.Priority)) diff --git a/wazuh-notify-go/notification/slack.go b/wazuh-notify-go/notification/slack.go index 375a3ea..e2cdf96 100644 --- a/wazuh-notify-go/notification/slack.go +++ b/wazuh-notify-go/notification/slack.go @@ -3,6 +3,7 @@ package notification import ( "bytes" "encoding/json" + "fmt" "log" "net/http" "os" @@ -17,7 +18,7 @@ func SendSlack(params types.Params) { var embedDescription string - if slices.Contains(strings.Split(params.FullAlert, ","), "slack") { + if slices.Contains(strings.Split(params.General.FullAlert, ","), "slack") { fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") @@ -31,7 +32,7 @@ func SendSlack(params types.Params) { "```\n\n" + "Priority: " + strconv.Itoa(params.Priority) + "\n" + "Tags: " + params.Tags + "\n\n" + - params.Click + params.General.Click } else { embedDescription = "\n\n" + "**Timestamp: **" + time.Now().Format(time.DateTime) + "\n" + @@ -44,20 +45,10 @@ func SendSlack(params types.Params) { "\n\n" + "Priority: " + strconv.Itoa(params.Priority) + "\n" + "Tags: " + params.Tags + "\n\n" + - params.Click + params.General.Click } - message := types.Message{ - Username: params.Sender, - Content: params.Mention, - Embeds: []types.Embed{ - { - Title: params.Sender, - Description: embedDescription, - Color: params.Color, - }, - }, - } + message := fmt.Sprintf("{\"text\": %s}", embedDescription) payload := new(bytes.Buffer) diff --git a/wazuh-notify-go/services/filters.go b/wazuh-notify-go/services/filters.go index 8f630b3..373016f 100644 --- a/wazuh-notify-go/services/filters.go +++ b/wazuh-notify-go/services/filters.go @@ -7,14 +7,14 @@ import ( ) func Filter() { - for _, rule := range strings.Split(inputParams.ExcludedRules, ",") { + for _, rule := range strings.Split(inputParams.General.ExcludedRules, ",") { if rule == inputParams.WazuhMessage.Parameters.Alert.Rule.ID { log.Log("rule excluded") log.CloseLogFile() os.Exit(0) } } - for _, agent := range strings.Split(inputParams.ExcludedAgents, ",") { + for _, agent := range strings.Split(inputParams.General.ExcludedAgents, ",") { if agent == inputParams.WazuhMessage.Parameters.Alert.Agent.ID { log.Log("agent excluded") log.CloseLogFile() diff --git a/wazuh-notify-go/services/init.go b/wazuh-notify-go/services/init.go index 707b63a..c8f8450 100644 --- a/wazuh-notify-go/services/init.go +++ b/wazuh-notify-go/services/init.go @@ -4,8 +4,8 @@ import ( "bufio" "encoding/json" "flag" + "github.com/BurntSushi/toml" "github.com/joho/godotenv" - "gopkg.in/yaml.v2" "os" "path" "slices" @@ -32,12 +32,12 @@ func InitNotify() types.Params { log.Log("env loaded") } - yamlFile, err := os.ReadFile(path.Join(BaseDirPath, "../../etc/wazuh-notify-config.yaml")) + tomlFile, err := os.ReadFile(path.Join(BaseDirPath, "../../etc/wazuh-notify-config.toml")) if err != nil { - log.Log("yaml failed to load") - yamlFile, err = os.ReadFile(path.Join(BaseDirPath, "wazuh-notify-config.yaml")) + log.Log("toml failed to load") + tomlFile, err = os.ReadFile(path.Join(BaseDirPath, "wazuh-notify-config.toml")) } - err = yaml.Unmarshal(yamlFile, &configParams) + err = toml.Unmarshal(tomlFile, &configParams) if err != nil { print(err) } @@ -47,11 +47,11 @@ func InitNotify() types.Params { log.Log(string(configParamString)) flag.StringVar(&inputParams.Url, "url", "", "is the webhook URL of the Discord server. It is stored in .env.") - flag.StringVar(&inputParams.Click, "click", configParams.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") + flag.StringVar(&inputParams.General.Click, "click", configParams.General.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") flag.IntVar(&inputParams.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.") - flag.StringVar(&inputParams.Sender, "sender", configParams.Sender, "is the sender of the message, either an app name or a person. The default is \"Security message\".") + flag.StringVar(&inputParams.General.Sender, "sender", configParams.General.Sender, "is the sender of the message, either an app name or a person. The default is \"Security message\".") flag.StringVar(&inputParams.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".") - flag.StringVar(&inputParams.Targets, "targets", "", "is a list of targets to send notifications to. Default is \"discord\".") + flag.StringVar(&inputParams.General.Targets, "targets", "", "is a list of targets to send notifications to. Default is \"discord\".") flag.Parse() @@ -59,11 +59,11 @@ func InitNotify() types.Params { inputParamString, _ := json.Marshal(inputParams) log.Log(string(inputParamString)) - inputParams.Targets = configParams.Targets - inputParams.FullAlert = configParams.FullAlert - inputParams.ExcludedAgents = configParams.ExcludedAgents - inputParams.ExcludedRules = configParams.ExcludedRules - inputParams.PriorityMaps = configParams.PriorityMaps + inputParams.General.Targets = configParams.General.Targets + inputParams.General.FullAlert = configParams.General.FullAlert + inputParams.General.ExcludedAgents = configParams.General.ExcludedAgents + inputParams.General.ExcludedRules = configParams.General.ExcludedRules + inputParams.PriorityMap = configParams.PriorityMap wazuhInput() @@ -79,10 +79,10 @@ func wazuhInput() { inputParams.WazuhMessage = wazuhData - for i, _ := range configParams.PriorityMaps { - if slices.Contains(configParams.PriorityMaps[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { - inputParams.Color = inputParams.PriorityMaps[i].Color - if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= inputParams.PriorityMaps[i].MentionThreshold { + for i, _ := range configParams.PriorityMap { + if slices.Contains(configParams.PriorityMap[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { + inputParams.Color = inputParams.PriorityMap[i].Color + if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= inputParams.PriorityMap[i].MentionThreshold { inputParams.Mention = "@here" } inputParams.Priority = 5 - i diff --git a/wazuh-notify-go/types/types.go b/wazuh-notify-go/types/types.go index 436cfd9..f20f8ff 100644 --- a/wazuh-notify-go/types/types.go +++ b/wazuh-notify-go/types/types.go @@ -1,25 +1,34 @@ package types type Params struct { - Url string - Sender string `yaml:"sender,omitempty"` - Priority int - Tags string - Click string `yaml:"click,omitempty"` - Targets string `yaml:"targets,omitempty"` - FullAlert string `yaml:"full_message,omitempty"` - ExcludedRules string `yaml:"excluded_rules,omitempty"` - ExcludedAgents string `yaml:"excluded_agents,omitempty"` - Color int - Mention string - WazuhMessage WazuhMessage - PriorityMaps []PriorityMap `yaml:"priority_map"` + General General `toml:"general"` + Url string + Priority int + Tags string + Color int + Mention string + WazuhMessage WazuhMessage + PriorityMap []PriorityMap `toml:"priority_map"` + MarkdownEmphasis MarkdownEmphasis `toml:"markdown_emphasis"` } +type General struct { + Targets string `toml:"targets"` + FullAlert string `toml:"full_alert"` + ExcludedRules string `toml:"excluded_rules"` + ExcludedAgents string `toml:"excluded_agents"` + Sender string `toml:"sender"` + Click string `toml:"click"` +} type PriorityMap struct { - ThreatMap []int `yaml:"threat_map"` - MentionThreshold int `yaml:"mention_threshold"` - Color int `yaml:"color"` + ThreatMap []int `toml:"threat_map"` + MentionThreshold int `toml:"mention_threshold"` + Color int `toml:"color"` +} +type MarkdownEmphasis struct { + Slack string `toml:"slack"` + Ntfy string `toml:"ntfy"` + Discord string `toml:"discord"` } type Message struct { diff --git a/wazuh-notify-go/wazuh-notify-config.yaml b/wazuh-notify-go/wazuh-notify-config.yaml index e455811..f4013ff 100644 --- a/wazuh-notify-go/wazuh-notify-config.yaml +++ b/wazuh-notify-go/wazuh-notify-config.yaml @@ -4,7 +4,7 @@ # This is the yaml config file for both the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py. # The yaml needs to be in the same folder as the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py -targets: "discord,ntfy" +targets: "discord,ntfy,slack" full_message: "ntfy" # Exclude rules that are listed in the ossec.conf active response definition. From 1bc7fe0bb525dade42a6e82b19aaee91f0f73028 Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 13:25:16 +0200 Subject: [PATCH 04/17] notify threshold --- wazuh-notify-go/services/init.go | 3 +++ wazuh-notify-go/types/types.go | 1 + 2 files changed, 4 insertions(+) diff --git a/wazuh-notify-go/services/init.go b/wazuh-notify-go/services/init.go index c8f8450..5c86064 100644 --- a/wazuh-notify-go/services/init.go +++ b/wazuh-notify-go/services/init.go @@ -81,6 +81,9 @@ func wazuhInput() { for i, _ := range configParams.PriorityMap { if slices.Contains(configParams.PriorityMap[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { + if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes%inputParams.PriorityMap[i].NotifyThreshold != 0 { + os.Exit(0) + } inputParams.Color = inputParams.PriorityMap[i].Color if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= inputParams.PriorityMap[i].MentionThreshold { inputParams.Mention = "@here" diff --git a/wazuh-notify-go/types/types.go b/wazuh-notify-go/types/types.go index f20f8ff..7e4453f 100644 --- a/wazuh-notify-go/types/types.go +++ b/wazuh-notify-go/types/types.go @@ -23,6 +23,7 @@ type General struct { type PriorityMap struct { ThreatMap []int `toml:"threat_map"` MentionThreshold int `toml:"mention_threshold"` + NotifyThreshold int `toml:"notify_threshold"` Color int `toml:"color"` } type MarkdownEmphasis struct { From 50b4baec2d2a12dd6783f6a856f412fb72155b9f Mon Sep 17 00:00:00 2001 From: Darius Date: Mon, 27 May 2024 13:33:47 +0200 Subject: [PATCH 05/17] golang identifier added --- wazuh-notify-go/services/init.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wazuh-notify-go/services/init.go b/wazuh-notify-go/services/init.go index 5c86064..12b31c4 100644 --- a/wazuh-notify-go/services/init.go +++ b/wazuh-notify-go/services/init.go @@ -49,7 +49,7 @@ func InitNotify() types.Params { flag.StringVar(&inputParams.Url, "url", "", "is the webhook URL of the Discord server. It is stored in .env.") flag.StringVar(&inputParams.General.Click, "click", configParams.General.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") flag.IntVar(&inputParams.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.") - flag.StringVar(&inputParams.General.Sender, "sender", configParams.General.Sender, "is the sender of the message, either an app name or a person. The default is \"Security message\".") + flag.StringVar(&inputParams.General.Sender, "sender", configParams.General.Sender + " Golang", "is the sender of the message, either an app name or a person. The default is \"Security message\".") flag.StringVar(&inputParams.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".") flag.StringVar(&inputParams.General.Targets, "targets", "", "is a list of targets to send notifications to. Default is \"discord\".") From 9a1f982ea6321ff5df11d1b69911004889be3cdd Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 13:48:08 +0200 Subject: [PATCH 06/17] message refactor --- wazuh-notify-go/notification/discord.go | 6 +++--- wazuh-notify-go/notification/slack.go | 23 ++++++++++++----------- wazuh-notify-go/types/types.go | 8 +++++++- 3 files changed, 22 insertions(+), 15 deletions(-) diff --git a/wazuh-notify-go/notification/discord.go b/wazuh-notify-go/notification/discord.go index 0360ad0..95d9cdb 100644 --- a/wazuh-notify-go/notification/discord.go +++ b/wazuh-notify-go/notification/discord.go @@ -42,12 +42,12 @@ func SendDiscord(params types.Params) { "**Threat level:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + "**Times fired:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + "\n\n" + - "Priority: " + strconv.Itoa(params.Priority) + "\n" + - "Tags: " + params.Tags + "\n\n" + + "**Priority:** " + strconv.Itoa(params.Priority) + "\n" + + "**Tags:** " + params.Tags + "\n\n" + params.General.Click } - message := types.Message{ + message := types.DiscordMessage{ Username: params.General.Sender, Content: params.Mention, Embeds: []types.Embed{ diff --git a/wazuh-notify-go/notification/slack.go b/wazuh-notify-go/notification/slack.go index e2cdf96..2e5336a 100644 --- a/wazuh-notify-go/notification/slack.go +++ b/wazuh-notify-go/notification/slack.go @@ -3,7 +3,6 @@ package notification import ( "bytes" "encoding/json" - "fmt" "log" "net/http" "os" @@ -35,20 +34,22 @@ func SendSlack(params types.Params) { params.General.Click } else { embedDescription = "\n\n" + - "**Timestamp: **" + time.Now().Format(time.DateTime) + "\n" + - "**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + - "**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + - "**Rule:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + - "**Description: **" + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + - "**Threat level:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + - "**Times fired:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + + "*Timestamp:* " + time.Now().Format(time.DateTime) + "\n" + + "*Agent:* " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + + "*Event id:* " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + + "*Rule:* " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + + "*Description:* " + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + + "*Threat level:* " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + + "*Times fired:* " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + "\n\n" + - "Priority: " + strconv.Itoa(params.Priority) + "\n" + - "Tags: " + params.Tags + "\n\n" + + "*Priority:* " + strconv.Itoa(params.Priority) + "\n" + + "*Tags:* " + params.Tags + "\n\n" + params.General.Click } - message := fmt.Sprintf("{\"text\": %s}", embedDescription) + message := types.SlackMessage{ + Text: embedDescription, + } payload := new(bytes.Buffer) diff --git a/wazuh-notify-go/types/types.go b/wazuh-notify-go/types/types.go index 7e4453f..de951a9 100644 --- a/wazuh-notify-go/types/types.go +++ b/wazuh-notify-go/types/types.go @@ -32,7 +32,8 @@ type MarkdownEmphasis struct { Discord string `toml:"discord"` } -type Message struct { +// Discord +type DiscordMessage struct { Username string `json:"username,omitempty"` AvatarUrl string `json:"avatar_url,omitempty"` Content string `json:"content,omitempty"` @@ -44,3 +45,8 @@ type Embed struct { Description string `json:"description,omitempty"` Color int `json:"color,omitempty"` } + +// slack +type SlackMessage struct { + Text string `json:"text,omitempty"` +} From c6f365ff544be5b75875b9ff3eef5c8f0c427a99 Mon Sep 17 00:00:00 2001 From: Darius Date: Mon, 27 May 2024 13:59:28 +0200 Subject: [PATCH 07/17] ntfy change --- wazuh-notify-config.toml | 5 +++++ wazuh-notify-go/notification/ntfy.go | 12 ++++++------ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/wazuh-notify-config.toml b/wazuh-notify-config.toml index ef0c386..6aeb34c 100644 --- a/wazuh-notify-config.toml +++ b/wazuh-notify-config.toml @@ -24,26 +24,31 @@ click = "https://documentation.wazuh.com/" [[priority_map]] threat_map = [15, 14, 13, 12] mention_threshold = 1 +notify_threshold = 1 color = 0xec3e40 # Red, SEVERE [[priority_map]] threat_map = [11, 10, 9] mention_threshold = 1 +notify_threshold = 1 color = 0xff9b2b # Orange, HIGH [[priority_map]] threat_map = [8, 7, 6] mention_threshold = 5 +notify_threshold = 5 color = 0xf5d800 # Yellow, ELEVATED [[priority_map]] threat_map = [5, 4] mention_threshold = 20 +notify_threshold = 5 color = 0x377fc7 # Blue, GUARDED [[priority_map]] threat_map = [3, 2, 1, 0] mention_threshold = 20 +notify_threshold = 5 color = 0x01a465 # Green, LOW ################ End of priority mapping ################################## diff --git a/wazuh-notify-go/notification/ntfy.go b/wazuh-notify-go/notification/ntfy.go index f9eb109..456bc1f 100644 --- a/wazuh-notify-go/notification/ntfy.go +++ b/wazuh-notify-go/notification/ntfy.go @@ -29,15 +29,15 @@ func SendNtfy(params types.Params) { "```" } else { payload = time.Now().Format(time.RFC3339) + "\n\n" + - "Agent: " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + - "Event id: " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + - "Description: " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + - "Threat level: " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + - "Times fired: " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + "\n" + "**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + + "**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + + "**Description:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + + "**Threat level:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + + "**Times fired:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + "\n" } req, _ := http.NewRequest("POST", os.Getenv("NTFY_URL"), strings.NewReader(payload)) - req.Header.Set("Content-Type", "text/plain") + req.Header.Set("Content-Type", "text/markdown") if params.General.Sender != "" { req.Header.Add("Title", params.General.Sender) From 2bc675b150cf8c9a2b2b8763b1b88057d8d77e0d Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 14:16:50 +0200 Subject: [PATCH 08/17] message builder refactor --- wazuh-notify-go/notification/discord.go | 39 +++------------------- wazuh-notify-go/notification/ntfy.go | 31 +++-------------- wazuh-notify-go/notification/slack.go | 39 +++------------------- wazuh-notify-go/services/init.go | 3 +- wazuh-notify-go/services/messageBuilder.go | 39 ++++++++++++++++++++++ 5 files changed, 55 insertions(+), 96 deletions(-) create mode 100644 wazuh-notify-go/services/messageBuilder.go diff --git a/wazuh-notify-go/notification/discord.go b/wazuh-notify-go/notification/discord.go index 95d9cdb..db70f4e 100644 --- a/wazuh-notify-go/notification/discord.go +++ b/wazuh-notify-go/notification/discord.go @@ -6,46 +6,17 @@ import ( "log" "net/http" "os" - "slices" "strconv" - "strings" - "time" + "wazuh-notify/services" "wazuh-notify/types" ) func SendDiscord(params types.Params) { - var embedDescription string - - if slices.Contains(strings.Split(params.General.FullAlert, ","), "discord") { - fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") - fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") - fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "}", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "[", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "]", "") - fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "") - - embedDescription = "\n\n ```" + - fullAlertString + - "```\n\n" + - "Priority: " + strconv.Itoa(params.Priority) + "\n" + - "Tags: " + params.Tags + "\n\n" + - params.General.Click - } else { - embedDescription = "\n\n" + - "**Timestamp: **" + time.Now().Format(time.DateTime) + "\n" + - "**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + - "**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + - "**Rule:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + - "**Description: **" + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + - "**Threat level:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + - "**Times fired:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + - "\n\n" + - "**Priority:** " + strconv.Itoa(params.Priority) + "\n" + - "**Tags:** " + params.Tags + "\n\n" + - params.General.Click - } + embedDescription := services.BuildMessage(params, "discord", params.MarkdownEmphasis.Discord) + + "**Priority:** " + strconv.Itoa(params.Priority) + "\n" + + "**Tags:** " + params.Tags + "\n\n" + + params.General.Click message := types.DiscordMessage{ Username: params.General.Sender, diff --git a/wazuh-notify-go/notification/ntfy.go b/wazuh-notify-go/notification/ntfy.go index 456bc1f..7103143 100644 --- a/wazuh-notify-go/notification/ntfy.go +++ b/wazuh-notify-go/notification/ntfy.go @@ -1,42 +1,21 @@ package notification import ( - "encoding/json" "net/http" "os" - "slices" "strconv" "strings" - "time" + "wazuh-notify/services" "wazuh-notify/types" ) func SendNtfy(params types.Params) { - var payload string + req, _ := http.NewRequest( + "POST", + os.Getenv("NTFY_URL"), + strings.NewReader(services.BuildMessage(params, "ntfy", params.MarkdownEmphasis.Ntfy))) - if slices.Contains(strings.Split(params.General.FullAlert, ","), "discord") { - fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") - fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") - fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "}", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "[", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "]", "") - fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "") - - payload = "\n\n ```" + - fullAlertString + - "```" - } else { - payload = time.Now().Format(time.RFC3339) + "\n\n" + - "**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + - "**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + - "**Description:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + - "**Threat level:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + - "**Times fired:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + "\n" - } - - req, _ := http.NewRequest("POST", os.Getenv("NTFY_URL"), strings.NewReader(payload)) req.Header.Set("Content-Type", "text/markdown") if params.General.Sender != "" { diff --git a/wazuh-notify-go/notification/slack.go b/wazuh-notify-go/notification/slack.go index 2e5336a..98603cf 100644 --- a/wazuh-notify-go/notification/slack.go +++ b/wazuh-notify-go/notification/slack.go @@ -6,49 +6,18 @@ import ( "log" "net/http" "os" - "slices" "strconv" - "strings" - "time" + "wazuh-notify/services" "wazuh-notify/types" ) func SendSlack(params types.Params) { - var embedDescription string - - if slices.Contains(strings.Split(params.General.FullAlert, ","), "slack") { - fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") - fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") - fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "}", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "[", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "]", "") - fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "") - - embedDescription = "\n\n ```" + - fullAlertString + - "```\n\n" + - "Priority: " + strconv.Itoa(params.Priority) + "\n" + - "Tags: " + params.Tags + "\n\n" + - params.General.Click - } else { - embedDescription = "\n\n" + - "*Timestamp:* " + time.Now().Format(time.DateTime) + "\n" + - "*Agent:* " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + - "*Event id:* " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + - "*Rule:* " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + - "*Description:* " + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + - "*Threat level:* " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + - "*Times fired:* " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + - "\n\n" + + message := types.SlackMessage{ + Text: services.BuildMessage(params, "slack", params.MarkdownEmphasis.Slack) + "*Priority:* " + strconv.Itoa(params.Priority) + "\n" + "*Tags:* " + params.Tags + "\n\n" + - params.General.Click - } - - message := types.SlackMessage{ - Text: embedDescription, + params.General.Click, } payload := new(bytes.Buffer) diff --git a/wazuh-notify-go/services/init.go b/wazuh-notify-go/services/init.go index 12b31c4..b29416c 100644 --- a/wazuh-notify-go/services/init.go +++ b/wazuh-notify-go/services/init.go @@ -49,7 +49,7 @@ func InitNotify() types.Params { flag.StringVar(&inputParams.Url, "url", "", "is the webhook URL of the Discord server. It is stored in .env.") flag.StringVar(&inputParams.General.Click, "click", configParams.General.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") flag.IntVar(&inputParams.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.") - flag.StringVar(&inputParams.General.Sender, "sender", configParams.General.Sender + " Golang", "is the sender of the message, either an app name or a person. The default is \"Security message\".") + flag.StringVar(&inputParams.General.Sender, "sender", configParams.General.Sender+" Golang", "is the sender of the message, either an app name or a person. The default is \"Security message\".") flag.StringVar(&inputParams.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".") flag.StringVar(&inputParams.General.Targets, "targets", "", "is a list of targets to send notifications to. Default is \"discord\".") @@ -64,6 +64,7 @@ func InitNotify() types.Params { inputParams.General.ExcludedAgents = configParams.General.ExcludedAgents inputParams.General.ExcludedRules = configParams.General.ExcludedRules inputParams.PriorityMap = configParams.PriorityMap + inputParams.MarkdownEmphasis = configParams.MarkdownEmphasis wazuhInput() diff --git a/wazuh-notify-go/services/messageBuilder.go b/wazuh-notify-go/services/messageBuilder.go new file mode 100644 index 0000000..7fb94db --- /dev/null +++ b/wazuh-notify-go/services/messageBuilder.go @@ -0,0 +1,39 @@ +package services + +import ( + "encoding/json" + "fmt" + "slices" + "strconv" + "strings" + "time" + "wazuh-notify/types" +) + +func BuildMessage(params types.Params, target string, emphasis string) string { + + if slices.Contains(strings.Split(params.General.FullAlert, ","), target) { + fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") + fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") + fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") + fullAlertString = strings.ReplaceAll(fullAlertString, "}", "") + fullAlertString = strings.ReplaceAll(fullAlertString, "[", "") + fullAlertString = strings.ReplaceAll(fullAlertString, "]", "") + fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "") + + return "\n\n ```" + + fullAlertString + + "```\n\n" + } else { + return "\n\n" + + fmt.Sprintf("%sTimestamp:%s ", emphasis, emphasis) + time.Now().Format(time.DateTime) + "\n" + + fmt.Sprintf("%sAgent:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + + fmt.Sprintf("%sEvent id:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + + fmt.Sprintf("%sRule:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + + fmt.Sprintf("%sDescription:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + + fmt.Sprintf("%sThreat level:%s ", emphasis, emphasis) + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + + fmt.Sprintf("%sTimes fired:%s ", emphasis, emphasis) + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + + "\n\n" + + } +} From ba49467acf612560a18420ede334985e75d60d84 Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 14:47:18 +0200 Subject: [PATCH 09/17] ntfy enter refactor auto types refactor --- wazuh-notify-go/log/log.go | 2 +- wazuh-notify-go/notification/discord.go | 2 -- wazuh-notify-go/notification/ntfy.go | 2 +- wazuh-notify-go/notification/slack.go | 2 -- wazuh-notify-go/services/init.go | 2 +- wazuh-notify-go/services/messageBuilder.go | 3 ++- wazuh-notify-go/types/discord.go | 14 ++++++++++++++ wazuh-notify-go/types/ntfy.go | 1 + wazuh-notify-go/types/slack.go | 5 +++++ wazuh-notify-go/types/types.go | 19 ------------------- 10 files changed, 25 insertions(+), 27 deletions(-) create mode 100644 wazuh-notify-go/types/discord.go create mode 100644 wazuh-notify-go/types/ntfy.go create mode 100644 wazuh-notify-go/types/slack.go diff --git a/wazuh-notify-go/log/log.go b/wazuh-notify-go/log/log.go index 5561aca..dfa3a10 100644 --- a/wazuh-notify-go/log/log.go +++ b/wazuh-notify-go/log/log.go @@ -29,7 +29,7 @@ func CloseLogFile() { if err != nil { panic(err) } - logFile.Close() + logFile.Close() } func Log(message string) { diff --git a/wazuh-notify-go/notification/discord.go b/wazuh-notify-go/notification/discord.go index db70f4e..910a405 100644 --- a/wazuh-notify-go/notification/discord.go +++ b/wazuh-notify-go/notification/discord.go @@ -6,7 +6,6 @@ import ( "log" "net/http" "os" - "strconv" "wazuh-notify/services" "wazuh-notify/types" ) @@ -14,7 +13,6 @@ import ( func SendDiscord(params types.Params) { embedDescription := services.BuildMessage(params, "discord", params.MarkdownEmphasis.Discord) + - "**Priority:** " + strconv.Itoa(params.Priority) + "\n" + "**Tags:** " + params.Tags + "\n\n" + params.General.Click diff --git a/wazuh-notify-go/notification/ntfy.go b/wazuh-notify-go/notification/ntfy.go index 7103143..f8332e9 100644 --- a/wazuh-notify-go/notification/ntfy.go +++ b/wazuh-notify-go/notification/ntfy.go @@ -14,7 +14,7 @@ func SendNtfy(params types.Params) { req, _ := http.NewRequest( "POST", os.Getenv("NTFY_URL"), - strings.NewReader(services.BuildMessage(params, "ntfy", params.MarkdownEmphasis.Ntfy))) + strings.NewReader(" "+services.BuildMessage(params, "ntfy", params.MarkdownEmphasis.Ntfy))) req.Header.Set("Content-Type", "text/markdown") diff --git a/wazuh-notify-go/notification/slack.go b/wazuh-notify-go/notification/slack.go index 98603cf..524e4de 100644 --- a/wazuh-notify-go/notification/slack.go +++ b/wazuh-notify-go/notification/slack.go @@ -6,7 +6,6 @@ import ( "log" "net/http" "os" - "strconv" "wazuh-notify/services" "wazuh-notify/types" ) @@ -15,7 +14,6 @@ func SendSlack(params types.Params) { message := types.SlackMessage{ Text: services.BuildMessage(params, "slack", params.MarkdownEmphasis.Slack) + - "*Priority:* " + strconv.Itoa(params.Priority) + "\n" + "*Tags:* " + params.Tags + "\n\n" + params.General.Click, } diff --git a/wazuh-notify-go/services/init.go b/wazuh-notify-go/services/init.go index b29416c..c7ed975 100644 --- a/wazuh-notify-go/services/init.go +++ b/wazuh-notify-go/services/init.go @@ -80,7 +80,7 @@ func wazuhInput() { inputParams.WazuhMessage = wazuhData - for i, _ := range configParams.PriorityMap { + for i := range configParams.PriorityMap { if slices.Contains(configParams.PriorityMap[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes%inputParams.PriorityMap[i].NotifyThreshold != 0 { os.Exit(0) diff --git a/wazuh-notify-go/services/messageBuilder.go b/wazuh-notify-go/services/messageBuilder.go index 7fb94db..5c129b6 100644 --- a/wazuh-notify-go/services/messageBuilder.go +++ b/wazuh-notify-go/services/messageBuilder.go @@ -33,7 +33,8 @@ func BuildMessage(params types.Params, target string, emphasis string) string { fmt.Sprintf("%sDescription:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + fmt.Sprintf("%sThreat level:%s ", emphasis, emphasis) + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + fmt.Sprintf("%sTimes fired:%s ", emphasis, emphasis) + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + - "\n\n" + "\n\n" + + fmt.Sprintf("%sPriority:%s ", emphasis, emphasis) + strconv.Itoa(params.Priority) + "\n" } } diff --git a/wazuh-notify-go/types/discord.go b/wazuh-notify-go/types/discord.go new file mode 100644 index 0000000..cd3f1fb --- /dev/null +++ b/wazuh-notify-go/types/discord.go @@ -0,0 +1,14 @@ +package types + +type DiscordMessage struct { + Username string `json:"username,omitempty"` + AvatarUrl string `json:"avatar_url,omitempty"` + Content string `json:"content,omitempty"` + Embeds []Embed `json:"embeds,omitempty"` +} + +type Embed struct { + Title string `json:"title,omitempty"` + Description string `json:"description,omitempty"` + Color int `json:"color,omitempty"` +} diff --git a/wazuh-notify-go/types/ntfy.go b/wazuh-notify-go/types/ntfy.go new file mode 100644 index 0000000..ab1254f --- /dev/null +++ b/wazuh-notify-go/types/ntfy.go @@ -0,0 +1 @@ +package types diff --git a/wazuh-notify-go/types/slack.go b/wazuh-notify-go/types/slack.go new file mode 100644 index 0000000..c986f98 --- /dev/null +++ b/wazuh-notify-go/types/slack.go @@ -0,0 +1,5 @@ +package types + +type SlackMessage struct { + Text string `json:"text,omitempty"` +} diff --git a/wazuh-notify-go/types/types.go b/wazuh-notify-go/types/types.go index de951a9..186dabd 100644 --- a/wazuh-notify-go/types/types.go +++ b/wazuh-notify-go/types/types.go @@ -31,22 +31,3 @@ type MarkdownEmphasis struct { Ntfy string `toml:"ntfy"` Discord string `toml:"discord"` } - -// Discord -type DiscordMessage struct { - Username string `json:"username,omitempty"` - AvatarUrl string `json:"avatar_url,omitempty"` - Content string `json:"content,omitempty"` - Embeds []Embed `json:"embeds,omitempty"` -} - -type Embed struct { - Title string `json:"title,omitempty"` - Description string `json:"description,omitempty"` - Color int `json:"color,omitempty"` -} - -// slack -type SlackMessage struct { - Text string `json:"text,omitempty"` -} From 05bd601f30defc6c8a9a768a5a2e342ca64bbfde Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 14:51:22 +0200 Subject: [PATCH 10/17] refactor files --- .../{notification => discord}/discord.go | 6 +- .../{types/discord.go => discord/types.go} | 2 +- wazuh-notify-go/main.go | 6 +- .../{notification => ntfy}/ntfy.go | 2 +- wazuh-notify-go/ntfy/types.go | 1 + .../{notification => slack}/slack.go | 4 +- .../{types/slack.go => slack/types.go} | 2 +- wazuh-notify-go/types/ntfy.go | 1 - wazuh-notify-go/types/{types.go => params.go} | 0 wazuh-notify-go/wazuh-notify-config.toml | 84 +++++++++++++++++++ wazuh-notify-go/wazuh-notify-config.yaml | 49 ----------- 11 files changed, 97 insertions(+), 60 deletions(-) rename wazuh-notify-go/{notification => discord}/discord.go (90%) rename wazuh-notify-go/{types/discord.go => discord/types.go} (95%) rename wazuh-notify-go/{notification => ntfy}/ntfy.go (97%) create mode 100644 wazuh-notify-go/ntfy/types.go rename wazuh-notify-go/{notification => slack}/slack.go (91%) rename wazuh-notify-go/{types/slack.go => slack/types.go} (82%) delete mode 100644 wazuh-notify-go/types/ntfy.go rename wazuh-notify-go/types/{types.go => params.go} (100%) create mode 100644 wazuh-notify-go/wazuh-notify-config.toml delete mode 100644 wazuh-notify-go/wazuh-notify-config.yaml diff --git a/wazuh-notify-go/notification/discord.go b/wazuh-notify-go/discord/discord.go similarity index 90% rename from wazuh-notify-go/notification/discord.go rename to wazuh-notify-go/discord/discord.go index 910a405..734bf5f 100644 --- a/wazuh-notify-go/notification/discord.go +++ b/wazuh-notify-go/discord/discord.go @@ -1,4 +1,4 @@ -package notification +package discord import ( "bytes" @@ -16,10 +16,10 @@ func SendDiscord(params types.Params) { "**Tags:** " + params.Tags + "\n\n" + params.General.Click - message := types.DiscordMessage{ + message := DiscordMessage{ Username: params.General.Sender, Content: params.Mention, - Embeds: []types.Embed{ + Embeds: []Embed{ { Title: params.General.Sender, Description: embedDescription, diff --git a/wazuh-notify-go/types/discord.go b/wazuh-notify-go/discord/types.go similarity index 95% rename from wazuh-notify-go/types/discord.go rename to wazuh-notify-go/discord/types.go index cd3f1fb..dbaa586 100644 --- a/wazuh-notify-go/types/discord.go +++ b/wazuh-notify-go/discord/types.go @@ -1,4 +1,4 @@ -package types +package discord type DiscordMessage struct { Username string `json:"username,omitempty"` diff --git a/wazuh-notify-go/main.go b/wazuh-notify-go/main.go index 1be83a6..ab6c2b2 100644 --- a/wazuh-notify-go/main.go +++ b/wazuh-notify-go/main.go @@ -4,7 +4,9 @@ import ( "strings" "wazuh-notify/log" "wazuh-notify/notification" + "wazuh-notify/ntfy" "wazuh-notify/services" + "wazuh-notify/slack" ) func main() { @@ -17,10 +19,10 @@ func main() { notification.SendDiscord(inputParams) case "ntfy": log.Log(target) - notification.SendNtfy(inputParams) + ntfy.SendNtfy(inputParams) case "slack": log.Log(target) - notification.SendSlack(inputParams) + slack.SendSlack(inputParams) } } log.CloseLogFile() diff --git a/wazuh-notify-go/notification/ntfy.go b/wazuh-notify-go/ntfy/ntfy.go similarity index 97% rename from wazuh-notify-go/notification/ntfy.go rename to wazuh-notify-go/ntfy/ntfy.go index f8332e9..d6a0dfd 100644 --- a/wazuh-notify-go/notification/ntfy.go +++ b/wazuh-notify-go/ntfy/ntfy.go @@ -1,4 +1,4 @@ -package notification +package ntfy import ( "net/http" diff --git a/wazuh-notify-go/ntfy/types.go b/wazuh-notify-go/ntfy/types.go new file mode 100644 index 0000000..19634d4 --- /dev/null +++ b/wazuh-notify-go/ntfy/types.go @@ -0,0 +1 @@ +package ntfy diff --git a/wazuh-notify-go/notification/slack.go b/wazuh-notify-go/slack/slack.go similarity index 91% rename from wazuh-notify-go/notification/slack.go rename to wazuh-notify-go/slack/slack.go index 524e4de..3aa6f4c 100644 --- a/wazuh-notify-go/notification/slack.go +++ b/wazuh-notify-go/slack/slack.go @@ -1,4 +1,4 @@ -package notification +package slack import ( "bytes" @@ -12,7 +12,7 @@ import ( func SendSlack(params types.Params) { - message := types.SlackMessage{ + message := SlackMessage{ Text: services.BuildMessage(params, "slack", params.MarkdownEmphasis.Slack) + "*Tags:* " + params.Tags + "\n\n" + params.General.Click, diff --git a/wazuh-notify-go/types/slack.go b/wazuh-notify-go/slack/types.go similarity index 82% rename from wazuh-notify-go/types/slack.go rename to wazuh-notify-go/slack/types.go index c986f98..cca8e79 100644 --- a/wazuh-notify-go/types/slack.go +++ b/wazuh-notify-go/slack/types.go @@ -1,4 +1,4 @@ -package types +package slack type SlackMessage struct { Text string `json:"text,omitempty"` diff --git a/wazuh-notify-go/types/ntfy.go b/wazuh-notify-go/types/ntfy.go deleted file mode 100644 index ab1254f..0000000 --- a/wazuh-notify-go/types/ntfy.go +++ /dev/null @@ -1 +0,0 @@ -package types diff --git a/wazuh-notify-go/types/types.go b/wazuh-notify-go/types/params.go similarity index 100% rename from wazuh-notify-go/types/types.go rename to wazuh-notify-go/types/params.go diff --git a/wazuh-notify-go/wazuh-notify-config.toml b/wazuh-notify-go/wazuh-notify-config.toml new file mode 100644 index 0000000..6aeb34c --- /dev/null +++ b/wazuh-notify-go/wazuh-notify-config.toml @@ -0,0 +1,84 @@ +############################################################################################################# +# This is the TOML config file for wazuh-notify (active response) for both the Python and Go implementation # +############################################################################################################# + +[general] +# Platforms in this string with comma seperated values are triggered. +targets = "slack, ntfy, discord" + +# Platforms in this string will enable sending the full event information. +full_alert = "" + +# Exclude rule events that are enabled in the ossec.conf active response definition. +# These settings provide an easier way to disable events from firing the notifiers. +excluded_rules = "99999, 00000" +excluded_agents = "99999" + +# The next 2 settings are used to add information to the messages. +sender = "Wazuh (IDS)" +click = "https://documentation.wazuh.com/" + +# Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) +# https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html +# Enter threat_map as lists of integers, mention_threshold as integer and color as Hex integer +[[priority_map]] +threat_map = [15, 14, 13, 12] +mention_threshold = 1 +notify_threshold = 1 +color = 0xec3e40 # Red, SEVERE + +[[priority_map]] +threat_map = [11, 10, 9] +mention_threshold = 1 +notify_threshold = 1 +color = 0xff9b2b # Orange, HIGH + +[[priority_map]] +threat_map = [8, 7, 6] +mention_threshold = 5 +notify_threshold = 5 +color = 0xf5d800 # Yellow, ELEVATED + +[[priority_map]] +threat_map = [5, 4] +mention_threshold = 20 +notify_threshold = 5 +color = 0x377fc7 # Blue, GUARDED + +[[priority_map]] +threat_map = [3, 2, 1, 0] +mention_threshold = 20 +notify_threshold = 5 +color = 0x01a465 # Green, LOW + +################ End of priority mapping ################################## + +# Following parameter defines the markdown characters to emphasise the parameter names in the notification messages +[markdown_emphasis] +slack = "*" +ntfy = "**" +discord = "**" + +################################################################################## +# From here on the settings are ONLY used by the Python version of wazuh-notify. # +################################################################################## + +[python] + +# The next settings are used for testing and troubleshooting. + +# Test mode will add the example event in wazuh-notify-test-event.json instead of the message received through wazuh. +# This enables testing for particular events when the test event is customized. +test_mode = true + +# Enabling this parameter provides more logging to the wazuh-notifier log. +extended_logging = 2 + +# Enabling this parameter provides extended logging to the console. +extended_print = 2 + +# Below settings provide for a window that enable/disables events from firing the notifiers. +excluded_days = "" + +# Enter as a tuple of string values. Be aware of your regional settings. +excluded_hours = ["23:59", "00:00"] diff --git a/wazuh-notify-go/wazuh-notify-config.yaml b/wazuh-notify-go/wazuh-notify-config.yaml deleted file mode 100644 index f4013ff..0000000 --- a/wazuh-notify-go/wazuh-notify-config.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- -#start of yaml - -# This is the yaml config file for both the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py. -# The yaml needs to be in the same folder as the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py - -targets: "discord,ntfy,slack" -full_message: "ntfy" - -# Exclude rules that are listed in the ossec.conf active response definition. - -excluded_rules: "5401,5403" -excluded_agents: "999" - -# Priority mapping from 1-12 (Wazuh events) to 1-5 (Discord and ntfy notification) -# Discord mention after x amount of event fired times - -priority_map: - - - threat_map: [15,14,13,12] - mention_threshold: 1 - color: 0xcc3300 - - - threat_map: [11,10,9] - mention_threshold: 1 - color: 0xff9966 - - - threat_map: [8,7,6] - mention_threshold: 5 - color: 0xffcc00 - - - threat_map: [5,4] - mention_threshold: 5 - color: 0x99cc33 - - - threat_map: [3,2,1,0] - mention_threshold: 5 - color: 0x339900 - - -sender: "Wazuh (IDS)" -click: "https://google.com" - - -#end of yaml -... - - - From 5675e75f45a7d3b97c1fb53eb9fcd003b88cd537 Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 15:10:26 +0200 Subject: [PATCH 11/17] refactor init --- wazuh-notify-go/main.go | 16 ++-- wazuh-notify-go/services/filters.go | 11 +-- wazuh-notify-go/services/flags.go | 23 ++++++ wazuh-notify-go/services/init.go | 101 ------------------------- wazuh-notify-go/services/readConfig.go | 42 ++++++++++ wazuh-notify-go/services/wazuhData.go | 45 +++++++++++ 6 files changed, 126 insertions(+), 112 deletions(-) create mode 100644 wazuh-notify-go/services/flags.go delete mode 100644 wazuh-notify-go/services/init.go create mode 100644 wazuh-notify-go/services/readConfig.go create mode 100644 wazuh-notify-go/services/wazuhData.go diff --git a/wazuh-notify-go/main.go b/wazuh-notify-go/main.go index ab6c2b2..85c2abb 100644 --- a/wazuh-notify-go/main.go +++ b/wazuh-notify-go/main.go @@ -2,27 +2,31 @@ package main import ( "strings" + "wazuh-notify/discord" "wazuh-notify/log" - "wazuh-notify/notification" "wazuh-notify/ntfy" "wazuh-notify/services" "wazuh-notify/slack" ) func main() { - inputParams := services.InitNotify() + configParams := services.ReadConfig() - for _, target := range strings.Split(inputParams.General.Targets, ", ") { + inputParams := services.ParseFlags(configParams) + + Params := services.ParseWazuhInput(inputParams) + + for _, target := range strings.Split(Params.General.Targets, ", ") { switch target { case "discord": log.Log(target) - notification.SendDiscord(inputParams) + discord.SendDiscord(Params) case "ntfy": log.Log(target) - ntfy.SendNtfy(inputParams) + ntfy.SendNtfy(Params) case "slack": log.Log(target) - slack.SendSlack(inputParams) + slack.SendSlack(Params) } } log.CloseLogFile() diff --git a/wazuh-notify-go/services/filters.go b/wazuh-notify-go/services/filters.go index 373016f..efd7458 100644 --- a/wazuh-notify-go/services/filters.go +++ b/wazuh-notify-go/services/filters.go @@ -4,18 +4,19 @@ import ( "os" "strings" "wazuh-notify/log" + "wazuh-notify/types" ) -func Filter() { - for _, rule := range strings.Split(inputParams.General.ExcludedRules, ",") { - if rule == inputParams.WazuhMessage.Parameters.Alert.Rule.ID { +func Filter(params types.Params) { + for _, rule := range strings.Split(params.General.ExcludedRules, ",") { + if rule == params.WazuhMessage.Parameters.Alert.Rule.ID { log.Log("rule excluded") log.CloseLogFile() os.Exit(0) } } - for _, agent := range strings.Split(inputParams.General.ExcludedAgents, ",") { - if agent == inputParams.WazuhMessage.Parameters.Alert.Agent.ID { + for _, agent := range strings.Split(params.General.ExcludedAgents, ",") { + if agent == params.WazuhMessage.Parameters.Alert.Agent.ID { log.Log("agent excluded") log.CloseLogFile() os.Exit(0) diff --git a/wazuh-notify-go/services/flags.go b/wazuh-notify-go/services/flags.go new file mode 100644 index 0000000..df76e3b --- /dev/null +++ b/wazuh-notify-go/services/flags.go @@ -0,0 +1,23 @@ +package services + +import ( + "flag" + "wazuh-notify/log" + "wazuh-notify/types" +) + +func ParseFlags(params types.Params) types.Params { + + flag.StringVar(¶ms.Url, "url", "", "is the webhook URL of the Discord server. It is stored in .env.") + flag.StringVar(¶ms.General.Click, "click", params.General.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") + flag.IntVar(¶ms.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.") + flag.StringVar(¶ms.General.Sender, "sender", params.General.Sender+" Golang", "is the sender of the message, either an app name or a person. The default is \"Security message\".") + flag.StringVar(¶ms.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".") + flag.StringVar(¶ms.General.Targets, "targets", params.General.Targets, "is a list of targets to send notifications to. Default is \"discord\".") + + flag.Parse() + + log.Log("params loaded") + + return params +} diff --git a/wazuh-notify-go/services/init.go b/wazuh-notify-go/services/init.go deleted file mode 100644 index c7ed975..0000000 --- a/wazuh-notify-go/services/init.go +++ /dev/null @@ -1,101 +0,0 @@ -package services - -import ( - "bufio" - "encoding/json" - "flag" - "github.com/BurntSushi/toml" - "github.com/joho/godotenv" - "os" - "path" - "slices" - "strings" - "wazuh-notify/log" - "wazuh-notify/types" -) - -var inputParams types.Params -var configParams types.Params -var wazuhData types.WazuhMessage - -func InitNotify() types.Params { - BaseFilePath, _ := os.Executable() - BaseDirPath := path.Dir(BaseFilePath) - - log.OpenLogFile(BaseDirPath) - - err := godotenv.Load(path.Join(BaseDirPath, "../../etc/.env")) - if err != nil { - log.Log("env failed to load") - godotenv.Load(path.Join(BaseDirPath, ".env")) - } else { - log.Log("env loaded") - } - - tomlFile, err := os.ReadFile(path.Join(BaseDirPath, "../../etc/wazuh-notify-config.toml")) - if err != nil { - log.Log("toml failed to load") - tomlFile, err = os.ReadFile(path.Join(BaseDirPath, "wazuh-notify-config.toml")) - } - err = toml.Unmarshal(tomlFile, &configParams) - if err != nil { - print(err) - } - - log.Log("yaml loaded") - configParamString, _ := json.Marshal(configParams) - log.Log(string(configParamString)) - - flag.StringVar(&inputParams.Url, "url", "", "is the webhook URL of the Discord server. It is stored in .env.") - flag.StringVar(&inputParams.General.Click, "click", configParams.General.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") - flag.IntVar(&inputParams.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.") - flag.StringVar(&inputParams.General.Sender, "sender", configParams.General.Sender+" Golang", "is the sender of the message, either an app name or a person. The default is \"Security message\".") - flag.StringVar(&inputParams.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".") - flag.StringVar(&inputParams.General.Targets, "targets", "", "is a list of targets to send notifications to. Default is \"discord\".") - - flag.Parse() - - log.Log("params loaded") - inputParamString, _ := json.Marshal(inputParams) - log.Log(string(inputParamString)) - - inputParams.General.Targets = configParams.General.Targets - inputParams.General.FullAlert = configParams.General.FullAlert - inputParams.General.ExcludedAgents = configParams.General.ExcludedAgents - inputParams.General.ExcludedRules = configParams.General.ExcludedRules - inputParams.PriorityMap = configParams.PriorityMap - inputParams.MarkdownEmphasis = configParams.MarkdownEmphasis - - wazuhInput() - - return inputParams -} - -func wazuhInput() { - reader := bufio.NewReader(os.Stdin) - - json.NewDecoder(reader).Decode(&wazuhData) - - inputParams.Tags += strings.Join(wazuhData.Parameters.Alert.Rule.Groups, ",") - - inputParams.WazuhMessage = wazuhData - - for i := range configParams.PriorityMap { - if slices.Contains(configParams.PriorityMap[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { - if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes%inputParams.PriorityMap[i].NotifyThreshold != 0 { - os.Exit(0) - } - inputParams.Color = inputParams.PriorityMap[i].Color - if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= inputParams.PriorityMap[i].MentionThreshold { - inputParams.Mention = "@here" - } - inputParams.Priority = 5 - i - } - } - - Filter() - - log.Log("Wazuh data loaded") - inputParamString, _ := json.Marshal(inputParams) - log.Log(string(inputParamString)) -} diff --git a/wazuh-notify-go/services/readConfig.go b/wazuh-notify-go/services/readConfig.go new file mode 100644 index 0000000..15f68ce --- /dev/null +++ b/wazuh-notify-go/services/readConfig.go @@ -0,0 +1,42 @@ +package services + +import ( + "github.com/BurntSushi/toml" + "github.com/joho/godotenv" + "os" + "path" + "wazuh-notify/log" + "wazuh-notify/types" +) + +func ReadConfig() types.Params { + + var configParams types.Params + + baseFilePath, _ := os.Executable() + baseDirPath := path.Dir(baseFilePath) + + log.OpenLogFile(baseDirPath) + + err := godotenv.Load(path.Join(baseDirPath, "../../etc/.env")) + if err != nil { + log.Log("env failed to load") + godotenv.Load(path.Join(baseDirPath, ".env")) + } else { + log.Log("env loaded") + } + + tomlFile, err := os.ReadFile(path.Join(baseDirPath, "../../etc/wazuh-notify-config.toml")) + if err != nil { + log.Log("toml failed to load") + tomlFile, err = os.ReadFile(path.Join(baseDirPath, "wazuh-notify-config.toml")) + } + err = toml.Unmarshal(tomlFile, &configParams) + if err != nil { + print(err) + } else { + log.Log("yaml loaded") + } + + return configParams +} diff --git a/wazuh-notify-go/services/wazuhData.go b/wazuh-notify-go/services/wazuhData.go new file mode 100644 index 0000000..ec9093f --- /dev/null +++ b/wazuh-notify-go/services/wazuhData.go @@ -0,0 +1,45 @@ +package services + +import ( + "bufio" + "encoding/json" + "os" + "slices" + "strings" + "wazuh-notify/log" + "wazuh-notify/types" +) + +func ParseWazuhInput(params types.Params) types.Params { + + var wazuhData types.WazuhMessage + + reader := bufio.NewReader(os.Stdin) + + json.NewDecoder(reader).Decode(&wazuhData) + + params.Tags += strings.Join(wazuhData.Parameters.Alert.Rule.Groups, ",") + + params.WazuhMessage = wazuhData + + for i := range params.PriorityMap { + if slices.Contains(params.PriorityMap[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { + if params.WazuhMessage.Parameters.Alert.Rule.Firedtimes%params.PriorityMap[i].NotifyThreshold != 0 { + log.Log("threshold not met") + log.CloseLogFile() + os.Exit(0) + } + params.Color = params.PriorityMap[i].Color + if params.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= params.PriorityMap[i].MentionThreshold { + params.Mention = "@here" + } + params.Priority = 5 - i + } + } + + log.Log("Wazuh data loaded") + + Filter(params) + + return params +} From 4e560878d4df3d3bd76ed9431525d39b7be91f6f Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 15:13:11 +0200 Subject: [PATCH 12/17] refactor folders --- wazuh-notify-go/main.go | 8 ++++---- wazuh-notify-go/services/{readConfig.go => config.go} | 2 +- wazuh-notify-go/services/filters.go | 2 +- wazuh-notify-go/services/flags.go | 2 +- wazuh-notify-go/{ => services}/log/log.go | 0 .../services/{messageBuilder.go => message.go} | 0 wazuh-notify-go/services/wazuhData.go | 2 +- wazuh-notify-go/{ => targets}/discord/discord.go | 0 wazuh-notify-go/{ => targets}/discord/types.go | 0 wazuh-notify-go/{ => targets}/ntfy/ntfy.go | 0 wazuh-notify-go/{ => targets}/ntfy/types.go | 0 wazuh-notify-go/{ => targets}/slack/slack.go | 0 wazuh-notify-go/{ => targets}/slack/types.go | 0 13 files changed, 8 insertions(+), 8 deletions(-) rename wazuh-notify-go/services/{readConfig.go => config.go} (96%) rename wazuh-notify-go/{ => services}/log/log.go (100%) rename wazuh-notify-go/services/{messageBuilder.go => message.go} (100%) rename wazuh-notify-go/{ => targets}/discord/discord.go (100%) rename wazuh-notify-go/{ => targets}/discord/types.go (100%) rename wazuh-notify-go/{ => targets}/ntfy/ntfy.go (100%) rename wazuh-notify-go/{ => targets}/ntfy/types.go (100%) rename wazuh-notify-go/{ => targets}/slack/slack.go (100%) rename wazuh-notify-go/{ => targets}/slack/types.go (100%) diff --git a/wazuh-notify-go/main.go b/wazuh-notify-go/main.go index 85c2abb..c11eb57 100644 --- a/wazuh-notify-go/main.go +++ b/wazuh-notify-go/main.go @@ -2,11 +2,11 @@ package main import ( "strings" - "wazuh-notify/discord" - "wazuh-notify/log" - "wazuh-notify/ntfy" "wazuh-notify/services" - "wazuh-notify/slack" + "wazuh-notify/services/log" + "wazuh-notify/targets/discord" + "wazuh-notify/targets/ntfy" + "wazuh-notify/targets/slack" ) func main() { diff --git a/wazuh-notify-go/services/readConfig.go b/wazuh-notify-go/services/config.go similarity index 96% rename from wazuh-notify-go/services/readConfig.go rename to wazuh-notify-go/services/config.go index 15f68ce..89f0b36 100644 --- a/wazuh-notify-go/services/readConfig.go +++ b/wazuh-notify-go/services/config.go @@ -5,7 +5,7 @@ import ( "github.com/joho/godotenv" "os" "path" - "wazuh-notify/log" + "wazuh-notify/services/log" "wazuh-notify/types" ) diff --git a/wazuh-notify-go/services/filters.go b/wazuh-notify-go/services/filters.go index efd7458..76f5316 100644 --- a/wazuh-notify-go/services/filters.go +++ b/wazuh-notify-go/services/filters.go @@ -3,7 +3,7 @@ package services import ( "os" "strings" - "wazuh-notify/log" + "wazuh-notify/services/log" "wazuh-notify/types" ) diff --git a/wazuh-notify-go/services/flags.go b/wazuh-notify-go/services/flags.go index df76e3b..a95d16b 100644 --- a/wazuh-notify-go/services/flags.go +++ b/wazuh-notify-go/services/flags.go @@ -2,7 +2,7 @@ package services import ( "flag" - "wazuh-notify/log" + "wazuh-notify/services/log" "wazuh-notify/types" ) diff --git a/wazuh-notify-go/log/log.go b/wazuh-notify-go/services/log/log.go similarity index 100% rename from wazuh-notify-go/log/log.go rename to wazuh-notify-go/services/log/log.go diff --git a/wazuh-notify-go/services/messageBuilder.go b/wazuh-notify-go/services/message.go similarity index 100% rename from wazuh-notify-go/services/messageBuilder.go rename to wazuh-notify-go/services/message.go diff --git a/wazuh-notify-go/services/wazuhData.go b/wazuh-notify-go/services/wazuhData.go index ec9093f..8e7a220 100644 --- a/wazuh-notify-go/services/wazuhData.go +++ b/wazuh-notify-go/services/wazuhData.go @@ -6,7 +6,7 @@ import ( "os" "slices" "strings" - "wazuh-notify/log" + "wazuh-notify/services/log" "wazuh-notify/types" ) diff --git a/wazuh-notify-go/discord/discord.go b/wazuh-notify-go/targets/discord/discord.go similarity index 100% rename from wazuh-notify-go/discord/discord.go rename to wazuh-notify-go/targets/discord/discord.go diff --git a/wazuh-notify-go/discord/types.go b/wazuh-notify-go/targets/discord/types.go similarity index 100% rename from wazuh-notify-go/discord/types.go rename to wazuh-notify-go/targets/discord/types.go diff --git a/wazuh-notify-go/ntfy/ntfy.go b/wazuh-notify-go/targets/ntfy/ntfy.go similarity index 100% rename from wazuh-notify-go/ntfy/ntfy.go rename to wazuh-notify-go/targets/ntfy/ntfy.go diff --git a/wazuh-notify-go/ntfy/types.go b/wazuh-notify-go/targets/ntfy/types.go similarity index 100% rename from wazuh-notify-go/ntfy/types.go rename to wazuh-notify-go/targets/ntfy/types.go diff --git a/wazuh-notify-go/slack/slack.go b/wazuh-notify-go/targets/slack/slack.go similarity index 100% rename from wazuh-notify-go/slack/slack.go rename to wazuh-notify-go/targets/slack/slack.go diff --git a/wazuh-notify-go/slack/types.go b/wazuh-notify-go/targets/slack/types.go similarity index 100% rename from wazuh-notify-go/slack/types.go rename to wazuh-notify-go/targets/slack/types.go From 2872f88a25070c4a30bd4c5623434e0062dae6c9 Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 15:29:39 +0200 Subject: [PATCH 13/17] go mod fix --- wazuh-notify-go/go.mod | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/wazuh-notify-go/go.mod b/wazuh-notify-go/go.mod index 463f281..817cce4 100644 --- a/wazuh-notify-go/go.mod +++ b/wazuh-notify-go/go.mod @@ -3,8 +3,6 @@ module wazuh-notify go 1.22 require ( + github.com/BurntSushi/toml v1.4.0 github.com/joho/godotenv v1.5.1 - gopkg.in/yaml.v2 v2.4.0 ) - -require github.com/BurntSushi/toml v1.4.0 // indirect From af2887edc23f5a31070de7c3ecf91c1a73599c92 Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 15:39:50 +0200 Subject: [PATCH 14/17] useless flags removed --- wazuh-notify-go/services/flags.go | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/wazuh-notify-go/services/flags.go b/wazuh-notify-go/services/flags.go index a95d16b..160a56b 100644 --- a/wazuh-notify-go/services/flags.go +++ b/wazuh-notify-go/services/flags.go @@ -8,16 +8,13 @@ import ( func ParseFlags(params types.Params) types.Params { - flag.StringVar(¶ms.Url, "url", "", "is the webhook URL of the Discord server. It is stored in .env.") flag.StringVar(¶ms.General.Click, "click", params.General.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") - flag.IntVar(¶ms.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.") flag.StringVar(¶ms.General.Sender, "sender", params.General.Sender+" Golang", "is the sender of the message, either an app name or a person. The default is \"Security message\".") - flag.StringVar(¶ms.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".") flag.StringVar(¶ms.General.Targets, "targets", params.General.Targets, "is a list of targets to send notifications to. Default is \"discord\".") flag.Parse() - log.Log("params loaded") + log.Log("flags loaded") return params } From 7377fdda65c6f081e096737e7cb0fb6b54b5bef8 Mon Sep 17 00:00:00 2001 From: darius Date: Mon, 27 May 2024 15:49:04 +0200 Subject: [PATCH 15/17] comments added --- wazuh-notify-go/main.go | 5 +++-- wazuh-notify-go/services/config.go | 8 ++++---- wazuh-notify-go/services/flags.go | 4 ++-- wazuh-notify-go/services/wazuhData.go | 13 ++++++++----- wazuh-notify-go/targets/discord/discord.go | 8 ++++---- wazuh-notify-go/targets/ntfy/ntfy.go | 6 +++--- wazuh-notify-go/targets/slack/slack.go | 6 +++--- 7 files changed, 27 insertions(+), 23 deletions(-) diff --git a/wazuh-notify-go/main.go b/wazuh-notify-go/main.go index c11eb57..87e2bdc 100644 --- a/wazuh-notify-go/main.go +++ b/wazuh-notify-go/main.go @@ -10,10 +10,11 @@ import ( ) func main() { + //Read config file and .env configParams := services.ReadConfig() - + //Parse command line flags inputParams := services.ParseFlags(configParams) - + //Parse wazuh input data from stdin Params := services.ParseWazuhInput(inputParams) for _, target := range strings.Split(Params.General.Targets, ", ") { diff --git a/wazuh-notify-go/services/config.go b/wazuh-notify-go/services/config.go index 89f0b36..a0285ee 100644 --- a/wazuh-notify-go/services/config.go +++ b/wazuh-notify-go/services/config.go @@ -12,12 +12,12 @@ import ( func ReadConfig() types.Params { var configParams types.Params - + //Get Path of executable location baseFilePath, _ := os.Executable() baseDirPath := path.Dir(baseFilePath) - + //Open log file and set first message log.OpenLogFile(baseDirPath) - + //Load .env into environment variables err := godotenv.Load(path.Join(baseDirPath, "../../etc/.env")) if err != nil { log.Log("env failed to load") @@ -25,7 +25,7 @@ func ReadConfig() types.Params { } else { log.Log("env loaded") } - + //Read config file tomlFile, err := os.ReadFile(path.Join(baseDirPath, "../../etc/wazuh-notify-config.toml")) if err != nil { log.Log("toml failed to load") diff --git a/wazuh-notify-go/services/flags.go b/wazuh-notify-go/services/flags.go index 160a56b..39aa301 100644 --- a/wazuh-notify-go/services/flags.go +++ b/wazuh-notify-go/services/flags.go @@ -7,11 +7,11 @@ import ( ) func ParseFlags(params types.Params) types.Params { - + //Set command line flags flag.StringVar(¶ms.General.Click, "click", params.General.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") flag.StringVar(¶ms.General.Sender, "sender", params.General.Sender+" Golang", "is the sender of the message, either an app name or a person. The default is \"Security message\".") flag.StringVar(¶ms.General.Targets, "targets", params.General.Targets, "is a list of targets to send notifications to. Default is \"discord\".") - + //Get flag values flag.Parse() log.Log("flags loaded") diff --git a/wazuh-notify-go/services/wazuhData.go b/wazuh-notify-go/services/wazuhData.go index 8e7a220..ac24a7f 100644 --- a/wazuh-notify-go/services/wazuhData.go +++ b/wazuh-notify-go/services/wazuhData.go @@ -13,23 +13,26 @@ import ( func ParseWazuhInput(params types.Params) types.Params { var wazuhData types.WazuhMessage - + //Read stdin reader := bufio.NewReader(os.Stdin) - + //Decode stdin to wazuhData json.NewDecoder(reader).Decode(&wazuhData) - + //Parse tags params.Tags += strings.Join(wazuhData.Parameters.Alert.Rule.Groups, ",") params.WazuhMessage = wazuhData - + //Map priority and color based on config for i := range params.PriorityMap { if slices.Contains(params.PriorityMap[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { + //Check notify threshold if params.WazuhMessage.Parameters.Alert.Rule.Firedtimes%params.PriorityMap[i].NotifyThreshold != 0 { log.Log("threshold not met") log.CloseLogFile() os.Exit(0) } + //Set color based on config map params.Color = params.PriorityMap[i].Color + //Check mention threshold if params.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= params.PriorityMap[i].MentionThreshold { params.Mention = "@here" } @@ -38,7 +41,7 @@ func ParseWazuhInput(params types.Params) types.Params { } log.Log("Wazuh data loaded") - + //Filter messages based on rules defined in config Filter(params) return params diff --git a/wazuh-notify-go/targets/discord/discord.go b/wazuh-notify-go/targets/discord/discord.go index 734bf5f..fced433 100644 --- a/wazuh-notify-go/targets/discord/discord.go +++ b/wazuh-notify-go/targets/discord/discord.go @@ -11,11 +11,11 @@ import ( ) func SendDiscord(params types.Params) { - + //Build message content embedDescription := services.BuildMessage(params, "discord", params.MarkdownEmphasis.Discord) + "**Tags:** " + params.Tags + "\n\n" + params.General.Click - + //Build message message := DiscordMessage{ Username: params.General.Sender, Content: params.Mention, @@ -29,12 +29,12 @@ func SendDiscord(params types.Params) { } payload := new(bytes.Buffer) - + //Parse message to json err := json.NewEncoder(payload).Encode(message) if err != nil { return } - + //Send message to webhook _, err = http.Post(os.Getenv("DISCORD_URL"), "application/json", payload) if err != nil { log.Fatalf("An Error Occured %v", err) diff --git a/wazuh-notify-go/targets/ntfy/ntfy.go b/wazuh-notify-go/targets/ntfy/ntfy.go index d6a0dfd..1d27848 100644 --- a/wazuh-notify-go/targets/ntfy/ntfy.go +++ b/wazuh-notify-go/targets/ntfy/ntfy.go @@ -10,14 +10,14 @@ import ( ) func SendNtfy(params types.Params) { - + //Create request and build message req, _ := http.NewRequest( "POST", os.Getenv("NTFY_URL"), strings.NewReader(" "+services.BuildMessage(params, "ntfy", params.MarkdownEmphasis.Ntfy))) req.Header.Set("Content-Type", "text/markdown") - + //Set headers if not empty if params.General.Sender != "" { req.Header.Add("Title", params.General.Sender) } @@ -30,6 +30,6 @@ func SendNtfy(params types.Params) { if params.Priority != 0 { req.Header.Add("Priority", strconv.Itoa(params.Priority)) } - + //Send request http.DefaultClient.Do(req) } diff --git a/wazuh-notify-go/targets/slack/slack.go b/wazuh-notify-go/targets/slack/slack.go index 3aa6f4c..d8c0351 100644 --- a/wazuh-notify-go/targets/slack/slack.go +++ b/wazuh-notify-go/targets/slack/slack.go @@ -11,7 +11,7 @@ import ( ) func SendSlack(params types.Params) { - + //Build message message := SlackMessage{ Text: services.BuildMessage(params, "slack", params.MarkdownEmphasis.Slack) + "*Tags:* " + params.Tags + "\n\n" + @@ -19,12 +19,12 @@ func SendSlack(params types.Params) { } payload := new(bytes.Buffer) - + //Parse message to json err := json.NewEncoder(payload).Encode(message) if err != nil { return } - + //Send message to webhook _, err = http.Post(os.Getenv("SLACK_URL"), "application/json", payload) if err != nil { log.Fatalf("An Error Occured %v", err) From c2b1099a4b73165a57b56b451c0784655c2c7bca Mon Sep 17 00:00:00 2001 From: Rudi Klein Date: Mon, 27 May 2024 20:24:00 +0200 Subject: [PATCH 16/17] Over to TOML and refactored. Testing needed. --- wazuh-notify-config.yaml | 66 ----- wazuh-notify-go/wazuh-notify-config.toml | 2 +- wazuh-notify-python/wazuh-notify.py | 175 +++++-------- wazuh-notify-python/wazuh_notify_module.py | 272 ++++++++------------- 4 files changed, 164 insertions(+), 351 deletions(-) delete mode 100644 wazuh-notify-config.yaml diff --git a/wazuh-notify-config.yaml b/wazuh-notify-config.yaml deleted file mode 100644 index 0ed1837..0000000 --- a/wazuh-notify-config.yaml +++ /dev/null @@ -1,66 +0,0 @@ ---- -# Start of wazuh notifier configuration yaml. - -# This is the yaml config file for wazuh-active-response (for both the Python and Go version) - -targets: "slack, ntfy, discord" # Platforms in this string with comma seperated values are triggered. -full_message: "" # Platforms in this string will enable sending the full event information. -full_alert: "" # Platforms in this string will enable sending the full event information. - -# Exclude rule events that are enabled in the ossec.conf active response definition. -# These settings provide an easier way to disable events from firing the notifiers. - -excluded_rules: "99999, 00000" # Enter as a string with comma seperated values -excluded_agents: "99999" # Enter as a string with comma seperated values - -# Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) -# https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html -# Enter threat_map as lists of integers, mention_threshold as integer and color as Hex integer - -priority_map: - - threat_map: [ 15,14,13,12 ] - mention_threshold: 1 - color: 0xec3e40 # Red, SEVERE - - threat_map: [ 11,10,9 ] - mention_threshold: 1 - color: 0xff9b2b # Orange, HIGH - - threat_map: [ 8,7,6 ] - mention_threshold: 5 - color: 0xf5d800 # Yellow, ELEVATED - - threat_map: [ 5,4 ] - mention_threshold: 20 - color: 0x377fc7 # Blue, GUARDED - - threat_map: [ 3,2,1,0 ] - mention_threshold: 20 - color: 0x01a465 # Green, LOW - -# The next 2 settings are used to add information to the messages. -sender: "Wazuh (IDS)" -click: "https://documentation.wazuh.com/" - -########################################################################################### -# From here on the settings are ONLY used by the Python version of wazuh-active-response. # -########################################################################################### - -# Below settings provide for a window that enable/disables events from firing the notifiers. -excluded_days: "" # Enter as a string with comma seperated values. Be aware of your regional settings. -excluded_hours: [ "23:59", "00:00" ] # Enter as a tuple of string values. Be aware of your regional settings. - -# Following parameter defines the markdown characters to emphasise the parameter names in the notification messages -markdown_emphasis: - slack: "*" - ntfy: "**" - discord: "**" - -# The next settings are used for testing. Test mode will add the example event in wazuh-notify-test-event.json instead of the -# message received through wazuh. This enables testing for particular events when the test event is customized. -test_mode: False - -# Enabling this parameter provides more logging to the wazuh-notifier log. -extended_logging: 2 - -# Enabling this parameter provides extended logging to the console. -extended_print: 0 - -# End of wazuh notifier configuration yaml -... diff --git a/wazuh-notify-go/wazuh-notify-config.toml b/wazuh-notify-go/wazuh-notify-config.toml index 6aeb34c..7d94861 100644 --- a/wazuh-notify-go/wazuh-notify-config.toml +++ b/wazuh-notify-go/wazuh-notify-config.toml @@ -20,7 +20,7 @@ click = "https://documentation.wazuh.com/" # Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) # https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html -# Enter threat_map as lists of integers, mention_threshold as integer and color as Hex integer +# Enter threat_map as lists of integers, mention/notify_threshold as integer and color as Hex integer [[priority_map]] threat_map = [15, 14, 13, 12] mention_threshold = 1 diff --git a/wazuh-notify-python/wazuh-notify.py b/wazuh-notify-python/wazuh-notify.py index ec4c462..42afdb9 100755 --- a/wazuh-notify-python/wazuh-notify.py +++ b/wazuh-notify-python/wazuh-notify.py @@ -5,7 +5,7 @@ # License (version 2) as published by the FSF - Free Software # Foundation. # -# Rudi Klein, april 2024 +# Rudi Klein, May 2024 import requests @@ -14,168 +14,117 @@ from wazuh_notify_module import * def main(): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. me = frame(0).f_code.co_name him = frame(1).f_code.co_name - # Load the YAML config. - + # Load the TOML config. config: dict = get_config() - logger(0, config, me, him, "############ Processing event ###############################") - logger(2, config, me, him, "Loading yaml configuration") # Get the arguments used with running the script. - arguments = get_arguments() - # Check if we are in test mode (test_mode setting in config yaml). If so, load test event instead of live event. - if config.get('python', 'test_mode'): - - logger(1, config, me, him, "Running in test mode: using test message wazuh-notify-test-event.json") - - # Load the test event data. - - home_path, _, _ = set_environment() - with (open(home_path + '/etc/wazuh-notify-test-event.json') as event_file): - data: dict = json.loads(event_file.read()) - - else: - - # We are running live. Load the data from the Wazuh process. - - logger(2, config, me, him, "Running in live mode: using live message") - data = load_message() + # Check for test mode. Use test data if true + data = check_test_mode(config) # Extract the 'alert' section of the (JSON) event - alert = data["parameters"]["alert"] logger(2, config, me, him, "Extracting data from the event") - # Check the config for any exclusion rules - - fire_notification = exclusions_check(config, alert) - logger(1, config, me, him, "Checking if we are outside of the exclusion rules: " + str(fire_notification)) - - if not fire_notification: - - # The event was excluded by the exclusion rules in the configuration. - - logger(1, config, me, him, "Event excluded, no notification sent. Exiting") - exit() - else: - - # The event was not excluded by the exclusion rules in the configuration. Keep processing. - - logger(2, config, me, him, "Event NOT excluded, notification will be sent") + # Check the config for any exclusion rules and abort when excluded. + exclusions_check(config, alert) # Get the mapping from event threat level to priority, color and mention_flag. - priority, color, mention = threat_mapping(config, alert['rule']['level'], alert['rule']['firedtimes']) - logger(2, config, me, him, "Threat mapping done: " + - "prio:" + str(priority) + " color:" + str(color) + " mention:" + mention) - # If the target argument was used with the script, we'll use that instead of the configuration parameter. - config["targets"] = arguments['targets'] if arguments['targets'] != "" else config["targets"] - # Prepare the messaging platform specific request and execute - + # Prepare the messaging platform specific notification and execute if configured. if "discord" in config["targets"]: + # Show me some ID! Stop resisting! caller = "discord" + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name # Load the url/webhook from the configuration. - discord_url, _, _ = get_env() - discord_url = arguments['url'] if arguments['url'] else discord_url - # Build the basic notification message content. + # Build the basic message content. + message_body: str = construct_message_body(caller, config, arguments, alert) - notification: str = construct_basic_message(config, arguments, caller, alert) - logger(2, config, me, him, caller + " basic message constructed") + # Common preparation of the notification. + notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, priority) # Build the payload(s) for the POST request. + _, _, payload_json = build_discord_notification(caller, config, notification_body, color, mention, sender) - _, _, payload_json = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) + # Build the notification to be sent. + build_discord_notification(caller, config, notification_body, color, mention, sender) # POST the notification through requests. - - result = requests.post(discord_url, json=payload_json) - - logger(1, config, me, him, caller + " notification constructed and HTTPS request done: " + str(result)) + discord_result = requests.post(discord_url, json=payload_json) + logger(1, config, me, him, caller + " notification constructed and sent: " + str(discord_result)) if "ntfy" in config["targets"]: + # Show me some ID! Stop resisting! caller = "ntfy" + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name # Load the url/webhook from the configuration. - _, ntfy_url, _ = get_env() + ntfy_url = arguments['url'] if arguments['url'] else ntfy_url - # Build the basic notification message content. + # Build the basic message content. + message_body: str = construct_message_body(caller, config, arguments, alert) - notification: str = construct_basic_message(config, arguments, caller, alert) - - logger(2, config, me, him, caller + " basic message constructed") + # Common preparation of the notification. + notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, priority) # Build the payload(s) for the POST request. - payload_headers, payload_data, _ = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) + payload_headers, payload_data, _ = build_ntfy_notification(caller, config, notification_body, color, mention, + sender) + + # Build the notification to be sent. + build_ntfy_notification(caller, config, notification_body, priority, click, sender) # POST the notification through requests. + ntfy_result = requests.post(ntfy_url, data=payload_data, headers=payload_headers) + logger(1, config, me, him, caller + " notification constructed and sent: " + str(ntfy_result)) - result = requests.post(ntfy_url, data=payload_data, headers=payload_headers) - logger(1, config, me, him, caller + " notification constructed and request done: " + str(result)) - - if "slack" in config["targets"]: - caller = "slack" - - # Load the url/webhook from the configuration. - - _, _, slack_url = get_env() - - # Build the basic notification message content. - - notification: str = construct_basic_message(config, arguments, caller, alert) - - logger(2, config, me, him, caller + " basic message constructed") - - # Build the payload(s) for the POST request. - - _, _, payload_json = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) - - # POST the notification through requests. - - result = requests.post(slack_url, headers={'Content-Type': 'application/json'}, json=payload_json) - - logger(1, config, me, him, caller + " notification constructed and request done: " + str(result)) + # if "slack" in config["targets"]: + # # Show me some ID! Stop resisting! + # caller = "slack" + # me = frame(0).f_code.co_name + # him = frame(1).f_code.co_name + # + # # Load the url/webhook from the configuration. + # _, _, slack_url = get_env() + # slack_url = arguments['url'] if arguments['url'] else slack_url + # + # # Build the basic message content. + # message_body: str = construct_message_body(caller, config, arguments, data) + # + # # Common preparation of the notification. + # notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, + # priority) + # # Build the payload(s) for the POST request. + # _, _, payload_json = build_slack_notification(caller, config, notification_body, priority, color, mention, + # click, sender) + # + # # Build the notification to be sent. + # build_slack_notification(caller, config, notification_body, priority, click, sender) + # + # result = requests.post(slack_url, headers={'Content-Type': 'application/json'}, json=payload_json) + # + # logger(1, config, me, him, caller + " notification constructed and sent: " + str(result)) logger(0, config, me, him, "############ Event processed ################################") exit(0) -if __name__ == "__main__": +if "__main__" == __name__: main() diff --git a/wazuh-notify-python/wazuh_notify_module.py b/wazuh-notify-python/wazuh_notify_module.py index e173917..c508db8 100755 --- a/wazuh-notify-python/wazuh_notify_module.py +++ b/wazuh-notify-python/wazuh_notify_module.py @@ -26,14 +26,11 @@ def set_environment() -> tuple: # Set paths for use in this module - wazuh_path, log_path, config_path = set_environment() # Set structured timestamps for notifications. - def set_time_format(): - now_message = time.strftime('%A, %d %b %Y %H:%M:%S') now_logging = time.strftime('%Y-%m-%d %H:%M:%S') now_time = time.strftime('%H:%M') @@ -43,53 +40,40 @@ def set_time_format(): # Logger: print to console and/or log to file - def logger(level, config, me, him, message): _, now_logging, _, _ = set_time_format() - + logger_wazuh_path = os.path.abspath(os.path.join(__file__, "../../..")) logger_log_path = '{0}/logs/wazuh-notify.log'.format(logger_wazuh_path) # When logging from main(), the destination function is called "". For cosmetic reasons rename to "main". - him = 'main' if him == '' else him - - log_line = f'{now_logging} | {level} | {me: <23} | {him: <15} | {message}' + log_line = f'{now_logging} | {level} | {me: <26} | {him: <13} | {message}' # Compare the extended_print log level in the configuration to the log level of the message. - if config.get('python').get('extended_print', 0) >= level: print(log_line) - try: # Compare the extended_logging level in the configuration to the log level of the message. - if config.get('python').get('extended_logging', 0) >= level: with open(logger_log_path, mode="a") as log_file: log_file.write(log_line + "\n") - except (FileNotFoundError, PermissionError, OSError): - # Special message to console when logging to file fails and console logging might not be set. - - log_line = f'{now_logging} | {level} | {me: <23} | {him: <15} | error opening log file: {logger_log_path}' + log_line = f'{now_logging} | {level} | {me: <26} | {him: <13} | error opening log file: {logger_log_path}' print(log_line) # Get the content of the .env file (url's and/or webhooks). - def get_env(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Write the configuration to a dictionary. - config: dict = get_config() # Check if the secrets .env file is available. - try: dotenv_path = join(dirname(__file__), '.env') load_dotenv(dotenv_path) @@ -98,43 +82,34 @@ def get_env(): raise Exception(dotenv_path, "file not found") # Retrieve URLs from .env - discord_url = os.getenv("DISCORD_URL") ntfy_url = os.getenv("NTFY_URL") slack_url = os.getenv("SLACK_URL") except Exception as err: - # output error, and return with an error code - logger(0, config, me, him, 'Error reading ' + str(err)) exit(err) - logger(2, config, me, him, dotenv_path + " loaded") return discord_url, ntfy_url, slack_url # Read and process configuration settings from wazuh-notify-config.yaml and create dictionary. - def get_config(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - this_config_path: str = "" config: dict = {} + # logger(2, config, me, him, "Loading TOML configuration") try: _, _, this_config_path = set_environment() - with open(this_config_path, 'rb') as ntfier_config: config: dict = tomli.load(ntfier_config) - except (FileNotFoundError, PermissionError, OSError): logger(2, config, me, him, "Error accessing configuration file: " + this_config_path) - logger(2, config, me, him, "Reading configuration file: " + this_config_path) config['targets'] = config.get('general').get('targets', 'discord, slack, ntfy') @@ -145,7 +120,6 @@ def get_config(): config['sender'] = config.get('general').get('sender', 'Wazuh (IDS)') config['click'] = config.get('general').get('click', 'https://wazuh.com') config['md_e'] = config.get('general').get('markdown_emphasis', '') - config['excluded_days'] = config.get('python').get('excluded_days', '') config['excluded_hours'] = config.get('python').get('excluded_hours', '') config['test_mode'] = config.get('python').get('test_mode', False) @@ -156,9 +130,7 @@ def get_config(): # Show configuration settings from wazuh-notify-config.yaml - def view_config(): - _, _, this_config_path, _ = set_environment() try: @@ -170,23 +142,18 @@ def view_config(): # Get script arguments during execution. Params found here override config settings. - def get_arguments(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Retrieve the configuration information - config: dict = get_config() # Short options - options: str = "u:s:p:m:t:c:hv" # Long options - long_options: list = ["url=", "sender=", "targets=", @@ -212,7 +179,6 @@ def get_arguments(): """ # Initialize some variables. - url: str = "" sender: str = "" targets: str = "" @@ -222,17 +188,13 @@ def get_arguments(): click: str = "" # Fetch the arguments from the command line, skipping the first argument (name of the script). - argument_list: list = sys.argv[1:] - logger(2, config, me, him, "Found arguments:" + str(argument_list)) if not argument_list: - logger(1, config, me, him, 'No argument list found (no arguments provided with script execution') # Store defaults for the non-existing arguments in the arguments dictionary to avoid None errors. - arguments: dict = {'url': url, 'sender': sender, 'targets': targets, @@ -241,78 +203,55 @@ def get_arguments(): 'tags': tags, 'click': click} return arguments - else: - try: - logger(2, config, me, him, "Parsing arguments") # Parsing arguments - p_arguments, values = getopt.getopt(argument_list, options, long_options) # Check each argument. Arguments that are present will override the defaults. - for current_argument, current_value in p_arguments: - if current_argument in ("-h", "--help"): print(help_text) exit() - elif current_argument in ("-v", "--view"): view_config() exit() - elif current_argument in ("-u", "--url"): url: str = current_value - elif current_argument in ("-s", "--sender"): sender: str = current_value - elif current_argument in ("-d", "--targets"): targets: str = current_value - elif current_argument in ("-p", "--priority"): priority: int = int(current_value) - elif current_argument in ("-m", "--message"): message: str = current_value - elif current_argument in ("-t", "--tags"): tags: str = current_value - elif current_argument in ("-c", "--click"): click: str = current_value - except getopt.error as err: # Output error, and return error code - logger(0, config, me, him, "Error during argument parsing:" + str(err)) - logger(2, config, me, him, "Arguments returned as dictionary") # Store the arguments in the arguments dictionary. - arguments: dict = {'url': url, 'sender': sender, 'targets': targets, 'message': message, 'priority': priority, 'tags': tags, 'click': click} - return arguments # Receive and load message from Wazuh - def load_message(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - config: dict = get_config() # get alert from stdin - logger(2, config, me, him, "Loading event message from STDIN") input_str: str = "" @@ -325,153 +264,136 @@ def load_message(): if data.get("command") == "add": logger(1, config, me, him, "Relevant event data found") return data - else: - # Event came in, but wasn't processed. - logger(0, config, me, him, "Event data not found") sys.exit(1) -# Check if there are reasons not to process this event. Check exclusions for rules, agents, days and hours. +# Check if we are in test mode (test_mode setting in config yaml). If so, load test event instead of live event. +def check_test_mode(config): + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + if config.get('python').get('test_mode'): + logger(1, config, me, him, "Running in test mode: using test message wazuh-notify-test-event.json") + # Load the test event data. + home_path, _, _ = set_environment() + with (open(home_path + '/etc/wazuh-notify-test-event.json') as event_file): + data: dict = json.loads(event_file.read()) + else: + # We are running live. Load the data from the Wazuh process. + logger(2, config, me, him, "Running in live mode: using live message") + data = load_message() + return data + + +# Check if there are reasons not to process this event. Check exclusions for rules, agents, days and hours. def exclusions_check(config, alert): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Set some environment - now_message, now_logging, now_weekday, now_time = set_time_format() # Check the exclusion records from the configuration yaml. - - ex_hours: tuple = config.get('python', 'excluded_hours') + logger(1, config, me, him, "Checking if we are outside of the exclusion rules: ") + ex_hours: tuple = config.get('python').get('excluded_hours') # Start hour may not be later than end hours. End hour may not exceed 00:00 midnight to avoid day jump. - ################################################ ex_hours = [ex_hours[0], "23:59"] if (ex_hours[1] >= '23:59' or ex_hours[1] < ex_hours[0]) else ex_hours # Get some more exclusion records from the config. - ex_days = config.get('python').get('excluded_days') ex_agents = config.get('general').get("excluded_agents") ex_rules = config.get('general').get("excluded_rules") # Check agent and rule from within the event. - ev_agent = alert['agent']['id'] ev_rule = alert['rule']['id'] # Let's assume all lights are green, until proven otherwise. - ex_hours_eval, ex_weekday_eval, ev_rule_eval, ev_agent_eval = True, True, True, True # Evaluate the conditions for sending a notification. Any False will cause the notification to be discarded. - if (now_time > ex_hours[0]) and (now_time < ex_hours[1]): - logger(2, config, me, him, "excluded: event inside exclusion time frame") - ex_hours_eval = False - elif now_weekday in ex_days: - logger(2, config, me, him, "excluded: event inside excluded weekdays") - ex_weekday_eval = False elif ev_rule in ex_rules: - logger(2, config, me, him, "excluded: event id inside exclusion list") - ev_rule_eval = False - elif ev_agent in ex_agents: - logger(2, config, me, him, "excluded: event agent inside exclusion list") - ev_rule_eval = False notification_eval = True if (ex_hours_eval and ex_weekday_eval and ev_rule_eval and ev_agent_eval) else False - logger(1, config, me, him, "Exclusion rules evaluated. Final decision: " + str(notification_eval)) - return notification_eval + if not notification_eval: + # The event was excluded by the exclusion rules in the configuration. + logger(1, config, me, him, "Event excluded, no notification sent. Exiting") + exit() + else: + # The event was not excluded by the exclusion rules in the configuration. Keep processing. + logger(2, config, me, him, "Event NOT excluded, notification will be sent") + return # Map the event threat level to the appropriate 5-level priority scale and color for use in the notification platforms. - def threat_mapping(config, threat_level, fired_times): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Map threat level to priority. Enters Homeland Security :-). - p_map = config.get('priority_map') - logger(2, config, me, him, "Prio map: " + str(p_map)) for i in range(len(p_map)): - logger(2, config, me, him, "Loop: " + str(i)) logger(2, config, me, him, "Level: " + str(threat_level)) if threat_level in p_map[i]["threat_map"]: - color_mapping = p_map[i]["color"] priority_mapping = 5 - i - logger(2, config, me, him, "Prio: " + str(priority_mapping)) logger(2, config, me, him, "Color: " + str(color_mapping)) if fired_times >= p_map[i]["mention_threshold"]: - # When this flag is set, Discord recipients get a stronger message (DM). - mention_flag = "@here" - else: - mention_flag = "" - logger(2, config, me, him, "Threat level mapped as: " + "prio:" + str(priority_mapping) + " color: " + str(color_mapping) + " mention: " + mention_flag) - return priority_mapping, color_mapping, mention_flag logger(0, config, me, him, "Threat level mapping failed! Returning garbage (99, 99, 99)") - return 99, 99, "99" # Construct the message that will be sent to the notifier platforms. - -def construct_basic_message(config, arguments, caller: str, data: dict) -> str: +def construct_message_body(caller, config, arguments, data: dict) -> str: # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Include a specific control sequence for markdown bold parameter names. - - md_map = config.get('python').get('markdown_emphasis', '') + # todo To be fixed + md_map = config.get('markdown_emphasis', '') md_e = md_map[caller] # If the --message (-m) argument was fulfilled, use this message to be sent. - if arguments['message']: - - basic_msg = arguments['message'] - + message_body = arguments['message'] else: - _, timestamp, _, _ = set_time_format() - basic_msg: str = \ + message_body: str = \ ( md_e + "Timestamp:" + md_e + " " + timestamp + "\n" + md_e + "Agent:" + md_e + " " + data["agent"]["name"] + " (" + data["agent"]["id"] + ")" + "\n" + @@ -479,32 +401,25 @@ def construct_basic_message(config, arguments, caller: str, data: dict) -> str: md_e + "Rule:" + md_e + " " + data["rule"]["description"] + "\n" + md_e + "Description:" + md_e + " " + data["full_log"] + "\n" + md_e + "Threat level:" + md_e + " " + str(data["rule"]["level"]) + "\n" + - md_e + "Times fired:" + md_e + " " + str(data["rule"]["firedtimes"]) + "\n") - - if caller == "ntfy": - # todo Check this out - basic_msg = " \n" + basic_msg + md_e + "Times fired:" + md_e + " " + str(data["rule"]["firedtimes"]) + "\n" + ) logger(2, config, me, him, caller + " basic message constructed.") - - return basic_msg + return message_body # Construct the notification (message + additional information) that will be sent to the notifier platforms. - -def build_notification(caller, config, arguments, notification, alert, priority, color, mention): +def prepare_payload(caller, config, arguments, message_body, alert, priority): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - logger(2, config, me, him, caller + " notification being constructed.") + logger(2, config, me, him, "Notification being constructed.") - md_map = config.get('python').get('markdown_emphasis', '') + md_map = config.get('markdown_emphasis', '') md_e = md_map[caller] click: str = config.get('general').get('click', 'https://wazuh.com') - sender: str = config.get('general').get('sender', 'Wazuh (IDS)') priority: str = str(priority) tags = (str(alert['rule']['groups']).replace("[", "") .replace("]", "") @@ -522,70 +437,85 @@ def build_notification(caller, config, arguments, notification, alert, priority, .replace(',', ' ') ) # Fill some of the variables with argument values if available. - # todo Redundant? - click = arguments['click'] if arguments['click'] else click priority = arguments['priority'] if arguments['priority'] else priority - sender = arguments['sender'] if arguments['sender'] else sender tags = arguments['tags'] if arguments['tags'] else tags + sender: str = config.get('general').get('sender', 'Wazuh (IDS)') + sender = arguments['sender'] if arguments['sender'] else sender + click: str = config.get('general').get('click', 'https://wazuh.com') + click = arguments['click'] if arguments['click'] else click # Add the full alert data to the notification. - if caller in config["full_alert"]: - logger(2, config, me, him, caller + "Full alert data will be sent.") - - notification: str = ("\n\n" + notification + "\n" + - md_e + "__Full event__" + md_e + "\n" + "```\n" + full_event + "```") - - # Add Priority & tags to the notification + logger(2, config, me, him, caller + "Full alert data will be attached.") + # Add the full alert data to the notification body + notification_body: str = ("\n\n" + message_body + "\n" + + md_e + "__Full event__" + md_e + "\n" + "```\n" + full_event + "```") + else: + notification_body: str = message_body + # Add priority & tags to the notification body + notification_body = (notification_body + "\n\n" + md_e + "Priority:" + md_e + " " + str(priority) + "\n" + + md_e + "Tags:" + md_e + " " + tags + "\n\n" + click) logger(2, config, me, him, caller + " adding priority and tags") - notification = (notification + "\n\n" + md_e + "Priority:" + md_e + " " + str(priority) + "\n" + - md_e + "Tags:" + md_e + " " + tags + "\n\n" + click) - config["targets"] = arguments['targets'] if arguments['targets'] != "" else config["targets"] - # Prepare the messaging platform specific notification and execute + return notification_body, click, sender - if caller == "discord": - logger(2, config, me, him, caller + " payload created") - payload_json = {"username": sender, - "content": mention, - "embeds": [{"description": notification, - "color": color, - "title": sender}]} +def build_discord_notification(caller, config, notification_body, color, mention, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + logger(2, config, me, him, caller + " payload created") - logger(2, config, me, him, caller + " notification built") + payload_json = {"username": sender, + "content": mention, + "embeds": [{"description": notification_body, + "color": color, + "title": sender}]} + logger(2, config, me, him, caller + " notification built") + return "", "", payload_json - return "", "", payload_json - if caller == "ntfy": - logger(2, config, me, him, caller + " payloads created") +def build_ntfy_notification(caller, config, notification_body, priority, click, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + logger(2, config, me, him, caller + " payloads created") - payload_data = notification - payload_headers = {"Markdown": "yes", - "Title": sender, - "Priority": str(priority), - "Click": click} + # if caller == "ntfy": + # todo Check this out + # basic_msg = " \n" + basic_msg - logger(2, config, me, him, caller + " notification built") + payload_data = notification_body + payload_headers = {"Markdown": "yes", + "Title": sender, + "Priority": str(priority), + "Click": click} + logger(2, config, me, him, caller + " notification built") + return payload_headers, payload_data, "" - return payload_headers, payload_data, "" - if caller == "slack": - logger(2, config, me, him, caller + " payloads created") +def build_slack_notification(caller, config, arguments, notification_body, priority, color, mention, click, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + sender: str = config.get('general').get('sender', 'Wazuh (IDS)') + sender = arguments['sender'] if arguments['sender'] else sender - # todo Need some investigation. + logger(2, config, me, him, caller + " payloads created") - payload_json = {"text": notification} - # payload_json = {"username": sender, - # "content": mention, - # "embeds": [{"description": notification, - # "color": color, - # "title": sender}]} + # todo Need some investigation. - logger(2, config, me, him, caller + " notification built") + payload_json = {"text": notification_body} + # payload_json = {"username": sender, + # "content": mention, + # "embeds": [{"description": notification, + # "color": color, + # "title": sender}]} - return "", "", payload_json + logger(2, config, me, him, caller + " notification built") + + return "", "", payload_json From ed5fb44020dbce707f11ab66d3c86832d026bdae Mon Sep 17 00:00:00 2001 From: darius Date: Tue, 28 May 2024 10:03:44 +0200 Subject: [PATCH 17/17] merge fix --- wazuh-notify-go/wazuh-notify-config.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 wazuh-notify-go/wazuh-notify-config.yaml diff --git a/wazuh-notify-go/wazuh-notify-config.yaml b/wazuh-notify-go/wazuh-notify-config.yaml deleted file mode 100644 index e69de29..0000000