diff --git a/wazuh-notify-config.yaml b/wazuh-notify-config.yaml deleted file mode 100644 index 0ed1837..0000000 --- a/wazuh-notify-config.yaml +++ /dev/null @@ -1,66 +0,0 @@ ---- -# Start of wazuh notifier configuration yaml. - -# This is the yaml config file for wazuh-active-response (for both the Python and Go version) - -targets: "slack, ntfy, discord" # Platforms in this string with comma seperated values are triggered. -full_message: "" # Platforms in this string will enable sending the full event information. -full_alert: "" # Platforms in this string will enable sending the full event information. - -# Exclude rule events that are enabled in the ossec.conf active response definition. -# These settings provide an easier way to disable events from firing the notifiers. - -excluded_rules: "99999, 00000" # Enter as a string with comma seperated values -excluded_agents: "99999" # Enter as a string with comma seperated values - -# Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) -# https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html -# Enter threat_map as lists of integers, mention_threshold as integer and color as Hex integer - -priority_map: - - threat_map: [ 15,14,13,12 ] - mention_threshold: 1 - color: 0xec3e40 # Red, SEVERE - - threat_map: [ 11,10,9 ] - mention_threshold: 1 - color: 0xff9b2b # Orange, HIGH - - threat_map: [ 8,7,6 ] - mention_threshold: 5 - color: 0xf5d800 # Yellow, ELEVATED - - threat_map: [ 5,4 ] - mention_threshold: 20 - color: 0x377fc7 # Blue, GUARDED - - threat_map: [ 3,2,1,0 ] - mention_threshold: 20 - color: 0x01a465 # Green, LOW - -# The next 2 settings are used to add information to the messages. -sender: "Wazuh (IDS)" -click: "https://documentation.wazuh.com/" - -########################################################################################### -# From here on the settings are ONLY used by the Python version of wazuh-active-response. # -########################################################################################### - -# Below settings provide for a window that enable/disables events from firing the notifiers. -excluded_days: "" # Enter as a string with comma seperated values. Be aware of your regional settings. -excluded_hours: [ "23:59", "00:00" ] # Enter as a tuple of string values. Be aware of your regional settings. - -# Following parameter defines the markdown characters to emphasise the parameter names in the notification messages -markdown_emphasis: - slack: "*" - ntfy: "**" - discord: "**" - -# The next settings are used for testing. Test mode will add the example event in wazuh-notify-test-event.json instead of the -# message received through wazuh. This enables testing for particular events when the test event is customized. -test_mode: False - -# Enabling this parameter provides more logging to the wazuh-notifier log. -extended_logging: 2 - -# Enabling this parameter provides extended logging to the console. -extended_print: 0 - -# End of wazuh notifier configuration yaml -... diff --git a/wazuh-notify-go/wazuh-notify-config.toml b/wazuh-notify-go/wazuh-notify-config.toml index 6aeb34c..7d94861 100644 --- a/wazuh-notify-go/wazuh-notify-config.toml +++ b/wazuh-notify-go/wazuh-notify-config.toml @@ -20,7 +20,7 @@ click = "https://documentation.wazuh.com/" # Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) # https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html -# Enter threat_map as lists of integers, mention_threshold as integer and color as Hex integer +# Enter threat_map as lists of integers, mention/notify_threshold as integer and color as Hex integer [[priority_map]] threat_map = [15, 14, 13, 12] mention_threshold = 1 diff --git a/wazuh-notify-python/wazuh-notify.py b/wazuh-notify-python/wazuh-notify.py index ec4c462..42afdb9 100755 --- a/wazuh-notify-python/wazuh-notify.py +++ b/wazuh-notify-python/wazuh-notify.py @@ -5,7 +5,7 @@ # License (version 2) as published by the FSF - Free Software # Foundation. # -# Rudi Klein, april 2024 +# Rudi Klein, May 2024 import requests @@ -14,168 +14,117 @@ from wazuh_notify_module import * def main(): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. me = frame(0).f_code.co_name him = frame(1).f_code.co_name - # Load the YAML config. - + # Load the TOML config. config: dict = get_config() - logger(0, config, me, him, "############ Processing event ###############################") - logger(2, config, me, him, "Loading yaml configuration") # Get the arguments used with running the script. - arguments = get_arguments() - # Check if we are in test mode (test_mode setting in config yaml). If so, load test event instead of live event. - if config.get('python', 'test_mode'): - - logger(1, config, me, him, "Running in test mode: using test message wazuh-notify-test-event.json") - - # Load the test event data. - - home_path, _, _ = set_environment() - with (open(home_path + '/etc/wazuh-notify-test-event.json') as event_file): - data: dict = json.loads(event_file.read()) - - else: - - # We are running live. Load the data from the Wazuh process. - - logger(2, config, me, him, "Running in live mode: using live message") - data = load_message() + # Check for test mode. Use test data if true + data = check_test_mode(config) # Extract the 'alert' section of the (JSON) event - alert = data["parameters"]["alert"] logger(2, config, me, him, "Extracting data from the event") - # Check the config for any exclusion rules - - fire_notification = exclusions_check(config, alert) - logger(1, config, me, him, "Checking if we are outside of the exclusion rules: " + str(fire_notification)) - - if not fire_notification: - - # The event was excluded by the exclusion rules in the configuration. - - logger(1, config, me, him, "Event excluded, no notification sent. Exiting") - exit() - else: - - # The event was not excluded by the exclusion rules in the configuration. Keep processing. - - logger(2, config, me, him, "Event NOT excluded, notification will be sent") + # Check the config for any exclusion rules and abort when excluded. + exclusions_check(config, alert) # Get the mapping from event threat level to priority, color and mention_flag. - priority, color, mention = threat_mapping(config, alert['rule']['level'], alert['rule']['firedtimes']) - logger(2, config, me, him, "Threat mapping done: " + - "prio:" + str(priority) + " color:" + str(color) + " mention:" + mention) - # If the target argument was used with the script, we'll use that instead of the configuration parameter. - config["targets"] = arguments['targets'] if arguments['targets'] != "" else config["targets"] - # Prepare the messaging platform specific request and execute - + # Prepare the messaging platform specific notification and execute if configured. if "discord" in config["targets"]: + # Show me some ID! Stop resisting! caller = "discord" + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name # Load the url/webhook from the configuration. - discord_url, _, _ = get_env() - discord_url = arguments['url'] if arguments['url'] else discord_url - # Build the basic notification message content. + # Build the basic message content. + message_body: str = construct_message_body(caller, config, arguments, alert) - notification: str = construct_basic_message(config, arguments, caller, alert) - logger(2, config, me, him, caller + " basic message constructed") + # Common preparation of the notification. + notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, priority) # Build the payload(s) for the POST request. + _, _, payload_json = build_discord_notification(caller, config, notification_body, color, mention, sender) - _, _, payload_json = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) + # Build the notification to be sent. + build_discord_notification(caller, config, notification_body, color, mention, sender) # POST the notification through requests. - - result = requests.post(discord_url, json=payload_json) - - logger(1, config, me, him, caller + " notification constructed and HTTPS request done: " + str(result)) + discord_result = requests.post(discord_url, json=payload_json) + logger(1, config, me, him, caller + " notification constructed and sent: " + str(discord_result)) if "ntfy" in config["targets"]: + # Show me some ID! Stop resisting! caller = "ntfy" + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name # Load the url/webhook from the configuration. - _, ntfy_url, _ = get_env() + ntfy_url = arguments['url'] if arguments['url'] else ntfy_url - # Build the basic notification message content. + # Build the basic message content. + message_body: str = construct_message_body(caller, config, arguments, alert) - notification: str = construct_basic_message(config, arguments, caller, alert) - - logger(2, config, me, him, caller + " basic message constructed") + # Common preparation of the notification. + notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, priority) # Build the payload(s) for the POST request. - payload_headers, payload_data, _ = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) + payload_headers, payload_data, _ = build_ntfy_notification(caller, config, notification_body, color, mention, + sender) + + # Build the notification to be sent. + build_ntfy_notification(caller, config, notification_body, priority, click, sender) # POST the notification through requests. + ntfy_result = requests.post(ntfy_url, data=payload_data, headers=payload_headers) + logger(1, config, me, him, caller + " notification constructed and sent: " + str(ntfy_result)) - result = requests.post(ntfy_url, data=payload_data, headers=payload_headers) - logger(1, config, me, him, caller + " notification constructed and request done: " + str(result)) - - if "slack" in config["targets"]: - caller = "slack" - - # Load the url/webhook from the configuration. - - _, _, slack_url = get_env() - - # Build the basic notification message content. - - notification: str = construct_basic_message(config, arguments, caller, alert) - - logger(2, config, me, him, caller + " basic message constructed") - - # Build the payload(s) for the POST request. - - _, _, payload_json = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) - - # POST the notification through requests. - - result = requests.post(slack_url, headers={'Content-Type': 'application/json'}, json=payload_json) - - logger(1, config, me, him, caller + " notification constructed and request done: " + str(result)) + # if "slack" in config["targets"]: + # # Show me some ID! Stop resisting! + # caller = "slack" + # me = frame(0).f_code.co_name + # him = frame(1).f_code.co_name + # + # # Load the url/webhook from the configuration. + # _, _, slack_url = get_env() + # slack_url = arguments['url'] if arguments['url'] else slack_url + # + # # Build the basic message content. + # message_body: str = construct_message_body(caller, config, arguments, data) + # + # # Common preparation of the notification. + # notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, + # priority) + # # Build the payload(s) for the POST request. + # _, _, payload_json = build_slack_notification(caller, config, notification_body, priority, color, mention, + # click, sender) + # + # # Build the notification to be sent. + # build_slack_notification(caller, config, notification_body, priority, click, sender) + # + # result = requests.post(slack_url, headers={'Content-Type': 'application/json'}, json=payload_json) + # + # logger(1, config, me, him, caller + " notification constructed and sent: " + str(result)) logger(0, config, me, him, "############ Event processed ################################") exit(0) -if __name__ == "__main__": +if "__main__" == __name__: main() diff --git a/wazuh-notify-python/wazuh_notify_module.py b/wazuh-notify-python/wazuh_notify_module.py index e173917..c508db8 100755 --- a/wazuh-notify-python/wazuh_notify_module.py +++ b/wazuh-notify-python/wazuh_notify_module.py @@ -26,14 +26,11 @@ def set_environment() -> tuple: # Set paths for use in this module - wazuh_path, log_path, config_path = set_environment() # Set structured timestamps for notifications. - def set_time_format(): - now_message = time.strftime('%A, %d %b %Y %H:%M:%S') now_logging = time.strftime('%Y-%m-%d %H:%M:%S') now_time = time.strftime('%H:%M') @@ -43,53 +40,40 @@ def set_time_format(): # Logger: print to console and/or log to file - def logger(level, config, me, him, message): _, now_logging, _, _ = set_time_format() - + logger_wazuh_path = os.path.abspath(os.path.join(__file__, "../../..")) logger_log_path = '{0}/logs/wazuh-notify.log'.format(logger_wazuh_path) # When logging from main(), the destination function is called "". For cosmetic reasons rename to "main". - him = 'main' if him == '' else him - - log_line = f'{now_logging} | {level} | {me: <23} | {him: <15} | {message}' + log_line = f'{now_logging} | {level} | {me: <26} | {him: <13} | {message}' # Compare the extended_print log level in the configuration to the log level of the message. - if config.get('python').get('extended_print', 0) >= level: print(log_line) - try: # Compare the extended_logging level in the configuration to the log level of the message. - if config.get('python').get('extended_logging', 0) >= level: with open(logger_log_path, mode="a") as log_file: log_file.write(log_line + "\n") - except (FileNotFoundError, PermissionError, OSError): - # Special message to console when logging to file fails and console logging might not be set. - - log_line = f'{now_logging} | {level} | {me: <23} | {him: <15} | error opening log file: {logger_log_path}' + log_line = f'{now_logging} | {level} | {me: <26} | {him: <13} | error opening log file: {logger_log_path}' print(log_line) # Get the content of the .env file (url's and/or webhooks). - def get_env(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Write the configuration to a dictionary. - config: dict = get_config() # Check if the secrets .env file is available. - try: dotenv_path = join(dirname(__file__), '.env') load_dotenv(dotenv_path) @@ -98,43 +82,34 @@ def get_env(): raise Exception(dotenv_path, "file not found") # Retrieve URLs from .env - discord_url = os.getenv("DISCORD_URL") ntfy_url = os.getenv("NTFY_URL") slack_url = os.getenv("SLACK_URL") except Exception as err: - # output error, and return with an error code - logger(0, config, me, him, 'Error reading ' + str(err)) exit(err) - logger(2, config, me, him, dotenv_path + " loaded") return discord_url, ntfy_url, slack_url # Read and process configuration settings from wazuh-notify-config.yaml and create dictionary. - def get_config(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - this_config_path: str = "" config: dict = {} + # logger(2, config, me, him, "Loading TOML configuration") try: _, _, this_config_path = set_environment() - with open(this_config_path, 'rb') as ntfier_config: config: dict = tomli.load(ntfier_config) - except (FileNotFoundError, PermissionError, OSError): logger(2, config, me, him, "Error accessing configuration file: " + this_config_path) - logger(2, config, me, him, "Reading configuration file: " + this_config_path) config['targets'] = config.get('general').get('targets', 'discord, slack, ntfy') @@ -145,7 +120,6 @@ def get_config(): config['sender'] = config.get('general').get('sender', 'Wazuh (IDS)') config['click'] = config.get('general').get('click', 'https://wazuh.com') config['md_e'] = config.get('general').get('markdown_emphasis', '') - config['excluded_days'] = config.get('python').get('excluded_days', '') config['excluded_hours'] = config.get('python').get('excluded_hours', '') config['test_mode'] = config.get('python').get('test_mode', False) @@ -156,9 +130,7 @@ def get_config(): # Show configuration settings from wazuh-notify-config.yaml - def view_config(): - _, _, this_config_path, _ = set_environment() try: @@ -170,23 +142,18 @@ def view_config(): # Get script arguments during execution. Params found here override config settings. - def get_arguments(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Retrieve the configuration information - config: dict = get_config() # Short options - options: str = "u:s:p:m:t:c:hv" # Long options - long_options: list = ["url=", "sender=", "targets=", @@ -212,7 +179,6 @@ def get_arguments(): """ # Initialize some variables. - url: str = "" sender: str = "" targets: str = "" @@ -222,17 +188,13 @@ def get_arguments(): click: str = "" # Fetch the arguments from the command line, skipping the first argument (name of the script). - argument_list: list = sys.argv[1:] - logger(2, config, me, him, "Found arguments:" + str(argument_list)) if not argument_list: - logger(1, config, me, him, 'No argument list found (no arguments provided with script execution') # Store defaults for the non-existing arguments in the arguments dictionary to avoid None errors. - arguments: dict = {'url': url, 'sender': sender, 'targets': targets, @@ -241,78 +203,55 @@ def get_arguments(): 'tags': tags, 'click': click} return arguments - else: - try: - logger(2, config, me, him, "Parsing arguments") # Parsing arguments - p_arguments, values = getopt.getopt(argument_list, options, long_options) # Check each argument. Arguments that are present will override the defaults. - for current_argument, current_value in p_arguments: - if current_argument in ("-h", "--help"): print(help_text) exit() - elif current_argument in ("-v", "--view"): view_config() exit() - elif current_argument in ("-u", "--url"): url: str = current_value - elif current_argument in ("-s", "--sender"): sender: str = current_value - elif current_argument in ("-d", "--targets"): targets: str = current_value - elif current_argument in ("-p", "--priority"): priority: int = int(current_value) - elif current_argument in ("-m", "--message"): message: str = current_value - elif current_argument in ("-t", "--tags"): tags: str = current_value - elif current_argument in ("-c", "--click"): click: str = current_value - except getopt.error as err: # Output error, and return error code - logger(0, config, me, him, "Error during argument parsing:" + str(err)) - logger(2, config, me, him, "Arguments returned as dictionary") # Store the arguments in the arguments dictionary. - arguments: dict = {'url': url, 'sender': sender, 'targets': targets, 'message': message, 'priority': priority, 'tags': tags, 'click': click} - return arguments # Receive and load message from Wazuh - def load_message(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - config: dict = get_config() # get alert from stdin - logger(2, config, me, him, "Loading event message from STDIN") input_str: str = "" @@ -325,153 +264,136 @@ def load_message(): if data.get("command") == "add": logger(1, config, me, him, "Relevant event data found") return data - else: - # Event came in, but wasn't processed. - logger(0, config, me, him, "Event data not found") sys.exit(1) -# Check if there are reasons not to process this event. Check exclusions for rules, agents, days and hours. +# Check if we are in test mode (test_mode setting in config yaml). If so, load test event instead of live event. +def check_test_mode(config): + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + if config.get('python').get('test_mode'): + logger(1, config, me, him, "Running in test mode: using test message wazuh-notify-test-event.json") + # Load the test event data. + home_path, _, _ = set_environment() + with (open(home_path + '/etc/wazuh-notify-test-event.json') as event_file): + data: dict = json.loads(event_file.read()) + else: + # We are running live. Load the data from the Wazuh process. + logger(2, config, me, him, "Running in live mode: using live message") + data = load_message() + return data + + +# Check if there are reasons not to process this event. Check exclusions for rules, agents, days and hours. def exclusions_check(config, alert): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Set some environment - now_message, now_logging, now_weekday, now_time = set_time_format() # Check the exclusion records from the configuration yaml. - - ex_hours: tuple = config.get('python', 'excluded_hours') + logger(1, config, me, him, "Checking if we are outside of the exclusion rules: ") + ex_hours: tuple = config.get('python').get('excluded_hours') # Start hour may not be later than end hours. End hour may not exceed 00:00 midnight to avoid day jump. - ################################################ ex_hours = [ex_hours[0], "23:59"] if (ex_hours[1] >= '23:59' or ex_hours[1] < ex_hours[0]) else ex_hours # Get some more exclusion records from the config. - ex_days = config.get('python').get('excluded_days') ex_agents = config.get('general').get("excluded_agents") ex_rules = config.get('general').get("excluded_rules") # Check agent and rule from within the event. - ev_agent = alert['agent']['id'] ev_rule = alert['rule']['id'] # Let's assume all lights are green, until proven otherwise. - ex_hours_eval, ex_weekday_eval, ev_rule_eval, ev_agent_eval = True, True, True, True # Evaluate the conditions for sending a notification. Any False will cause the notification to be discarded. - if (now_time > ex_hours[0]) and (now_time < ex_hours[1]): - logger(2, config, me, him, "excluded: event inside exclusion time frame") - ex_hours_eval = False - elif now_weekday in ex_days: - logger(2, config, me, him, "excluded: event inside excluded weekdays") - ex_weekday_eval = False elif ev_rule in ex_rules: - logger(2, config, me, him, "excluded: event id inside exclusion list") - ev_rule_eval = False - elif ev_agent in ex_agents: - logger(2, config, me, him, "excluded: event agent inside exclusion list") - ev_rule_eval = False notification_eval = True if (ex_hours_eval and ex_weekday_eval and ev_rule_eval and ev_agent_eval) else False - logger(1, config, me, him, "Exclusion rules evaluated. Final decision: " + str(notification_eval)) - return notification_eval + if not notification_eval: + # The event was excluded by the exclusion rules in the configuration. + logger(1, config, me, him, "Event excluded, no notification sent. Exiting") + exit() + else: + # The event was not excluded by the exclusion rules in the configuration. Keep processing. + logger(2, config, me, him, "Event NOT excluded, notification will be sent") + return # Map the event threat level to the appropriate 5-level priority scale and color for use in the notification platforms. - def threat_mapping(config, threat_level, fired_times): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Map threat level to priority. Enters Homeland Security :-). - p_map = config.get('priority_map') - logger(2, config, me, him, "Prio map: " + str(p_map)) for i in range(len(p_map)): - logger(2, config, me, him, "Loop: " + str(i)) logger(2, config, me, him, "Level: " + str(threat_level)) if threat_level in p_map[i]["threat_map"]: - color_mapping = p_map[i]["color"] priority_mapping = 5 - i - logger(2, config, me, him, "Prio: " + str(priority_mapping)) logger(2, config, me, him, "Color: " + str(color_mapping)) if fired_times >= p_map[i]["mention_threshold"]: - # When this flag is set, Discord recipients get a stronger message (DM). - mention_flag = "@here" - else: - mention_flag = "" - logger(2, config, me, him, "Threat level mapped as: " + "prio:" + str(priority_mapping) + " color: " + str(color_mapping) + " mention: " + mention_flag) - return priority_mapping, color_mapping, mention_flag logger(0, config, me, him, "Threat level mapping failed! Returning garbage (99, 99, 99)") - return 99, 99, "99" # Construct the message that will be sent to the notifier platforms. - -def construct_basic_message(config, arguments, caller: str, data: dict) -> str: +def construct_message_body(caller, config, arguments, data: dict) -> str: # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Include a specific control sequence for markdown bold parameter names. - - md_map = config.get('python').get('markdown_emphasis', '') + # todo To be fixed + md_map = config.get('markdown_emphasis', '') md_e = md_map[caller] # If the --message (-m) argument was fulfilled, use this message to be sent. - if arguments['message']: - - basic_msg = arguments['message'] - + message_body = arguments['message'] else: - _, timestamp, _, _ = set_time_format() - basic_msg: str = \ + message_body: str = \ ( md_e + "Timestamp:" + md_e + " " + timestamp + "\n" + md_e + "Agent:" + md_e + " " + data["agent"]["name"] + " (" + data["agent"]["id"] + ")" + "\n" + @@ -479,32 +401,25 @@ def construct_basic_message(config, arguments, caller: str, data: dict) -> str: md_e + "Rule:" + md_e + " " + data["rule"]["description"] + "\n" + md_e + "Description:" + md_e + " " + data["full_log"] + "\n" + md_e + "Threat level:" + md_e + " " + str(data["rule"]["level"]) + "\n" + - md_e + "Times fired:" + md_e + " " + str(data["rule"]["firedtimes"]) + "\n") - - if caller == "ntfy": - # todo Check this out - basic_msg = " \n" + basic_msg + md_e + "Times fired:" + md_e + " " + str(data["rule"]["firedtimes"]) + "\n" + ) logger(2, config, me, him, caller + " basic message constructed.") - - return basic_msg + return message_body # Construct the notification (message + additional information) that will be sent to the notifier platforms. - -def build_notification(caller, config, arguments, notification, alert, priority, color, mention): +def prepare_payload(caller, config, arguments, message_body, alert, priority): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - logger(2, config, me, him, caller + " notification being constructed.") + logger(2, config, me, him, "Notification being constructed.") - md_map = config.get('python').get('markdown_emphasis', '') + md_map = config.get('markdown_emphasis', '') md_e = md_map[caller] click: str = config.get('general').get('click', 'https://wazuh.com') - sender: str = config.get('general').get('sender', 'Wazuh (IDS)') priority: str = str(priority) tags = (str(alert['rule']['groups']).replace("[", "") .replace("]", "") @@ -522,70 +437,85 @@ def build_notification(caller, config, arguments, notification, alert, priority, .replace(',', ' ') ) # Fill some of the variables with argument values if available. - # todo Redundant? - click = arguments['click'] if arguments['click'] else click priority = arguments['priority'] if arguments['priority'] else priority - sender = arguments['sender'] if arguments['sender'] else sender tags = arguments['tags'] if arguments['tags'] else tags + sender: str = config.get('general').get('sender', 'Wazuh (IDS)') + sender = arguments['sender'] if arguments['sender'] else sender + click: str = config.get('general').get('click', 'https://wazuh.com') + click = arguments['click'] if arguments['click'] else click # Add the full alert data to the notification. - if caller in config["full_alert"]: - logger(2, config, me, him, caller + "Full alert data will be sent.") - - notification: str = ("\n\n" + notification + "\n" + - md_e + "__Full event__" + md_e + "\n" + "```\n" + full_event + "```") - - # Add Priority & tags to the notification + logger(2, config, me, him, caller + "Full alert data will be attached.") + # Add the full alert data to the notification body + notification_body: str = ("\n\n" + message_body + "\n" + + md_e + "__Full event__" + md_e + "\n" + "```\n" + full_event + "```") + else: + notification_body: str = message_body + # Add priority & tags to the notification body + notification_body = (notification_body + "\n\n" + md_e + "Priority:" + md_e + " " + str(priority) + "\n" + + md_e + "Tags:" + md_e + " " + tags + "\n\n" + click) logger(2, config, me, him, caller + " adding priority and tags") - notification = (notification + "\n\n" + md_e + "Priority:" + md_e + " " + str(priority) + "\n" + - md_e + "Tags:" + md_e + " " + tags + "\n\n" + click) - config["targets"] = arguments['targets'] if arguments['targets'] != "" else config["targets"] - # Prepare the messaging platform specific notification and execute + return notification_body, click, sender - if caller == "discord": - logger(2, config, me, him, caller + " payload created") - payload_json = {"username": sender, - "content": mention, - "embeds": [{"description": notification, - "color": color, - "title": sender}]} +def build_discord_notification(caller, config, notification_body, color, mention, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + logger(2, config, me, him, caller + " payload created") - logger(2, config, me, him, caller + " notification built") + payload_json = {"username": sender, + "content": mention, + "embeds": [{"description": notification_body, + "color": color, + "title": sender}]} + logger(2, config, me, him, caller + " notification built") + return "", "", payload_json - return "", "", payload_json - if caller == "ntfy": - logger(2, config, me, him, caller + " payloads created") +def build_ntfy_notification(caller, config, notification_body, priority, click, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + logger(2, config, me, him, caller + " payloads created") - payload_data = notification - payload_headers = {"Markdown": "yes", - "Title": sender, - "Priority": str(priority), - "Click": click} + # if caller == "ntfy": + # todo Check this out + # basic_msg = " \n" + basic_msg - logger(2, config, me, him, caller + " notification built") + payload_data = notification_body + payload_headers = {"Markdown": "yes", + "Title": sender, + "Priority": str(priority), + "Click": click} + logger(2, config, me, him, caller + " notification built") + return payload_headers, payload_data, "" - return payload_headers, payload_data, "" - if caller == "slack": - logger(2, config, me, him, caller + " payloads created") +def build_slack_notification(caller, config, arguments, notification_body, priority, color, mention, click, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + sender: str = config.get('general').get('sender', 'Wazuh (IDS)') + sender = arguments['sender'] if arguments['sender'] else sender - # todo Need some investigation. + logger(2, config, me, him, caller + " payloads created") - payload_json = {"text": notification} - # payload_json = {"username": sender, - # "content": mention, - # "embeds": [{"description": notification, - # "color": color, - # "title": sender}]} + # todo Need some investigation. - logger(2, config, me, him, caller + " notification built") + payload_json = {"text": notification_body} + # payload_json = {"username": sender, + # "content": mention, + # "embeds": [{"description": notification, + # "color": color, + # "title": sender}]} - return "", "", payload_json + logger(2, config, me, him, caller + " notification built") + + return "", "", payload_json