exclude rules added
full message added
This commit is contained in:
parent
7e95376a22
commit
cc7f93ba64
@ -6,12 +6,33 @@ import (
|
|||||||
"log"
|
"log"
|
||||||
"net/http"
|
"net/http"
|
||||||
"os"
|
"os"
|
||||||
|
"slices"
|
||||||
"strconv"
|
"strconv"
|
||||||
|
"strings"
|
||||||
"wazuh-notify/types"
|
"wazuh-notify/types"
|
||||||
)
|
)
|
||||||
|
|
||||||
func SendDiscord(params types.Params) {
|
func SendDiscord(params types.Params) {
|
||||||
embedDescription := "\n\n" +
|
|
||||||
|
var embedDescription string
|
||||||
|
|
||||||
|
if slices.Contains(strings.Split(params.FullMessage, ","), "discord") {
|
||||||
|
fullMessage, _ := json.MarshalIndent(params.WazuhMessage, "", " ")
|
||||||
|
fullMessageString := strings.ReplaceAll(string(fullMessage), `"`, "")
|
||||||
|
fullMessageString = strings.ReplaceAll(fullMessageString, "{", "")
|
||||||
|
fullMessageString = strings.ReplaceAll(fullMessageString, "}", "")
|
||||||
|
fullMessageString = strings.ReplaceAll(fullMessageString, "[", "")
|
||||||
|
fullMessageString = strings.ReplaceAll(fullMessageString, "]", "")
|
||||||
|
fullMessageString = strings.ReplaceAll(fullMessageString, " ,", "")
|
||||||
|
|
||||||
|
embedDescription = "\n\n ```" +
|
||||||
|
fullMessageString +
|
||||||
|
"```\n\n" +
|
||||||
|
"Priority: " + strconv.Itoa(params.Priority) + "\n" +
|
||||||
|
"Tags: " + params.Tags + "\n\n" +
|
||||||
|
params.Click
|
||||||
|
} else {
|
||||||
|
embedDescription = "\n\n" +
|
||||||
"**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" +
|
"**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" +
|
||||||
"**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" +
|
"**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" +
|
||||||
"**Description:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" +
|
"**Description:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" +
|
||||||
@ -21,6 +42,7 @@ func SendDiscord(params types.Params) {
|
|||||||
"Priority: " + strconv.Itoa(params.Priority) + "\n" +
|
"Priority: " + strconv.Itoa(params.Priority) + "\n" +
|
||||||
"Tags: " + params.Tags + "\n\n" +
|
"Tags: " + params.Tags + "\n\n" +
|
||||||
params.Click
|
params.Click
|
||||||
|
}
|
||||||
|
|
||||||
var color int
|
var color int
|
||||||
|
|
||||||
|
|||||||
24
wazuh-notify-go/services/filters.go
Normal file
24
wazuh-notify-go/services/filters.go
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
package services
|
||||||
|
|
||||||
|
import (
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
"wazuh-notify/log"
|
||||||
|
)
|
||||||
|
|
||||||
|
func Filter() {
|
||||||
|
for _, rule := range strings.Split(inputParams.ExcludedRules, ",") {
|
||||||
|
if rule == inputParams.WazuhMessage.Parameters.Alert.Rule.ID {
|
||||||
|
log.Log("rule excluded")
|
||||||
|
log.CloseLogFile()
|
||||||
|
os.Exit(0)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for _, agent := range strings.Split(inputParams.ExcludedAgents, ",") {
|
||||||
|
if agent == inputParams.WazuhMessage.Parameters.Alert.Agent.ID {
|
||||||
|
log.Log("agent excluded")
|
||||||
|
log.CloseLogFile()
|
||||||
|
os.Exit(0)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -56,6 +56,9 @@ func InitNotify() types.Params {
|
|||||||
log.Log(string(inputParamString))
|
log.Log(string(inputParamString))
|
||||||
|
|
||||||
inputParams.Targets = configParams.Targets
|
inputParams.Targets = configParams.Targets
|
||||||
|
inputParams.FullMessage = configParams.FullMessage
|
||||||
|
inputParams.ExcludedAgents = configParams.ExcludedAgents
|
||||||
|
inputParams.ExcludedRules = configParams.ExcludedRules
|
||||||
|
|
||||||
wazuhInput()
|
wazuhInput()
|
||||||
|
|
||||||
@ -73,6 +76,8 @@ func wazuhInput() {
|
|||||||
|
|
||||||
inputParams.WazuhMessage = wazuhData
|
inputParams.WazuhMessage = wazuhData
|
||||||
|
|
||||||
|
Filter()
|
||||||
|
|
||||||
log.Log("Wazuh data loaded")
|
log.Log("Wazuh data loaded")
|
||||||
inputParamString, _ := json.Marshal(inputParams)
|
inputParamString, _ := json.Marshal(inputParams)
|
||||||
log.Log(string(inputParamString))
|
log.Log(string(inputParamString))
|
||||||
|
|||||||
@ -7,6 +7,9 @@ type Params struct {
|
|||||||
Tags string
|
Tags string
|
||||||
Click string `yaml:"click,omitempty"`
|
Click string `yaml:"click,omitempty"`
|
||||||
Targets string `yaml:"targets,omitempty"`
|
Targets string `yaml:"targets,omitempty"`
|
||||||
|
FullMessage string `yaml:"full_message,omitempty"`
|
||||||
|
ExcludedRules string `yaml:"excluded_rules,omitempty"`
|
||||||
|
ExcludedAgents string `yaml:"excluded_agents,omitempty"`
|
||||||
WazuhMessage WazuhMessage
|
WazuhMessage WazuhMessage
|
||||||
Priority1 []int `yaml:"priority_1"`
|
Priority1 []int `yaml:"priority_1"`
|
||||||
Priority2 []int `yaml:"priority_2"`
|
Priority2 []int `yaml:"priority_2"`
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user