40 lines
1.6 KiB
Go
40 lines
1.6 KiB
Go
|
package services
|
||
|
|
|
||
|
|
import (
|
||
|
|
"encoding/json"
|
||
|
|
"fmt"
|
||
|
|
"slices"
|
||
|
|
"strconv"
|
||
|
|
"strings"
|
||
|
|
"time"
|
||
|
|
"wazuh-notify/types"
|
||
|
|
)
|
||
|
|
|
||
|
|
func BuildMessage(params types.Params, target string, emphasis string) string {
|
||
|
|
|
||
|
|
if slices.Contains(strings.Split(params.General.FullAlert, ","), target) {
|
||
|
|
fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ")
|
||
|
|
fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "")
|
||
|
|
fullAlertString = strings.ReplaceAll(fullAlertString, "{", "")
|
||
|
|
fullAlertString = strings.ReplaceAll(fullAlertString, "}", "")
|
||
|
|
fullAlertString = strings.ReplaceAll(fullAlertString, "[", "")
|
||
|
|
fullAlertString = strings.ReplaceAll(fullAlertString, "]", "")
|
||
|
|
fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "")
|
||
|
|
|
||
|
|
return "\n\n ```" +
|
||
|
|
fullAlertString +
|
||
|
|
"```\n\n"
|
||
|
|
} else {
|
||
|
|
return "\n\n" +
|
||
|
|
fmt.Sprintf("%sTimestamp:%s ", emphasis, emphasis) + time.Now().Format(time.DateTime) + "\n" +
|
||
|
|
fmt.Sprintf("%sAgent:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" +
|
||
|
|
fmt.Sprintf("%sEvent id:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" +
|
||
|
|
fmt.Sprintf("%sRule:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" +
|
||
|
|
fmt.Sprintf("%sDescription:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.FullLog + "\n" +
|
||
|
|
fmt.Sprintf("%sThreat level:%s ", emphasis, emphasis) + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" +
|
||
|
|
fmt.Sprintf("%sTimes fired:%s ", emphasis, emphasis) + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) +
|
||
|
|
"\n\n"
|
||
|
|
|
||
|
|
}
|
||
|
|
}
|