From 5ee0b78c075de8f66db80e06eef8138c425afd3c Mon Sep 17 00:00:00 2001 From: darius Date: Wed, 8 May 2024 01:56:48 +0200 Subject: [PATCH] go functional mirror added --- requirements.txt | 3 + wazuh-notify-go/.env | 2 + wazuh-notify-go/.idea/.gitignore | 8 +++ wazuh-notify-go/.idea/.name | 1 + wazuh-notify-go/.idea/modules.xml | 8 +++ wazuh-notify-go/config.yaml | 86 +++++++++++++++++++++++++ wazuh-notify-go/go.mod | 8 +++ wazuh-notify-go/go.sum | 6 ++ wazuh-notify-go/init.go | 59 +++++++++++++++++ wazuh-notify-go/main.go | 21 ++++++ wazuh-notify-go/notification/discord.go | 42 ++++++++++++ wazuh-notify-go/notification/ntfy.go | 33 ++++++++++ wazuh-notify-go/types/types.go | 25 +++++++ 13 files changed, 302 insertions(+) create mode 100644 requirements.txt create mode 100644 wazuh-notify-go/.env create mode 100644 wazuh-notify-go/.idea/.gitignore create mode 100644 wazuh-notify-go/.idea/.name create mode 100644 wazuh-notify-go/.idea/modules.xml create mode 100644 wazuh-notify-go/config.yaml create mode 100644 wazuh-notify-go/go.mod create mode 100644 wazuh-notify-go/go.sum create mode 100644 wazuh-notify-go/init.go create mode 100644 wazuh-notify-go/main.go create mode 100644 wazuh-notify-go/notification/discord.go create mode 100644 wazuh-notify-go/notification/ntfy.go create mode 100644 wazuh-notify-go/types/types.go diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..6d956f2 --- /dev/null +++ b/requirements.txt @@ -0,0 +1,3 @@ +requests~=2.31.0 +PyYAML~=6.0.1 +python-dotenv~=1.0.1 \ No newline at end of file diff --git a/wazuh-notify-go/.env b/wazuh-notify-go/.env new file mode 100644 index 0000000..c7bbc35 --- /dev/null +++ b/wazuh-notify-go/.env @@ -0,0 +1,2 @@ +DISCORD_WEBHOOK=https://discord.com/api/webhooks/1237526475306176572/kHGnaQiM8qWOfdLIN1LWqgq3dsfqiHtsfs-Z5FralJNdX5hdw-MOPf4zzIDiFVjcIat4 +NTFY_URL=https://ntfy.sh/__KleinTest \ No newline at end of file diff --git a/wazuh-notify-go/.idea/.gitignore b/wazuh-notify-go/.idea/.gitignore new file mode 100644 index 0000000..13566b8 --- /dev/null +++ b/wazuh-notify-go/.idea/.gitignore @@ -0,0 +1,8 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Editor-based HTTP Client requests +/httpRequests/ +# Datasource local storage ignored files +/dataSources/ +/dataSources.local.xml diff --git a/wazuh-notify-go/.idea/.name b/wazuh-notify-go/.idea/.name new file mode 100644 index 0000000..78dd73c --- /dev/null +++ b/wazuh-notify-go/.idea/.name @@ -0,0 +1 @@ +wazuh-notify-go \ No newline at end of file diff --git a/wazuh-notify-go/.idea/modules.xml b/wazuh-notify-go/.idea/modules.xml new file mode 100644 index 0000000..c6cb081 --- /dev/null +++ b/wazuh-notify-go/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/wazuh-notify-go/config.yaml b/wazuh-notify-go/config.yaml new file mode 100644 index 0000000..3aab265 --- /dev/null +++ b/wazuh-notify-go/config.yaml @@ -0,0 +1,86 @@ +--- +#start of yaml + +# This is the yaml config file for both the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py. +# The yaml needs to be in the same folder as the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py + +# COMMON (custom-wazuh-notifiers.py) configuration settings start here. +# 1 = messages will be sent through this message server. 0 = messages will NOT be sent through this message server. + +discord_enabled: 1 +ntfy_enabled: 1 +targets: "discord,ntfy" + +# Exclude rules that are listed in the ossec.conf active response definition. + +excluded_rules: "5401, 5403" +excluded_agents: "999" + +# Priority mapping from 1-12 (Wazuh events) to 1-5 (Discord and ntfy notification) + +notifier_priority_1: 12, 11, 10 +notifier_priority_2: 9, 8 +notifier_priority_3: 7, 6 +notifier_priority_4: 5, 4 +notifier_priority_5: 3 ,2, 1 + +# COMMON configuration settings end here. + + +# NTFY configuration settings start here. +# The default values refer to the hard-coded defaults, if no yaml configuration is found. +# +# -u, --server is the URL of the NTFY server, ending with a "/". Default is https://ntfy.sh/. +# -s, --sender is the sender of the message, either an app name or a person. Default is "Wazuh (IDS)". +# -d, --destination is the NTFY subscription, to send the message to. Default is none. +# -p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5. +# -m, --message is the text of the message to be sent. Default is "Test message". +# -t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded". +# -c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com. +# -h, --help shows this help message. Must have no value argument. +# -v, --view show config. + +ntfy_server: "https://ntfy.sh/" +ntfy_sender: "Wazuh (IDS)" +ntfy_destination: "__KleinTest" +ntfy_priority: "3" +ntfy_message: "Test message" +ntfy_tags: "information, testing, yaml" +ntfy_click: "https://google.com" + +# 1 to send the full event data with the message. 0 only sends the message with basic details +ntfy_full_message: "0" + +# NTFY configuration settings end here. + +# DISCORD configuration settings start here. +# The default values refer to the hard-coded defaults, if no yaml configuration is found. + +# -u, --server is the webhook URL of the Discord server. It is stored in .env. +# -s, --sender is the sender of the message, either an app name or a person. The default is "Security message". +# -d, --destination is the destination (actually the originator) of the message, either an app name or a person. Default is "Wazuh (IDS)" +# -p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5. +# -m, --message is the text of the message to be sent. Default is "Test message", but may include --tags and/or --click. +# -t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded". +# -c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com. +# -h, --help shows this help message. Must have no value argument. +# -v, --view show config. + +discord_server: "not used! The webhook (server) is a secret stored in .env" +discord_sender: "Security message" +discord_destination: "WAZUH (IDS)" +discord_priority: 3 +discord_message: "Test message" +discord_tags: "informational, testing, yaml" +discord_click: "https://google.com" + +# 1 to send the full event data with the message. 0 only sends the message with basic details +discord_full_message: "0" + +# DISCORD configuration settings ends here. + +#end of yaml +... + + + diff --git a/wazuh-notify-go/go.mod b/wazuh-notify-go/go.mod new file mode 100644 index 0000000..5897e35 --- /dev/null +++ b/wazuh-notify-go/go.mod @@ -0,0 +1,8 @@ +module wazuh-notify + +go 1.22 + +require ( + github.com/joho/godotenv v1.5.1 + gopkg.in/yaml.v2 v2.4.0 +) diff --git a/wazuh-notify-go/go.sum b/wazuh-notify-go/go.sum new file mode 100644 index 0000000..f7e7502 --- /dev/null +++ b/wazuh-notify-go/go.sum @@ -0,0 +1,6 @@ +github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= +github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= diff --git a/wazuh-notify-go/init.go b/wazuh-notify-go/init.go new file mode 100644 index 0000000..aa94353 --- /dev/null +++ b/wazuh-notify-go/init.go @@ -0,0 +1,59 @@ +package main + +import ( + "flag" + "github.com/joho/godotenv" + "gopkg.in/yaml.v2" + "log" + "os" + "wazuh-notify/types" +) + +var configParams types.Params + +func initNotify() { + err := godotenv.Load() + if err != nil { + log.Fatalf(".env not found: %v", err) + return + } + + flag.StringVar(&inputParams.Server, "server", "", "is the webhook URL of the Discord server. It is stored in .env.") + flag.StringVar(&inputParams.Click, "click", "", "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") + flag.StringVar(&inputParams.Destination, "destination", "", "is the destination (actually the originator) of the message, either an app name or a person. Default is \"Wazuh (IDS)\"") + flag.StringVar(&inputParams.Message, "message", "", "is the text of the message to be sent. Default is \"Test message\", but may include --tags and/or --click.") + flag.IntVar(&inputParams.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.") + flag.StringVar(&inputParams.Sender, "sender", "", "is the sender of the message, either an app name or a person. The default is \"Security message\".") + flag.StringVar(&inputParams.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".") + flag.StringVar(&inputParams.Targets, "targets", "", "is a list of targets to send notifications to. Default is \"discord\".") + + flag.Parse() + + yamlFile, err := os.ReadFile("./config.yaml") + yaml.Unmarshal(yamlFile, &configParams) + + if inputParams.Server == "" { + inputParams.Server = configParams.Server + } + if inputParams.Click == "" { + inputParams.Click = configParams.Click + } + if inputParams.Destination == "" { + inputParams.Destination = configParams.Destination + } + if inputParams.Message == "" { + inputParams.Message = configParams.Message + } + if inputParams.Priority == 0 { + inputParams.Priority = configParams.Priority + } + if inputParams.Sender == "" { + inputParams.Sender = configParams.Sender + } + if inputParams.Tags == "" { + inputParams.Tags = configParams.Tags + } + if inputParams.Targets == "" { + inputParams.Targets = configParams.Targets + } +} diff --git a/wazuh-notify-go/main.go b/wazuh-notify-go/main.go new file mode 100644 index 0000000..42685c9 --- /dev/null +++ b/wazuh-notify-go/main.go @@ -0,0 +1,21 @@ +package main + +import ( + "strings" + "wazuh-notify/notification" + "wazuh-notify/types" +) + +var inputParams types.Params + +func main() { + initNotify() + for _, target := range strings.Split(inputParams.Targets, ",") { + switch target { + case "discord": + notification.SendDiscord(inputParams) + case "ntfy": + notification.SendNtfy(inputParams) + } + } +} diff --git a/wazuh-notify-go/notification/discord.go b/wazuh-notify-go/notification/discord.go new file mode 100644 index 0000000..6c625c5 --- /dev/null +++ b/wazuh-notify-go/notification/discord.go @@ -0,0 +1,42 @@ +package notification + +import ( + "bytes" + "encoding/json" + "fmt" + "log" + "net/http" + "os" + "wazuh-notify/types" +) + +func SendDiscord(params types.Params) { + embedDescription := fmt.Sprintf("\n\n %s \n\nPriority: %x\nTags: %s\n\n%s", + params.Message, + params.Priority, + params.Tags, + params.Click, + ) + + message := types.Message{ + Username: params.Sender, + Embeds: []types.Embed{ + { + Title: params.Destination, + Description: embedDescription, + }, + }, + } + + payload := new(bytes.Buffer) + + err := json.NewEncoder(payload).Encode(message) + if err != nil { + return + } + + _, err = http.Post(os.Getenv("DISCORD_WEBHOOK"), "application/json", payload) + if err != nil { + log.Fatalf("An Error Occured %v", err) + } +} diff --git a/wazuh-notify-go/notification/ntfy.go b/wazuh-notify-go/notification/ntfy.go new file mode 100644 index 0000000..3749d41 --- /dev/null +++ b/wazuh-notify-go/notification/ntfy.go @@ -0,0 +1,33 @@ +package notification + +import ( + "net/http" + "os" + "strconv" + "strings" + "time" + "wazuh-notify/types" +) + +func SendNtfy(params types.Params) { + + payload := time.Now().Format(time.RFC3339) + "\n\n" + params.Message + + req, _ := http.NewRequest("POST", os.Getenv("NTFY_URL"), strings.NewReader(payload)) + req.Header.Set("Content-Type", "text/plain") + + if params.Sender != "" { + req.Header.Add("Title", params.Sender) + } + if params.Tags != "" { + req.Header.Add("Tags", params.Tags) + } + if params.Click != "" { + req.Header.Add("Click", params.Click) + } + if params.Priority != 0 { + req.Header.Add("Priority", strconv.Itoa(params.Priority)) + } + + http.DefaultClient.Do(req) +} diff --git a/wazuh-notify-go/types/types.go b/wazuh-notify-go/types/types.go new file mode 100644 index 0000000..8b76d08 --- /dev/null +++ b/wazuh-notify-go/types/types.go @@ -0,0 +1,25 @@ +package types + +type Params struct { + Server string `yaml:"discord_server"` + Sender string `yaml:"discord_sender"` + Destination string `yaml:"discord_destination"` + Priority int `yaml:"discord_priority"` + Message string `yaml:"discord_message"` + Tags string `yaml:"discord_tags"` + Click string `yaml:"discord_click"` + Targets string `yaml:"targets"` +} + +type Message struct { + Username string `json:"username,omitempty"` + AvatarUrl string `json:"avatar_url,omitempty"` + Content string `json:"content,omitempty"` + Embeds []Embed `json:"embeds,omitempty"` +} + +type Embed struct { + Title string `json:"title,omitempty"` + Description string `json:"description,omitempty"` + Color string `json:"color,omitempty"` +}