diff --git a/wazuh-notify-config.toml b/wazuh-notify-config.toml new file mode 100644 index 0000000..6aeb34c --- /dev/null +++ b/wazuh-notify-config.toml @@ -0,0 +1,84 @@ +############################################################################################################# +# This is the TOML config file for wazuh-notify (active response) for both the Python and Go implementation # +############################################################################################################# + +[general] +# Platforms in this string with comma seperated values are triggered. +targets = "slack, ntfy, discord" + +# Platforms in this string will enable sending the full event information. +full_alert = "" + +# Exclude rule events that are enabled in the ossec.conf active response definition. +# These settings provide an easier way to disable events from firing the notifiers. +excluded_rules = "99999, 00000" +excluded_agents = "99999" + +# The next 2 settings are used to add information to the messages. +sender = "Wazuh (IDS)" +click = "https://documentation.wazuh.com/" + +# Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) +# https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html +# Enter threat_map as lists of integers, mention_threshold as integer and color as Hex integer +[[priority_map]] +threat_map = [15, 14, 13, 12] +mention_threshold = 1 +notify_threshold = 1 +color = 0xec3e40 # Red, SEVERE + +[[priority_map]] +threat_map = [11, 10, 9] +mention_threshold = 1 +notify_threshold = 1 +color = 0xff9b2b # Orange, HIGH + +[[priority_map]] +threat_map = [8, 7, 6] +mention_threshold = 5 +notify_threshold = 5 +color = 0xf5d800 # Yellow, ELEVATED + +[[priority_map]] +threat_map = [5, 4] +mention_threshold = 20 +notify_threshold = 5 +color = 0x377fc7 # Blue, GUARDED + +[[priority_map]] +threat_map = [3, 2, 1, 0] +mention_threshold = 20 +notify_threshold = 5 +color = 0x01a465 # Green, LOW + +################ End of priority mapping ################################## + +# Following parameter defines the markdown characters to emphasise the parameter names in the notification messages +[markdown_emphasis] +slack = "*" +ntfy = "**" +discord = "**" + +################################################################################## +# From here on the settings are ONLY used by the Python version of wazuh-notify. # +################################################################################## + +[python] + +# The next settings are used for testing and troubleshooting. + +# Test mode will add the example event in wazuh-notify-test-event.json instead of the message received through wazuh. +# This enables testing for particular events when the test event is customized. +test_mode = true + +# Enabling this parameter provides more logging to the wazuh-notifier log. +extended_logging = 2 + +# Enabling this parameter provides extended logging to the console. +extended_print = 2 + +# Below settings provide for a window that enable/disables events from firing the notifiers. +excluded_days = "" + +# Enter as a tuple of string values. Be aware of your regional settings. +excluded_hours = ["23:59", "00:00"] diff --git a/wazuh-notify-config.yaml b/wazuh-notify-config.yaml deleted file mode 100644 index 0ed1837..0000000 --- a/wazuh-notify-config.yaml +++ /dev/null @@ -1,66 +0,0 @@ ---- -# Start of wazuh notifier configuration yaml. - -# This is the yaml config file for wazuh-active-response (for both the Python and Go version) - -targets: "slack, ntfy, discord" # Platforms in this string with comma seperated values are triggered. -full_message: "" # Platforms in this string will enable sending the full event information. -full_alert: "" # Platforms in this string will enable sending the full event information. - -# Exclude rule events that are enabled in the ossec.conf active response definition. -# These settings provide an easier way to disable events from firing the notifiers. - -excluded_rules: "99999, 00000" # Enter as a string with comma seperated values -excluded_agents: "99999" # Enter as a string with comma seperated values - -# Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) -# https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html -# Enter threat_map as lists of integers, mention_threshold as integer and color as Hex integer - -priority_map: - - threat_map: [ 15,14,13,12 ] - mention_threshold: 1 - color: 0xec3e40 # Red, SEVERE - - threat_map: [ 11,10,9 ] - mention_threshold: 1 - color: 0xff9b2b # Orange, HIGH - - threat_map: [ 8,7,6 ] - mention_threshold: 5 - color: 0xf5d800 # Yellow, ELEVATED - - threat_map: [ 5,4 ] - mention_threshold: 20 - color: 0x377fc7 # Blue, GUARDED - - threat_map: [ 3,2,1,0 ] - mention_threshold: 20 - color: 0x01a465 # Green, LOW - -# The next 2 settings are used to add information to the messages. -sender: "Wazuh (IDS)" -click: "https://documentation.wazuh.com/" - -########################################################################################### -# From here on the settings are ONLY used by the Python version of wazuh-active-response. # -########################################################################################### - -# Below settings provide for a window that enable/disables events from firing the notifiers. -excluded_days: "" # Enter as a string with comma seperated values. Be aware of your regional settings. -excluded_hours: [ "23:59", "00:00" ] # Enter as a tuple of string values. Be aware of your regional settings. - -# Following parameter defines the markdown characters to emphasise the parameter names in the notification messages -markdown_emphasis: - slack: "*" - ntfy: "**" - discord: "**" - -# The next settings are used for testing. Test mode will add the example event in wazuh-notify-test-event.json instead of the -# message received through wazuh. This enables testing for particular events when the test event is customized. -test_mode: False - -# Enabling this parameter provides more logging to the wazuh-notifier log. -extended_logging: 2 - -# Enabling this parameter provides extended logging to the console. -extended_print: 0 - -# End of wazuh notifier configuration yaml -... diff --git a/wazuh-notify-go/.env b/wazuh-notify-go/.env deleted file mode 100644 index cecf3fc..0000000 --- a/wazuh-notify-go/.env +++ /dev/null @@ -1,2 +0,0 @@ -DISCORD_URL=https://discord.com/api/webhooks/1237526475306176572/kHGnaQiM8qWOfdLIN1LWqgq3dsfqiHtsfs-Z5FralJNdX5hdw-MOPf4zzIDiFVjcIat4 -NTFY_URL=https://ntfy.sh/__KleinTest \ No newline at end of file diff --git a/wazuh-notify-go/go.mod b/wazuh-notify-go/go.mod index 5897e35..817cce4 100644 --- a/wazuh-notify-go/go.mod +++ b/wazuh-notify-go/go.mod @@ -3,6 +3,6 @@ module wazuh-notify go 1.22 require ( + github.com/BurntSushi/toml v1.4.0 github.com/joho/godotenv v1.5.1 - gopkg.in/yaml.v2 v2.4.0 ) diff --git a/wazuh-notify-go/go.sum b/wazuh-notify-go/go.sum index f7e7502..4261ff8 100644 --- a/wazuh-notify-go/go.sum +++ b/wazuh-notify-go/go.sum @@ -1,3 +1,5 @@ +github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0= +github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= diff --git a/wazuh-notify-go/main.go b/wazuh-notify-go/main.go index 3e34362..87e2bdc 100644 --- a/wazuh-notify-go/main.go +++ b/wazuh-notify-go/main.go @@ -2,25 +2,32 @@ package main import ( "strings" - "wazuh-notify/log" - "wazuh-notify/notification" "wazuh-notify/services" + "wazuh-notify/services/log" + "wazuh-notify/targets/discord" + "wazuh-notify/targets/ntfy" + "wazuh-notify/targets/slack" ) func main() { - inputParams := services.InitNotify() + //Read config file and .env + configParams := services.ReadConfig() + //Parse command line flags + inputParams := services.ParseFlags(configParams) + //Parse wazuh input data from stdin + Params := services.ParseWazuhInput(inputParams) - for _, target := range strings.Split(inputParams.Targets, ",") { + for _, target := range strings.Split(Params.General.Targets, ", ") { switch target { case "discord": log.Log(target) - notification.SendDiscord(inputParams) + discord.SendDiscord(Params) case "ntfy": log.Log(target) - notification.SendNtfy(inputParams) + ntfy.SendNtfy(Params) case "slack": log.Log(target) - notification.SendSlack(inputParams) + slack.SendSlack(Params) } } log.CloseLogFile() diff --git a/wazuh-notify-go/notification/discord.go b/wazuh-notify-go/notification/discord.go deleted file mode 100644 index 4241b36..0000000 --- a/wazuh-notify-go/notification/discord.go +++ /dev/null @@ -1,73 +0,0 @@ -package notification - -import ( - "bytes" - "encoding/json" - "log" - "net/http" - "os" - "slices" - "strconv" - "strings" - "time" - "wazuh-notify/types" -) - -func SendDiscord(params types.Params) { - - var embedDescription string - - if slices.Contains(strings.Split(params.FullAlert, ","), "discord") { - fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") - fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") - fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "}", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "[", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "]", "") - fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "") - - embedDescription = "\n\n ```" + - fullAlertString + - "```\n\n" + - "Priority: " + strconv.Itoa(params.Priority) + "\n" + - "Tags: " + params.Tags + "\n\n" + - params.Click - } else { - embedDescription = "\n\n" + - "**Timestamp: **" + time.Now().Format(time.DateTime) + "\n" + - "**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + - "**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + - "**Rule:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + - "**Description: **" + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + - "**Threat level:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + - "**Times fired:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + - "\n\n" + - "Priority: " + strconv.Itoa(params.Priority) + "\n" + - "Tags: " + params.Tags + "\n\n" + - params.Click - } - - message := types.Message{ - Username: params.Sender, - Content: params.Mention, - Embeds: []types.Embed{ - { - Title: params.Sender, - Description: embedDescription, - Color: params.Color, - }, - }, - } - - payload := new(bytes.Buffer) - - err := json.NewEncoder(payload).Encode(message) - if err != nil { - return - } - - _, err = http.Post(os.Getenv("DISCORD_URL"), "application/json", payload) - if err != nil { - log.Fatalf("An Error Occured %v", err) - } -} diff --git a/wazuh-notify-go/notification/ntfy.go b/wazuh-notify-go/notification/ntfy.go deleted file mode 100644 index c408d95..0000000 --- a/wazuh-notify-go/notification/ntfy.go +++ /dev/null @@ -1,56 +0,0 @@ -package notification - -import ( - "encoding/json" - "net/http" - "os" - "slices" - "strconv" - "strings" - "time" - "wazuh-notify/types" -) - -func SendNtfy(params types.Params) { - - var payload string - - if slices.Contains(strings.Split(params.FullAlert, ","), "discord") { - fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") - fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") - fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "}", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "[", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "]", "") - fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "") - - payload = "\n\n ```" + - fullAlertString + - "```" - } else { - payload = time.Now().Format(time.RFC3339) + "\n\n" + - "Agent: " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + - "Event id: " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + - "Description: " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + - "Threat level: " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + - "Times fired: " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + "\n" - } - - req, _ := http.NewRequest("POST", os.Getenv("NTFY_URL"), strings.NewReader(payload)) - req.Header.Set("Content-Type", "text/plain") - - if params.Sender != "" { - req.Header.Add("Title", params.Sender) - } - if params.Tags != "" { - req.Header.Add("Tags", params.Tags) - } - if params.Click != "" { - req.Header.Add("Click", params.Click) - } - if params.Priority != 0 { - req.Header.Add("Priority", strconv.Itoa(params.Priority)) - } - - http.DefaultClient.Do(req) -} diff --git a/wazuh-notify-go/notification/slack.go b/wazuh-notify-go/notification/slack.go deleted file mode 100644 index 375a3ea..0000000 --- a/wazuh-notify-go/notification/slack.go +++ /dev/null @@ -1,73 +0,0 @@ -package notification - -import ( - "bytes" - "encoding/json" - "log" - "net/http" - "os" - "slices" - "strconv" - "strings" - "time" - "wazuh-notify/types" -) - -func SendSlack(params types.Params) { - - var embedDescription string - - if slices.Contains(strings.Split(params.FullAlert, ","), "slack") { - fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") - fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") - fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "}", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "[", "") - fullAlertString = strings.ReplaceAll(fullAlertString, "]", "") - fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "") - - embedDescription = "\n\n ```" + - fullAlertString + - "```\n\n" + - "Priority: " + strconv.Itoa(params.Priority) + "\n" + - "Tags: " + params.Tags + "\n\n" + - params.Click - } else { - embedDescription = "\n\n" + - "**Timestamp: **" + time.Now().Format(time.DateTime) + "\n" + - "**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + - "**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + - "**Rule:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + - "**Description: **" + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + - "**Threat level:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + - "**Times fired:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + - "\n\n" + - "Priority: " + strconv.Itoa(params.Priority) + "\n" + - "Tags: " + params.Tags + "\n\n" + - params.Click - } - - message := types.Message{ - Username: params.Sender, - Content: params.Mention, - Embeds: []types.Embed{ - { - Title: params.Sender, - Description: embedDescription, - Color: params.Color, - }, - }, - } - - payload := new(bytes.Buffer) - - err := json.NewEncoder(payload).Encode(message) - if err != nil { - return - } - - _, err = http.Post(os.Getenv("SLACK_URL"), "application/json", payload) - if err != nil { - log.Fatalf("An Error Occured %v", err) - } -} diff --git a/wazuh-notify-go/services/config.go b/wazuh-notify-go/services/config.go new file mode 100644 index 0000000..a0285ee --- /dev/null +++ b/wazuh-notify-go/services/config.go @@ -0,0 +1,42 @@ +package services + +import ( + "github.com/BurntSushi/toml" + "github.com/joho/godotenv" + "os" + "path" + "wazuh-notify/services/log" + "wazuh-notify/types" +) + +func ReadConfig() types.Params { + + var configParams types.Params + //Get Path of executable location + baseFilePath, _ := os.Executable() + baseDirPath := path.Dir(baseFilePath) + //Open log file and set first message + log.OpenLogFile(baseDirPath) + //Load .env into environment variables + err := godotenv.Load(path.Join(baseDirPath, "../../etc/.env")) + if err != nil { + log.Log("env failed to load") + godotenv.Load(path.Join(baseDirPath, ".env")) + } else { + log.Log("env loaded") + } + //Read config file + tomlFile, err := os.ReadFile(path.Join(baseDirPath, "../../etc/wazuh-notify-config.toml")) + if err != nil { + log.Log("toml failed to load") + tomlFile, err = os.ReadFile(path.Join(baseDirPath, "wazuh-notify-config.toml")) + } + err = toml.Unmarshal(tomlFile, &configParams) + if err != nil { + print(err) + } else { + log.Log("yaml loaded") + } + + return configParams +} diff --git a/wazuh-notify-go/services/filters.go b/wazuh-notify-go/services/filters.go index 8f630b3..76f5316 100644 --- a/wazuh-notify-go/services/filters.go +++ b/wazuh-notify-go/services/filters.go @@ -3,19 +3,20 @@ package services import ( "os" "strings" - "wazuh-notify/log" + "wazuh-notify/services/log" + "wazuh-notify/types" ) -func Filter() { - for _, rule := range strings.Split(inputParams.ExcludedRules, ",") { - if rule == inputParams.WazuhMessage.Parameters.Alert.Rule.ID { +func Filter(params types.Params) { + for _, rule := range strings.Split(params.General.ExcludedRules, ",") { + if rule == params.WazuhMessage.Parameters.Alert.Rule.ID { log.Log("rule excluded") log.CloseLogFile() os.Exit(0) } } - for _, agent := range strings.Split(inputParams.ExcludedAgents, ",") { - if agent == inputParams.WazuhMessage.Parameters.Alert.Agent.ID { + for _, agent := range strings.Split(params.General.ExcludedAgents, ",") { + if agent == params.WazuhMessage.Parameters.Alert.Agent.ID { log.Log("agent excluded") log.CloseLogFile() os.Exit(0) diff --git a/wazuh-notify-go/services/flags.go b/wazuh-notify-go/services/flags.go new file mode 100644 index 0000000..39aa301 --- /dev/null +++ b/wazuh-notify-go/services/flags.go @@ -0,0 +1,20 @@ +package services + +import ( + "flag" + "wazuh-notify/services/log" + "wazuh-notify/types" +) + +func ParseFlags(params types.Params) types.Params { + //Set command line flags + flag.StringVar(¶ms.General.Click, "click", params.General.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") + flag.StringVar(¶ms.General.Sender, "sender", params.General.Sender+" Golang", "is the sender of the message, either an app name or a person. The default is \"Security message\".") + flag.StringVar(¶ms.General.Targets, "targets", params.General.Targets, "is a list of targets to send notifications to. Default is \"discord\".") + //Get flag values + flag.Parse() + + log.Log("flags loaded") + + return params +} diff --git a/wazuh-notify-go/services/init.go b/wazuh-notify-go/services/init.go deleted file mode 100644 index 707b63a..0000000 --- a/wazuh-notify-go/services/init.go +++ /dev/null @@ -1,97 +0,0 @@ -package services - -import ( - "bufio" - "encoding/json" - "flag" - "github.com/joho/godotenv" - "gopkg.in/yaml.v2" - "os" - "path" - "slices" - "strings" - "wazuh-notify/log" - "wazuh-notify/types" -) - -var inputParams types.Params -var configParams types.Params -var wazuhData types.WazuhMessage - -func InitNotify() types.Params { - BaseFilePath, _ := os.Executable() - BaseDirPath := path.Dir(BaseFilePath) - - log.OpenLogFile(BaseDirPath) - - err := godotenv.Load(path.Join(BaseDirPath, "../../etc/.env")) - if err != nil { - log.Log("env failed to load") - godotenv.Load(path.Join(BaseDirPath, ".env")) - } else { - log.Log("env loaded") - } - - yamlFile, err := os.ReadFile(path.Join(BaseDirPath, "../../etc/wazuh-notify-config.yaml")) - if err != nil { - log.Log("yaml failed to load") - yamlFile, err = os.ReadFile(path.Join(BaseDirPath, "wazuh-notify-config.yaml")) - } - err = yaml.Unmarshal(yamlFile, &configParams) - if err != nil { - print(err) - } - - log.Log("yaml loaded") - configParamString, _ := json.Marshal(configParams) - log.Log(string(configParamString)) - - flag.StringVar(&inputParams.Url, "url", "", "is the webhook URL of the Discord server. It is stored in .env.") - flag.StringVar(&inputParams.Click, "click", configParams.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.") - flag.IntVar(&inputParams.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.") - flag.StringVar(&inputParams.Sender, "sender", configParams.Sender, "is the sender of the message, either an app name or a person. The default is \"Security message\".") - flag.StringVar(&inputParams.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".") - flag.StringVar(&inputParams.Targets, "targets", "", "is a list of targets to send notifications to. Default is \"discord\".") - - flag.Parse() - - log.Log("params loaded") - inputParamString, _ := json.Marshal(inputParams) - log.Log(string(inputParamString)) - - inputParams.Targets = configParams.Targets - inputParams.FullAlert = configParams.FullAlert - inputParams.ExcludedAgents = configParams.ExcludedAgents - inputParams.ExcludedRules = configParams.ExcludedRules - inputParams.PriorityMaps = configParams.PriorityMaps - - wazuhInput() - - return inputParams -} - -func wazuhInput() { - reader := bufio.NewReader(os.Stdin) - - json.NewDecoder(reader).Decode(&wazuhData) - - inputParams.Tags += strings.Join(wazuhData.Parameters.Alert.Rule.Groups, ",") - - inputParams.WazuhMessage = wazuhData - - for i, _ := range configParams.PriorityMaps { - if slices.Contains(configParams.PriorityMaps[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { - inputParams.Color = inputParams.PriorityMaps[i].Color - if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= inputParams.PriorityMaps[i].MentionThreshold { - inputParams.Mention = "@here" - } - inputParams.Priority = 5 - i - } - } - - Filter() - - log.Log("Wazuh data loaded") - inputParamString, _ := json.Marshal(inputParams) - log.Log(string(inputParamString)) -} diff --git a/wazuh-notify-go/log/log.go b/wazuh-notify-go/services/log/log.go similarity index 97% rename from wazuh-notify-go/log/log.go rename to wazuh-notify-go/services/log/log.go index 5561aca..dfa3a10 100644 --- a/wazuh-notify-go/log/log.go +++ b/wazuh-notify-go/services/log/log.go @@ -29,7 +29,7 @@ func CloseLogFile() { if err != nil { panic(err) } - logFile.Close() + logFile.Close() } func Log(message string) { diff --git a/wazuh-notify-go/services/message.go b/wazuh-notify-go/services/message.go new file mode 100644 index 0000000..5c129b6 --- /dev/null +++ b/wazuh-notify-go/services/message.go @@ -0,0 +1,40 @@ +package services + +import ( + "encoding/json" + "fmt" + "slices" + "strconv" + "strings" + "time" + "wazuh-notify/types" +) + +func BuildMessage(params types.Params, target string, emphasis string) string { + + if slices.Contains(strings.Split(params.General.FullAlert, ","), target) { + fullAlert, _ := json.MarshalIndent(params.WazuhMessage, "", " ") + fullAlertString := strings.ReplaceAll(string(fullAlert), `"`, "") + fullAlertString = strings.ReplaceAll(fullAlertString, "{", "") + fullAlertString = strings.ReplaceAll(fullAlertString, "}", "") + fullAlertString = strings.ReplaceAll(fullAlertString, "[", "") + fullAlertString = strings.ReplaceAll(fullAlertString, "]", "") + fullAlertString = strings.ReplaceAll(fullAlertString, " ,", "") + + return "\n\n ```" + + fullAlertString + + "```\n\n" + } else { + return "\n\n" + + fmt.Sprintf("%sTimestamp:%s ", emphasis, emphasis) + time.Now().Format(time.DateTime) + "\n" + + fmt.Sprintf("%sAgent:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" + + fmt.Sprintf("%sEvent id:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" + + fmt.Sprintf("%sRule:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" + + fmt.Sprintf("%sDescription:%s ", emphasis, emphasis) + params.WazuhMessage.Parameters.Alert.FullLog + "\n" + + fmt.Sprintf("%sThreat level:%s ", emphasis, emphasis) + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" + + fmt.Sprintf("%sTimes fired:%s ", emphasis, emphasis) + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + + "\n\n" + + fmt.Sprintf("%sPriority:%s ", emphasis, emphasis) + strconv.Itoa(params.Priority) + "\n" + + } +} diff --git a/wazuh-notify-go/services/wazuhData.go b/wazuh-notify-go/services/wazuhData.go new file mode 100644 index 0000000..ac24a7f --- /dev/null +++ b/wazuh-notify-go/services/wazuhData.go @@ -0,0 +1,48 @@ +package services + +import ( + "bufio" + "encoding/json" + "os" + "slices" + "strings" + "wazuh-notify/services/log" + "wazuh-notify/types" +) + +func ParseWazuhInput(params types.Params) types.Params { + + var wazuhData types.WazuhMessage + //Read stdin + reader := bufio.NewReader(os.Stdin) + //Decode stdin to wazuhData + json.NewDecoder(reader).Decode(&wazuhData) + //Parse tags + params.Tags += strings.Join(wazuhData.Parameters.Alert.Rule.Groups, ",") + + params.WazuhMessage = wazuhData + //Map priority and color based on config + for i := range params.PriorityMap { + if slices.Contains(params.PriorityMap[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) { + //Check notify threshold + if params.WazuhMessage.Parameters.Alert.Rule.Firedtimes%params.PriorityMap[i].NotifyThreshold != 0 { + log.Log("threshold not met") + log.CloseLogFile() + os.Exit(0) + } + //Set color based on config map + params.Color = params.PriorityMap[i].Color + //Check mention threshold + if params.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= params.PriorityMap[i].MentionThreshold { + params.Mention = "@here" + } + params.Priority = 5 - i + } + } + + log.Log("Wazuh data loaded") + //Filter messages based on rules defined in config + Filter(params) + + return params +} diff --git a/wazuh-notify-go/targets/discord/discord.go b/wazuh-notify-go/targets/discord/discord.go new file mode 100644 index 0000000..fced433 --- /dev/null +++ b/wazuh-notify-go/targets/discord/discord.go @@ -0,0 +1,42 @@ +package discord + +import ( + "bytes" + "encoding/json" + "log" + "net/http" + "os" + "wazuh-notify/services" + "wazuh-notify/types" +) + +func SendDiscord(params types.Params) { + //Build message content + embedDescription := services.BuildMessage(params, "discord", params.MarkdownEmphasis.Discord) + + "**Tags:** " + params.Tags + "\n\n" + + params.General.Click + //Build message + message := DiscordMessage{ + Username: params.General.Sender, + Content: params.Mention, + Embeds: []Embed{ + { + Title: params.General.Sender, + Description: embedDescription, + Color: params.Color, + }, + }, + } + + payload := new(bytes.Buffer) + //Parse message to json + err := json.NewEncoder(payload).Encode(message) + if err != nil { + return + } + //Send message to webhook + _, err = http.Post(os.Getenv("DISCORD_URL"), "application/json", payload) + if err != nil { + log.Fatalf("An Error Occured %v", err) + } +} diff --git a/wazuh-notify-go/targets/discord/types.go b/wazuh-notify-go/targets/discord/types.go new file mode 100644 index 0000000..dbaa586 --- /dev/null +++ b/wazuh-notify-go/targets/discord/types.go @@ -0,0 +1,14 @@ +package discord + +type DiscordMessage struct { + Username string `json:"username,omitempty"` + AvatarUrl string `json:"avatar_url,omitempty"` + Content string `json:"content,omitempty"` + Embeds []Embed `json:"embeds,omitempty"` +} + +type Embed struct { + Title string `json:"title,omitempty"` + Description string `json:"description,omitempty"` + Color int `json:"color,omitempty"` +} diff --git a/wazuh-notify-go/targets/ntfy/ntfy.go b/wazuh-notify-go/targets/ntfy/ntfy.go new file mode 100644 index 0000000..1d27848 --- /dev/null +++ b/wazuh-notify-go/targets/ntfy/ntfy.go @@ -0,0 +1,35 @@ +package ntfy + +import ( + "net/http" + "os" + "strconv" + "strings" + "wazuh-notify/services" + "wazuh-notify/types" +) + +func SendNtfy(params types.Params) { + //Create request and build message + req, _ := http.NewRequest( + "POST", + os.Getenv("NTFY_URL"), + strings.NewReader(" "+services.BuildMessage(params, "ntfy", params.MarkdownEmphasis.Ntfy))) + + req.Header.Set("Content-Type", "text/markdown") + //Set headers if not empty + if params.General.Sender != "" { + req.Header.Add("Title", params.General.Sender) + } + if params.Tags != "" { + req.Header.Add("Tags", params.Tags) + } + if params.General.Click != "" { + req.Header.Add("Click", params.General.Click) + } + if params.Priority != 0 { + req.Header.Add("Priority", strconv.Itoa(params.Priority)) + } + //Send request + http.DefaultClient.Do(req) +} diff --git a/wazuh-notify-go/targets/ntfy/types.go b/wazuh-notify-go/targets/ntfy/types.go new file mode 100644 index 0000000..19634d4 --- /dev/null +++ b/wazuh-notify-go/targets/ntfy/types.go @@ -0,0 +1 @@ +package ntfy diff --git a/wazuh-notify-go/targets/slack/slack.go b/wazuh-notify-go/targets/slack/slack.go new file mode 100644 index 0000000..d8c0351 --- /dev/null +++ b/wazuh-notify-go/targets/slack/slack.go @@ -0,0 +1,32 @@ +package slack + +import ( + "bytes" + "encoding/json" + "log" + "net/http" + "os" + "wazuh-notify/services" + "wazuh-notify/types" +) + +func SendSlack(params types.Params) { + //Build message + message := SlackMessage{ + Text: services.BuildMessage(params, "slack", params.MarkdownEmphasis.Slack) + + "*Tags:* " + params.Tags + "\n\n" + + params.General.Click, + } + + payload := new(bytes.Buffer) + //Parse message to json + err := json.NewEncoder(payload).Encode(message) + if err != nil { + return + } + //Send message to webhook + _, err = http.Post(os.Getenv("SLACK_URL"), "application/json", payload) + if err != nil { + log.Fatalf("An Error Occured %v", err) + } +} diff --git a/wazuh-notify-go/targets/slack/types.go b/wazuh-notify-go/targets/slack/types.go new file mode 100644 index 0000000..cca8e79 --- /dev/null +++ b/wazuh-notify-go/targets/slack/types.go @@ -0,0 +1,5 @@ +package slack + +type SlackMessage struct { + Text string `json:"text,omitempty"` +} diff --git a/wazuh-notify-go/types/params.go b/wazuh-notify-go/types/params.go new file mode 100644 index 0000000..186dabd --- /dev/null +++ b/wazuh-notify-go/types/params.go @@ -0,0 +1,33 @@ +package types + +type Params struct { + General General `toml:"general"` + Url string + Priority int + Tags string + Color int + Mention string + WazuhMessage WazuhMessage + PriorityMap []PriorityMap `toml:"priority_map"` + MarkdownEmphasis MarkdownEmphasis `toml:"markdown_emphasis"` +} + +type General struct { + Targets string `toml:"targets"` + FullAlert string `toml:"full_alert"` + ExcludedRules string `toml:"excluded_rules"` + ExcludedAgents string `toml:"excluded_agents"` + Sender string `toml:"sender"` + Click string `toml:"click"` +} +type PriorityMap struct { + ThreatMap []int `toml:"threat_map"` + MentionThreshold int `toml:"mention_threshold"` + NotifyThreshold int `toml:"notify_threshold"` + Color int `toml:"color"` +} +type MarkdownEmphasis struct { + Slack string `toml:"slack"` + Ntfy string `toml:"ntfy"` + Discord string `toml:"discord"` +} diff --git a/wazuh-notify-go/types/types.go b/wazuh-notify-go/types/types.go deleted file mode 100644 index 436cfd9..0000000 --- a/wazuh-notify-go/types/types.go +++ /dev/null @@ -1,36 +0,0 @@ -package types - -type Params struct { - Url string - Sender string `yaml:"sender,omitempty"` - Priority int - Tags string - Click string `yaml:"click,omitempty"` - Targets string `yaml:"targets,omitempty"` - FullAlert string `yaml:"full_message,omitempty"` - ExcludedRules string `yaml:"excluded_rules,omitempty"` - ExcludedAgents string `yaml:"excluded_agents,omitempty"` - Color int - Mention string - WazuhMessage WazuhMessage - PriorityMaps []PriorityMap `yaml:"priority_map"` -} - -type PriorityMap struct { - ThreatMap []int `yaml:"threat_map"` - MentionThreshold int `yaml:"mention_threshold"` - Color int `yaml:"color"` -} - -type Message struct { - Username string `json:"username,omitempty"` - AvatarUrl string `json:"avatar_url,omitempty"` - Content string `json:"content,omitempty"` - Embeds []Embed `json:"embeds,omitempty"` -} - -type Embed struct { - Title string `json:"title,omitempty"` - Description string `json:"description,omitempty"` - Color int `json:"color,omitempty"` -} diff --git a/wazuh-notify-go/wazuh-notify-config.toml b/wazuh-notify-go/wazuh-notify-config.toml new file mode 100644 index 0000000..7d94861 --- /dev/null +++ b/wazuh-notify-go/wazuh-notify-config.toml @@ -0,0 +1,84 @@ +############################################################################################################# +# This is the TOML config file for wazuh-notify (active response) for both the Python and Go implementation # +############################################################################################################# + +[general] +# Platforms in this string with comma seperated values are triggered. +targets = "slack, ntfy, discord" + +# Platforms in this string will enable sending the full event information. +full_alert = "" + +# Exclude rule events that are enabled in the ossec.conf active response definition. +# These settings provide an easier way to disable events from firing the notifiers. +excluded_rules = "99999, 00000" +excluded_agents = "99999" + +# The next 2 settings are used to add information to the messages. +sender = "Wazuh (IDS)" +click = "https://documentation.wazuh.com/" + +# Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord) +# https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html +# Enter threat_map as lists of integers, mention/notify_threshold as integer and color as Hex integer +[[priority_map]] +threat_map = [15, 14, 13, 12] +mention_threshold = 1 +notify_threshold = 1 +color = 0xec3e40 # Red, SEVERE + +[[priority_map]] +threat_map = [11, 10, 9] +mention_threshold = 1 +notify_threshold = 1 +color = 0xff9b2b # Orange, HIGH + +[[priority_map]] +threat_map = [8, 7, 6] +mention_threshold = 5 +notify_threshold = 5 +color = 0xf5d800 # Yellow, ELEVATED + +[[priority_map]] +threat_map = [5, 4] +mention_threshold = 20 +notify_threshold = 5 +color = 0x377fc7 # Blue, GUARDED + +[[priority_map]] +threat_map = [3, 2, 1, 0] +mention_threshold = 20 +notify_threshold = 5 +color = 0x01a465 # Green, LOW + +################ End of priority mapping ################################## + +# Following parameter defines the markdown characters to emphasise the parameter names in the notification messages +[markdown_emphasis] +slack = "*" +ntfy = "**" +discord = "**" + +################################################################################## +# From here on the settings are ONLY used by the Python version of wazuh-notify. # +################################################################################## + +[python] + +# The next settings are used for testing and troubleshooting. + +# Test mode will add the example event in wazuh-notify-test-event.json instead of the message received through wazuh. +# This enables testing for particular events when the test event is customized. +test_mode = true + +# Enabling this parameter provides more logging to the wazuh-notifier log. +extended_logging = 2 + +# Enabling this parameter provides extended logging to the console. +extended_print = 2 + +# Below settings provide for a window that enable/disables events from firing the notifiers. +excluded_days = "" + +# Enter as a tuple of string values. Be aware of your regional settings. +excluded_hours = ["23:59", "00:00"] diff --git a/wazuh-notify-go/wazuh-notify-config.yaml b/wazuh-notify-go/wazuh-notify-config.yaml deleted file mode 100644 index a86ea54..0000000 --- a/wazuh-notify-go/wazuh-notify-config.yaml +++ /dev/null @@ -1,46 +0,0 @@ ---- -#start of yaml - -# This is the yaml config file for both the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py. -# The yaml needs to be in the same folder as the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py - -targets: "discord,ntfy" -full_message: "ntfy" - -# Exclude rules that are listed in the ossec.conf active response definition. - -excluded_rules: "5401,5403" -excluded_agents: "999" - -# Priority mapping from 1-12 (Wazuh events) to 1-5 (Discord and ntfy notification) -# Discord mention after x amount of event fired times - -priority_map: - - - threat_map: [15,14,13,12] - mention_threshold: 1 - color: 0xcc3300 - - - threat_map: [11,10,9] - mention_threshold: 1 - color: 0xff9966 - - - threat_map: [8,7,6] - mention_threshold: 5 - color: 0xffcc00 - - - threat_map: [5,4] - mention_threshold: 5 - color: 0x99cc33 - - - threat_map: [3,2,1,0] - mention_threshold: 5 - color: 0x339900 - - -sender: "Wazuh (IDS)" -click: "https://google.com" - - -#end of yaml -... \ No newline at end of file diff --git a/wazuh-notify-python/wazuh-notify.py b/wazuh-notify-python/wazuh-notify.py index b1c273e..42afdb9 100755 --- a/wazuh-notify-python/wazuh-notify.py +++ b/wazuh-notify-python/wazuh-notify.py @@ -5,7 +5,7 @@ # License (version 2) as published by the FSF - Free Software # Foundation. # -# Rudi Klein, april 2024 +# Rudi Klein, May 2024 import requests @@ -14,168 +14,117 @@ from wazuh_notify_module import * def main(): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. me = frame(0).f_code.co_name him = frame(1).f_code.co_name - # Load the YAML config. - + # Load the TOML config. config: dict = get_config() - logger(0, config, me, him, "############ Processing event ###############################") - logger(2, config, me, him, "Loading yaml configuration") # Get the arguments used with running the script. - arguments = get_arguments() - # Check if we are in test mode (test_mode setting in config yaml). If so, load test event instead of live event. - if config.get("test_mode"): - - logger(1, config, me, him, "Running in test mode: using test message wazuh-notify-test-event.json") - - # Load the test event data. - - home_path, _, _ = set_environment() - with (open(home_path + '/etc/wazuh-notify-test-event.json') as event_file): - data: dict = json.loads(event_file.read()) - - else: - - # We are running live. Load the data from the Wazuh process. - - logger(2, config, me, him, "Running in live mode: using live message") - data = load_message() + # Check for test mode. Use test data if true + data = check_test_mode(config) # Extract the 'alert' section of the (JSON) event - alert = data["parameters"]["alert"] logger(2, config, me, him, "Extracting data from the event") - # Check the config for any exclusion rules - - fire_notification = exclusions_check(config, alert) - logger(1, config, me, him, "Checking if we are outside of the exclusion rules: " + str(fire_notification)) - - if not fire_notification: - - # The event was excluded by the exclusion rules in the configuration. - - logger(1, config, me, him, "Event excluded, no notification sent. Exiting") - exit() - else: - - # The event was not excluded by the exclusion rules in the configuration. Keep processing. - - logger(2, config, me, him, "Event NOT excluded, notification will be sent") + # Check the config for any exclusion rules and abort when excluded. + exclusions_check(config, alert) # Get the mapping from event threat level to priority, color and mention_flag. - priority, color, mention = threat_mapping(config, alert['rule']['level'], alert['rule']['firedtimes']) - logger(2, config, me, him, "Threat mapping done: " + - "prio:" + str(priority) + " color:" + str(color) + " mention:" + mention) - # If the target argument was used with the script, we'll use that instead of the configuration parameter. - config["targets"] = arguments['targets'] if arguments['targets'] != "" else config["targets"] - # Prepare the messaging platform specific request and execute - + # Prepare the messaging platform specific notification and execute if configured. if "discord" in config["targets"]: + # Show me some ID! Stop resisting! caller = "discord" + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name # Load the url/webhook from the configuration. - discord_url, _, _ = get_env() - discord_url = arguments['url'] if arguments['url'] else discord_url - # Build the basic notification message content. + # Build the basic message content. + message_body: str = construct_message_body(caller, config, arguments, alert) - notification: str = construct_basic_message(config, arguments, caller, alert) - logger(2, config, me, him, caller + " basic message constructed") + # Common preparation of the notification. + notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, priority) # Build the payload(s) for the POST request. + _, _, payload_json = build_discord_notification(caller, config, notification_body, color, mention, sender) - _, _, payload_json = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) + # Build the notification to be sent. + build_discord_notification(caller, config, notification_body, color, mention, sender) # POST the notification through requests. - - result = requests.post(discord_url, json=payload_json) - - logger(1, config, me, him, caller + " notification constructed and HTTPS request done: " + str(result)) + discord_result = requests.post(discord_url, json=payload_json) + logger(1, config, me, him, caller + " notification constructed and sent: " + str(discord_result)) if "ntfy" in config["targets"]: + # Show me some ID! Stop resisting! caller = "ntfy" + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name # Load the url/webhook from the configuration. - _, ntfy_url, _ = get_env() + ntfy_url = arguments['url'] if arguments['url'] else ntfy_url - # Build the basic notification message content. + # Build the basic message content. + message_body: str = construct_message_body(caller, config, arguments, alert) - notification: str = construct_basic_message(config, arguments, caller, alert) - - logger(2, config, me, him, caller + " basic message constructed") + # Common preparation of the notification. + notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, priority) # Build the payload(s) for the POST request. - payload_headers, payload_data, _ = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) + payload_headers, payload_data, _ = build_ntfy_notification(caller, config, notification_body, color, mention, + sender) + + # Build the notification to be sent. + build_ntfy_notification(caller, config, notification_body, priority, click, sender) # POST the notification through requests. + ntfy_result = requests.post(ntfy_url, data=payload_data, headers=payload_headers) + logger(1, config, me, him, caller + " notification constructed and sent: " + str(ntfy_result)) - result = requests.post(ntfy_url, data=payload_data, headers=payload_headers) - logger(1, config, me, him, caller + " notification constructed and request done: " + str(result)) - - if "slack" in config["targets"]: - caller = "slack" - - # Load the url/webhook from the configuration. - - _, _, slack_url = get_env() - - # Build the basic notification message content. - - notification: str = construct_basic_message(config, arguments, caller, alert) - - logger(2, config, me, him, caller + " basic message constructed") - - # Build the payload(s) for the POST request. - - _, _, payload_json = build_notification(caller, - config, - arguments, - notification, - alert, - priority, - color, - mention - ) - - # POST the notification through requests. - - result = requests.post(slack_url, headers={'Content-Type': 'application/json'}, json=payload_json) - - logger(1, config, me, him, caller + " notification constructed and request done: " + str(result)) + # if "slack" in config["targets"]: + # # Show me some ID! Stop resisting! + # caller = "slack" + # me = frame(0).f_code.co_name + # him = frame(1).f_code.co_name + # + # # Load the url/webhook from the configuration. + # _, _, slack_url = get_env() + # slack_url = arguments['url'] if arguments['url'] else slack_url + # + # # Build the basic message content. + # message_body: str = construct_message_body(caller, config, arguments, data) + # + # # Common preparation of the notification. + # notification_body, click, sender = prepare_payload(caller, config, arguments, message_body, alert, + # priority) + # # Build the payload(s) for the POST request. + # _, _, payload_json = build_slack_notification(caller, config, notification_body, priority, color, mention, + # click, sender) + # + # # Build the notification to be sent. + # build_slack_notification(caller, config, notification_body, priority, click, sender) + # + # result = requests.post(slack_url, headers={'Content-Type': 'application/json'}, json=payload_json) + # + # logger(1, config, me, him, caller + " notification constructed and sent: " + str(result)) logger(0, config, me, him, "############ Event processed ################################") exit(0) -if __name__ == "__main__": +if "__main__" == __name__: main() diff --git a/wazuh-notify-python/wazuh_notify_module.py b/wazuh-notify-python/wazuh_notify_module.py index 2b04b38..c508db8 100755 --- a/wazuh-notify-python/wazuh_notify_module.py +++ b/wazuh-notify-python/wazuh_notify_module.py @@ -8,7 +8,7 @@ import time from os.path import join, dirname from sys import _getframe as frame -import yaml +import tomli from dotenv import load_dotenv @@ -17,23 +17,20 @@ from dotenv import load_dotenv # config_path = wazuh-notify-config.yaml def set_environment() -> tuple: - - set_wazuh_path = os.path.abspath(os.path.join(__file__, "../../..")) + set_wazuh_path = os.path.abspath(os.path.join(__file__, "../..")) + # set_wazuh_path = os.path.abspath(os.path.join(__file__, "../../..")) set_log_path = '{0}/logs/wazuh-notify.log'.format(set_wazuh_path) - set_config_path = '{0}/etc/wazuh-notify-config.yaml'.format(set_wazuh_path) + set_config_path = '{0}/etc/wazuh-notify-config.toml'.format(set_wazuh_path) return set_wazuh_path, set_log_path, set_config_path # Set paths for use in this module - wazuh_path, log_path, config_path = set_environment() # Set structured timestamps for notifications. - def set_time_format(): - now_message = time.strftime('%A, %d %b %Y %H:%M:%S') now_logging = time.strftime('%Y-%m-%d %H:%M:%S') now_time = time.strftime('%H:%M') @@ -43,53 +40,40 @@ def set_time_format(): # Logger: print to console and/or log to file - def logger(level, config, me, him, message): _, now_logging, _, _ = set_time_format() - + logger_wazuh_path = os.path.abspath(os.path.join(__file__, "../../..")) logger_log_path = '{0}/logs/wazuh-notify.log'.format(logger_wazuh_path) # When logging from main(), the destination function is called "". For cosmetic reasons rename to "main". - him = 'main' if him == '' else him - - log_line = f'{now_logging} | {level} | {me: <23} | {him: <15} | {message}' + log_line = f'{now_logging} | {level} | {me: <26} | {him: <13} | {message}' # Compare the extended_print log level in the configuration to the log level of the message. - - if config.get('extended_print') >= level: + if config.get('python').get('extended_print', 0) >= level: print(log_line) - try: # Compare the extended_logging level in the configuration to the log level of the message. - - if config.get("extended_logging") >= level: + if config.get('python').get('extended_logging', 0) >= level: with open(logger_log_path, mode="a") as log_file: log_file.write(log_line + "\n") - except (FileNotFoundError, PermissionError, OSError): - # Special message to console when logging to file fails and console logging might not be set. - - log_line = f'{now_logging} | {level} | {me: <23} | {him: <15} | error opening log file: {logger_log_path}' + log_line = f'{now_logging} | {level} | {me: <26} | {him: <13} | error opening log file: {logger_log_path}' print(log_line) # Get the content of the .env file (url's and/or webhooks). - def get_env(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Write the configuration to a dictionary. - config: dict = get_config() # Check if the secrets .env file is available. - try: dotenv_path = join(dirname(__file__), '.env') load_dotenv(dotenv_path) @@ -98,67 +82,55 @@ def get_env(): raise Exception(dotenv_path, "file not found") # Retrieve URLs from .env - discord_url = os.getenv("DISCORD_URL") ntfy_url = os.getenv("NTFY_URL") slack_url = os.getenv("SLACK_URL") except Exception as err: - # output error, and return with an error code - logger(0, config, me, him, 'Error reading ' + str(err)) exit(err) - logger(2, config, me, him, dotenv_path + " loaded") return discord_url, ntfy_url, slack_url # Read and process configuration settings from wazuh-notify-config.yaml and create dictionary. - def get_config(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - this_config_path: str = "" config: dict = {} + # logger(2, config, me, him, "Loading TOML configuration") try: _, _, this_config_path = set_environment() - - with open(this_config_path, 'r') as ntfier_config: - config: dict = yaml.safe_load(ntfier_config) - + with open(this_config_path, 'rb') as ntfier_config: + config: dict = tomli.load(ntfier_config) except (FileNotFoundError, PermissionError, OSError): logger(2, config, me, him, "Error accessing configuration file: " + this_config_path) - logger(2, config, me, him, "Reading configuration file: " + this_config_path) - config['targets'] = config.get('targets', 'discord, ntfy, slack') - config['full_alert'] = config.get('full_alert', '') - config['excluded_rules'] = config.get('excluded_rules', '') - config['excluded_agents'] = config.get('excluded_agents', '') + config['targets'] = config.get('general').get('targets', 'discord, slack, ntfy') + config['full_alert'] = config.get('general').get('full_alert', False) + config['excluded_rules'] = config.get('general').get('excluded_rules', '') + config['excluded_agents'] = config.get('general').get('excluded_agents', '') config['priority_map'] = config.get('priority_map', []) - config['sender'] = config.get('sender', 'Wazuh (IDS)') - config['click'] = config.get('click', 'https://wazuh.org') - config['md_e'] = config.get('markdown_emphasis', '') - - config['excluded_days'] = config.get('excluded_days', '') - config['excluded_hours'] = config.get('excluded_hours', '') - config['test_mode'] = config.get('test_mode', False) - config['extended_logging'] = config.get('extended_logging', True) - config['extended_print'] = config.get('extended_print', True) + config['sender'] = config.get('general').get('sender', 'Wazuh (IDS)') + config['click'] = config.get('general').get('click', 'https://wazuh.com') + config['md_e'] = config.get('general').get('markdown_emphasis', '') + config['excluded_days'] = config.get('python').get('excluded_days', '') + config['excluded_hours'] = config.get('python').get('excluded_hours', '') + config['test_mode'] = config.get('python').get('test_mode', False) + config['extended_logging'] = config.get('python').get('extended_logging', 0) + config['extended_print'] = config.get('python').get('extended_print', 0) return config # Show configuration settings from wazuh-notify-config.yaml - def view_config(): - _, _, this_config_path, _ = set_environment() try: @@ -170,23 +142,18 @@ def view_config(): # Get script arguments during execution. Params found here override config settings. - def get_arguments(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Retrieve the configuration information - config: dict = get_config() # Short options - options: str = "u:s:p:m:t:c:hv" # Long options - long_options: list = ["url=", "sender=", "targets=", @@ -212,7 +179,6 @@ def get_arguments(): """ # Initialize some variables. - url: str = "" sender: str = "" targets: str = "" @@ -222,17 +188,13 @@ def get_arguments(): click: str = "" # Fetch the arguments from the command line, skipping the first argument (name of the script). - argument_list: list = sys.argv[1:] - logger(2, config, me, him, "Found arguments:" + str(argument_list)) if not argument_list: - logger(1, config, me, him, 'No argument list found (no arguments provided with script execution') # Store defaults for the non-existing arguments in the arguments dictionary to avoid None errors. - arguments: dict = {'url': url, 'sender': sender, 'targets': targets, @@ -241,78 +203,55 @@ def get_arguments(): 'tags': tags, 'click': click} return arguments - else: - try: - logger(2, config, me, him, "Parsing arguments") # Parsing arguments - p_arguments, values = getopt.getopt(argument_list, options, long_options) # Check each argument. Arguments that are present will override the defaults. - for current_argument, current_value in p_arguments: - if current_argument in ("-h", "--help"): print(help_text) exit() - elif current_argument in ("-v", "--view"): view_config() exit() - elif current_argument in ("-u", "--url"): url: str = current_value - elif current_argument in ("-s", "--sender"): sender: str = current_value - elif current_argument in ("-d", "--targets"): targets: str = current_value - elif current_argument in ("-p", "--priority"): priority: int = int(current_value) - elif current_argument in ("-m", "--message"): message: str = current_value - elif current_argument in ("-t", "--tags"): tags: str = current_value - elif current_argument in ("-c", "--click"): click: str = current_value - except getopt.error as err: # Output error, and return error code - logger(0, config, me, him, "Error during argument parsing:" + str(err)) - logger(2, config, me, him, "Arguments returned as dictionary") # Store the arguments in the arguments dictionary. - arguments: dict = {'url': url, 'sender': sender, 'targets': targets, 'message': message, 'priority': priority, 'tags': tags, 'click': click} - return arguments # Receive and load message from Wazuh - def load_message(): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - config: dict = get_config() # get alert from stdin - logger(2, config, me, him, "Loading event message from STDIN") input_str: str = "" @@ -325,153 +264,136 @@ def load_message(): if data.get("command") == "add": logger(1, config, me, him, "Relevant event data found") return data - else: - # Event came in, but wasn't processed. - logger(0, config, me, him, "Event data not found") sys.exit(1) -# Check if there are reasons not to process this event. Check exclusions for rules, agents, days and hours. +# Check if we are in test mode (test_mode setting in config yaml). If so, load test event instead of live event. +def check_test_mode(config): + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + if config.get('python').get('test_mode'): + logger(1, config, me, him, "Running in test mode: using test message wazuh-notify-test-event.json") + # Load the test event data. + home_path, _, _ = set_environment() + with (open(home_path + '/etc/wazuh-notify-test-event.json') as event_file): + data: dict = json.loads(event_file.read()) + else: + # We are running live. Load the data from the Wazuh process. + logger(2, config, me, him, "Running in live mode: using live message") + data = load_message() + return data + + +# Check if there are reasons not to process this event. Check exclusions for rules, agents, days and hours. def exclusions_check(config, alert): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Set some environment - now_message, now_logging, now_weekday, now_time = set_time_format() # Check the exclusion records from the configuration yaml. - - ex_hours: tuple = config.get('excluded_hours') + logger(1, config, me, him, "Checking if we are outside of the exclusion rules: ") + ex_hours: tuple = config.get('python').get('excluded_hours') # Start hour may not be later than end hours. End hour may not exceed 00:00 midnight to avoid day jump. - ex_hours = [ex_hours[0], "23:59"] if (ex_hours[1] >= '23:59' or ex_hours[1] < ex_hours[0]) else ex_hours # Get some more exclusion records from the config. - - ex_days = config.get('excluded_days') - ex_agents = config.get("excluded_agents") - ex_rules = config.get("excluded_rules") + ex_days = config.get('python').get('excluded_days') + ex_agents = config.get('general').get("excluded_agents") + ex_rules = config.get('general').get("excluded_rules") # Check agent and rule from within the event. - ev_agent = alert['agent']['id'] ev_rule = alert['rule']['id'] # Let's assume all lights are green, until proven otherwise. - ex_hours_eval, ex_weekday_eval, ev_rule_eval, ev_agent_eval = True, True, True, True # Evaluate the conditions for sending a notification. Any False will cause the notification to be discarded. - if (now_time > ex_hours[0]) and (now_time < ex_hours[1]): - logger(2, config, me, him, "excluded: event inside exclusion time frame") - ex_hours_eval = False - elif now_weekday in ex_days: - logger(2, config, me, him, "excluded: event inside excluded weekdays") - ex_weekday_eval = False elif ev_rule in ex_rules: - logger(2, config, me, him, "excluded: event id inside exclusion list") - ev_rule_eval = False - elif ev_agent in ex_agents: - logger(2, config, me, him, "excluded: event agent inside exclusion list") - ev_rule_eval = False notification_eval = True if (ex_hours_eval and ex_weekday_eval and ev_rule_eval and ev_agent_eval) else False - logger(1, config, me, him, "Exclusion rules evaluated. Final decision: " + str(notification_eval)) - return notification_eval + if not notification_eval: + # The event was excluded by the exclusion rules in the configuration. + logger(1, config, me, him, "Event excluded, no notification sent. Exiting") + exit() + else: + # The event was not excluded by the exclusion rules in the configuration. Keep processing. + logger(2, config, me, him, "Event NOT excluded, notification will be sent") + return # Map the event threat level to the appropriate 5-level priority scale and color for use in the notification platforms. - def threat_mapping(config, threat_level, fired_times): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Map threat level to priority. Enters Homeland Security :-). - p_map = config.get('priority_map') - logger(2, config, me, him, "Prio map: " + str(p_map)) for i in range(len(p_map)): - logger(2, config, me, him, "Loop: " + str(i)) logger(2, config, me, him, "Level: " + str(threat_level)) if threat_level in p_map[i]["threat_map"]: - color_mapping = p_map[i]["color"] priority_mapping = 5 - i - logger(2, config, me, him, "Prio: " + str(priority_mapping)) logger(2, config, me, him, "Color: " + str(color_mapping)) if fired_times >= p_map[i]["mention_threshold"]: - # When this flag is set, Discord recipients get a stronger message (DM). - mention_flag = "@here" - else: - mention_flag = "" - logger(2, config, me, him, "Threat level mapped as: " + "prio:" + str(priority_mapping) + " color: " + str(color_mapping) + " mention: " + mention_flag) - return priority_mapping, color_mapping, mention_flag logger(0, config, me, him, "Threat level mapping failed! Returning garbage (99, 99, 99)") - return 99, 99, "99" # Construct the message that will be sent to the notifier platforms. - -def construct_basic_message(config, arguments, caller: str, data: dict) -> str: +def construct_message_body(caller, config, arguments, data: dict) -> str: # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name # Include a specific control sequence for markdown bold parameter names. - - md_map = config.get('markdown_emphasis') + # todo To be fixed + md_map = config.get('markdown_emphasis', '') md_e = md_map[caller] # If the --message (-m) argument was fulfilled, use this message to be sent. - if arguments['message']: - - basic_msg = arguments['message'] - + message_body = arguments['message'] else: - _, timestamp, _, _ = set_time_format() - basic_msg: str = \ + message_body: str = \ ( md_e + "Timestamp:" + md_e + " " + timestamp + "\n" + md_e + "Agent:" + md_e + " " + data["agent"]["name"] + " (" + data["agent"]["id"] + ")" + "\n" + @@ -479,32 +401,25 @@ def construct_basic_message(config, arguments, caller: str, data: dict) -> str: md_e + "Rule:" + md_e + " " + data["rule"]["description"] + "\n" + md_e + "Description:" + md_e + " " + data["full_log"] + "\n" + md_e + "Threat level:" + md_e + " " + str(data["rule"]["level"]) + "\n" + - md_e + "Times fired:" + md_e + " " + str(data["rule"]["firedtimes"]) + "\n") - - if caller == "ntfy": - # todo Check this out - basic_msg = " \n" + basic_msg + md_e + "Times fired:" + md_e + " " + str(data["rule"]["firedtimes"]) + "\n" + ) logger(2, config, me, him, caller + " basic message constructed.") - - return basic_msg + return message_body # Construct the notification (message + additional information) that will be sent to the notifier platforms. - -def build_notification(caller, config, arguments, notification, alert, priority, color, mention): +def prepare_payload(caller, config, arguments, message_body, alert, priority): # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. - me = frame(0).f_code.co_name him = frame(1).f_code.co_name - logger(2, config, me, him, caller + " notification being constructed.") + logger(2, config, me, him, "Notification being constructed.") - md_map = config.get('markdown_emphasis') + md_map = config.get('markdown_emphasis', '') md_e = md_map[caller] - click: str = config.get('click') - sender: str = config.get('sender') + click: str = config.get('general').get('click', 'https://wazuh.com') priority: str = str(priority) tags = (str(alert['rule']['groups']).replace("[", "") .replace("]", "") @@ -522,70 +437,85 @@ def build_notification(caller, config, arguments, notification, alert, priority, .replace(',', ' ') ) # Fill some of the variables with argument values if available. - # todo Redundant? - click = arguments['click'] if arguments['click'] else click priority = arguments['priority'] if arguments['priority'] else priority - sender = arguments['sender'] if arguments['sender'] else sender tags = arguments['tags'] if arguments['tags'] else tags + sender: str = config.get('general').get('sender', 'Wazuh (IDS)') + sender = arguments['sender'] if arguments['sender'] else sender + click: str = config.get('general').get('click', 'https://wazuh.com') + click = arguments['click'] if arguments['click'] else click # Add the full alert data to the notification. - if caller in config["full_alert"]: - logger(2, config, me, him, caller + "Full alert data will be sent.") - - notification: str = ("\n\n" + notification + "\n" + - md_e + "__Full event__" + md_e + "\n" + "```\n" + full_event + "```") - - # Add Priority & tags to the notification + logger(2, config, me, him, caller + "Full alert data will be attached.") + # Add the full alert data to the notification body + notification_body: str = ("\n\n" + message_body + "\n" + + md_e + "__Full event__" + md_e + "\n" + "```\n" + full_event + "```") + else: + notification_body: str = message_body + # Add priority & tags to the notification body + notification_body = (notification_body + "\n\n" + md_e + "Priority:" + md_e + " " + str(priority) + "\n" + + md_e + "Tags:" + md_e + " " + tags + "\n\n" + click) logger(2, config, me, him, caller + " adding priority and tags") - notification = (notification + "\n\n" + md_e + "Priority:" + md_e + " " + str(priority) + "\n" + - md_e + "Tags:" + md_e + " " + tags + "\n\n" + click) - config["targets"] = arguments['targets'] if arguments['targets'] != "" else config["targets"] - # Prepare the messaging platform specific notification and execute + return notification_body, click, sender - if caller == "discord": - logger(2, config, me, him, caller + " payload created") - payload_json = {"username": sender, - "content": mention, - "embeds": [{"description": notification, - "color": color, - "title": sender}]} +def build_discord_notification(caller, config, notification_body, color, mention, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + logger(2, config, me, him, caller + " payload created") - logger(2, config, me, him, caller + " notification built") + payload_json = {"username": sender, + "content": mention, + "embeds": [{"description": notification_body, + "color": color, + "title": sender}]} + logger(2, config, me, him, caller + " notification built") + return "", "", payload_json - return "", "", payload_json - if caller == "ntfy": - logger(2, config, me, him, caller + " payloads created") +def build_ntfy_notification(caller, config, notification_body, priority, click, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + logger(2, config, me, him, caller + " payloads created") - payload_data = notification - payload_headers = {"Markdown": "yes", - "Title": sender, - "Priority": str(priority), - "Click": click} + # if caller == "ntfy": + # todo Check this out + # basic_msg = " \n" + basic_msg - logger(2, config, me, him, caller + " notification built") + payload_data = notification_body + payload_headers = {"Markdown": "yes", + "Title": sender, + "Priority": str(priority), + "Click": click} + logger(2, config, me, him, caller + " notification built") + return payload_headers, payload_data, "" - return payload_headers, payload_data, "" - if caller == "slack": - logger(2, config, me, him, caller + " payloads created") +def build_slack_notification(caller, config, arguments, notification_body, priority, color, mention, click, sender): + # The 'me' variable sets the called function (current function), the 'him' the calling function. Used for logging. + me = frame(0).f_code.co_name + him = frame(1).f_code.co_name + sender: str = config.get('general').get('sender', 'Wazuh (IDS)') + sender = arguments['sender'] if arguments['sender'] else sender - # todo Need some investigation. + logger(2, config, me, him, caller + " payloads created") - payload_json = {"text": notification} - # payload_json = {"username": sender, - # "content": mention, - # "embeds": [{"description": notification, - # "color": color, - # "title": sender}]} + # todo Need some investigation. - logger(2, config, me, him, caller + " notification built") + payload_json = {"text": notification_body} + # payload_json = {"username": sender, + # "content": mention, + # "embeds": [{"description": notification, + # "color": color, + # "title": sender}]} - return "", "", payload_json + logger(2, config, me, him, caller + " notification built") + + return "", "", payload_json