Merge remote-tracking branch 'origin/master'
# Conflicts: # Writerside/topics/Wazuh-notifier.md
This commit is contained in:
commit
cc2bd4e10b
4
.env
4
.env
@ -1,2 +1,2 @@
|
||||
DISCORD_WEBHOOK=https://discord.com/api/webhooks/1235943329854783530/lgAd6On2gtLPCAZ0HABXCJvVFut7zTL0eGwYs7akkSQ7LEZA2hGtqKYag5vXMdBXJv6L
|
||||
|
||||
DISCORD_URL=https://discord.com/api/webhooks/1235943329854783530/lgAd6On2gtLPCAZ0HABXCJvVFut7zTL0eGwYs7akkSQ7LEZA2hGtqKYag5vXMdBXJv6L
|
||||
NTFY_URL=https://ntfy.sh/__KleinTest
|
||||
|
||||
126
README.md
126
README.md
@ -1,126 +0,0 @@
|
||||
# Wazuh notifier
|
||||
|
||||
Wazuh notifier enables the Wazuh manager to be notified when selected events occur.
|
||||
|
||||
## Contents
|
||||
|
||||
The main script is a custom active response Python script: wazuh-active-response.py.<br>
|
||||
The actual sending of the messages is done by 2 notifier Python scripts:<br>
|
||||
**Discord notifier**: wazuh-discord-notifier.py, and **NTFY.sh notifier**: wazuh-ntfy-notifier.py<br>
|
||||
A YAML configuration: wazuh-notifier-config.yaml, and a Python module: wazuh_notifier_lib.py
|
||||
|
||||
Wazuh notifier is a stateless implementation and only notifies, using the Discord and/or NTFY.sh messaging services.
|
||||
|
||||
The Wazuh notifier is triggered by configuring the **ossec.conf** and adding an **active response configuration.**
|
||||
|
||||
## Installation ##
|
||||
|
||||
### Step 1 ###
|
||||
|
||||
Download the files from https://github.com/RudiKlein/wazuh-notifier to your server.
|
||||
|
||||
### Step 2 ###
|
||||
|
||||
Copy the 4 Python files to the /var/ossec/active-response/bin/ folder
|
||||
|
||||
```
|
||||
$ cp <folder contaning downloaded Wazuh notifier files>/wazuh-*.py /var/ossec/active-response/bin/
|
||||
```
|
||||
|
||||
Set the correct ownership
|
||||
|
||||
```
|
||||
$ chown root:wazuh /var/ossec/active-response/bin/wazuh-*.py
|
||||
```
|
||||
|
||||
Set the correct permissions
|
||||
|
||||
```
|
||||
$ chmod uog+rx /var/ossec/active-response/bin/wazuh-*.py
|
||||
```
|
||||
|
||||
### Step 3 ###
|
||||
|
||||
Copy the YAML file to /var/ossec/etc/
|
||||
|
||||
```
|
||||
$ cp <folder contaning downloaded Wazuh notifier files>/wazuh-notifier-config.yaml /var/ossec/etc/
|
||||
```
|
||||
|
||||
Set the correct ownership
|
||||
|
||||
```
|
||||
$ chown root:wazuh /var/ossec/etc/wazuh-notifier-config.yaml
|
||||
```
|
||||
|
||||
Set the correct permissions
|
||||
|
||||
```
|
||||
$ chmod uog+r /var/ossec/etc/wazuh-notifier-config.yaml
|
||||
```
|
||||
|
||||
### Step 4 ###
|
||||
|
||||
Modify the ossec.conf configuration file and add the following<br>
|
||||
|
||||
```
|
||||
<command>
|
||||
<name>wazuh-active-response</name>
|
||||
<executable>wazuh-active-response.py</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
```
|
||||
|
||||
```
|
||||
<active-response>
|
||||
<command>wazuh-active-response</command>
|
||||
<location>server</location>
|
||||
<level></level>
|
||||
<rules_id></rules_id>
|
||||
</active-response>
|
||||
```
|
||||
|
||||
Add the rules you want to be informed about between the <rules_id></rules_id>, with the rules id's seperated by comma's.
|
||||
Example: <rules_id>5402, 3461, 8777</rules_id><br>
|
||||
(Please refer to the Wazuh online documentation for more information [^Wazuh docs])
|
||||
|
||||
[^Wazuh docs]: https://documentation.wazuh.com/current/user-manual/capabilities/active-response/index.html
|
||||
|
||||
## The Active Response module ##
|
||||
|
||||
The wazuh-active-response.py acts as the interface between Wazuh and the messaging notifiers for Discord and ntfy.
|
||||
It is based on the example active response Python script in the [^Wazuh docs].
|
||||
|
||||
## The Discord notifier ##
|
||||
|
||||
## The ntfy.sh notifier ##
|
||||
|
||||
## The YAML configuration ##
|
||||
|
||||
**Enable/disable the notifiers**<br>
|
||||
|
||||
```
|
||||
discord_enabled: 1 (0 if not set in the yaml configuration)
|
||||
ntfy_enabled: 1 (0 if not set in the yaml configuration)
|
||||
```
|
||||
|
||||
**Exclude rules that are enabled in the ossec.conf active response definition.**<br>
|
||||
This prevents the need to alter the ossec.conf for temporary rule disabling and stopping/starting wazuh-manager.
|
||||
Additionally, agents can also be excluded from notifications.
|
||||
|
||||
```
|
||||
excluded_rules: "5401, 5402, 5403"
|
||||
excluded_agents: "999"
|
||||
```
|
||||
|
||||
Default settings for the ntfy notifier. This overrules the hardcoded defaults.
|
||||
|
||||
```
|
||||
ntfy_server: "https://ntfy.sh/"
|
||||
ntfy_sender: "Wazuh (IDS)"
|
||||
ntfy_destination: "__KleinTest"
|
||||
ntfy_priority: "5"
|
||||
ntfy_message: "Test message"
|
||||
ntfy_tags: "information, testing, yaml"
|
||||
ntfy_click: "https://google.com"
|
||||
```
|
||||
10
golive.bsh
Executable file
10
golive.bsh
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
echo "Going live!"
|
||||
sudo cp /home/rudi/pycharm/wazuh-notifier.py /var/ossec/active-response/bin
|
||||
sudo cp /home/rudi/pycharm/wazuh_notifier_module.py /var/ossec/active-response/bin
|
||||
sudo cp /home/rudi/pycharm/etc/wazuh-notify-config.yaml /var/ossec/etc
|
||||
sudo cp /home/rudi/pycharm/wazuh-test-event.json /var/ossec/etc
|
||||
|
||||
echo copied: wazuh-notifier.py, wazuh_notifier_module.py
|
||||
echo "Live!"
|
||||
|
||||
@ -1,258 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
|
||||
# This script is adapted version of the Python active response script sample, provided by Wazuh, in the documentation:
|
||||
# https://documentation.wazuh.com/current/user-manual/capabilities/active-response/custom-active-response-scripts.html
|
||||
# It is provided under the below copyright statement:
|
||||
#
|
||||
# Copyright (C) 2015-2022, Wazuh Inc.
|
||||
# All rights reserved.
|
||||
#
|
||||
# This program is free software; you can redistribute it
|
||||
# and/or modify it under the terms of the GNU General Public
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
#
|
||||
# This version has changes in
|
||||
# 1) the first lines of code with the assignments, and
|
||||
# 2) the Start Custom Action Add section
|
||||
# This adapted version is free software. Rudi Klein, april 2024
|
||||
|
||||
import datetime
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
from pathlib import PureWindowsPath, PurePosixPath
|
||||
|
||||
from wazuh_notifier_lib import import_config as ic
|
||||
from wazuh_notifier_lib import set_env as se
|
||||
|
||||
# Some variable assignments
|
||||
|
||||
wazuh_path, ar_path, config_path = se()
|
||||
|
||||
ADD_COMMAND = 0
|
||||
DELETE_COMMAND = 1
|
||||
CONTINUE_COMMAND = 2
|
||||
ABORT_COMMAND = 3
|
||||
|
||||
OS_SUCCESS = 0
|
||||
OS_INVALID = -1
|
||||
|
||||
|
||||
class Message:
|
||||
|
||||
def __init__(self):
|
||||
self.alert = ""
|
||||
self.command = 0
|
||||
|
||||
|
||||
def write_debug_file(ar_name, msg):
|
||||
with open(ar_path, mode="a") as log_file:
|
||||
ar_name_posix = str(PurePosixPath(PureWindowsPath(ar_name[ar_name.find("active-response"):])))
|
||||
log_file.write(
|
||||
str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')) + " " + ar_name_posix + ": " + msg + "\n")
|
||||
|
||||
|
||||
def setup_and_check_message(argv):
|
||||
# get alert from stdin
|
||||
input_str = ""
|
||||
for line in sys.stdin:
|
||||
input_str = line
|
||||
break
|
||||
|
||||
write_debug_file(argv[0], input_str)
|
||||
|
||||
try:
|
||||
data = json.loads(input_str)
|
||||
except ValueError:
|
||||
write_debug_file(argv[0], 'Decoding JSON has failed, invalid input format')
|
||||
Message.command = OS_INVALID
|
||||
return Message
|
||||
|
||||
Message.alert = data
|
||||
|
||||
command = data.get("command")
|
||||
|
||||
if command == "add":
|
||||
Message.command = ADD_COMMAND
|
||||
elif command == "delete":
|
||||
Message.command = DELETE_COMMAND
|
||||
else:
|
||||
Message.command = OS_INVALID
|
||||
write_debug_file(argv[0], 'Not valid command: ' + command)
|
||||
|
||||
return Message
|
||||
|
||||
|
||||
def send_keys_and_check_message(argv, keys):
|
||||
# build and send message with keys
|
||||
keys_msg = json.dumps(
|
||||
{"version": 1, "origin": {"name": argv[0], "module": "active-response"}, "command": "check_keys",
|
||||
"parameters": {"keys": keys}})
|
||||
|
||||
write_debug_file(argv[0], keys_msg)
|
||||
|
||||
print(keys_msg)
|
||||
sys.stdout.flush()
|
||||
|
||||
# read the response of previous message
|
||||
input_str = ""
|
||||
while True:
|
||||
line = sys.stdin.readline()
|
||||
if line:
|
||||
input_str = line
|
||||
break
|
||||
|
||||
write_debug_file(argv[0], input_str)
|
||||
|
||||
try:
|
||||
data = json.loads(input_str)
|
||||
except ValueError:
|
||||
write_debug_file(argv[0], 'Decoding JSON has failed, invalid input format')
|
||||
return Message
|
||||
|
||||
action = data.get("command")
|
||||
|
||||
if "continue" == action:
|
||||
ret = CONTINUE_COMMAND
|
||||
elif "abort" == action:
|
||||
ret = ABORT_COMMAND
|
||||
else:
|
||||
ret = OS_INVALID
|
||||
write_debug_file(argv[0], "Invalid value of 'command'")
|
||||
|
||||
return ret
|
||||
|
||||
|
||||
def parameters_deconstruct(argv, event_keys):
|
||||
a_id: str = str(event_keys["agent"]["id"])
|
||||
a_name: str = str(event_keys["agent"]["name"])
|
||||
e_id: str = str(event_keys["rule"]["id"])
|
||||
e_description: str = str(event_keys["rule"]["description"])
|
||||
e_level: str = str(event_keys["rule"]["level"])
|
||||
e_fired_times: str = str(event_keys["rule"]["firedtimes"])
|
||||
e_full_event: str = str(json.dumps(event_keys, indent=0).replace('"', '')
|
||||
.replace('{', '')
|
||||
.replace('}', '')
|
||||
.replace('[', '')
|
||||
.replace(']', '')
|
||||
.replace(',', '')
|
||||
.replace(' ', '')
|
||||
)
|
||||
|
||||
if e_id in ic("excluded_rules") or a_id in ic("excluded_agents"):
|
||||
|
||||
write_debug_file(argv[0], "Excluded rule or agent: " + e_id + "/" + a_id)
|
||||
|
||||
else:
|
||||
|
||||
return a_id, a_name, e_id, e_description, e_level, e_fired_times, e_full_event
|
||||
|
||||
|
||||
def construct_basic_message(argv, accent: str, a_id: str, a_name: str, e_id: str, e_description: str, e_level: str,
|
||||
e_fired_times: str):
|
||||
# Adding the BOLD text string to the Discord message. Ntfy has a different message format.
|
||||
|
||||
basic_message: str = ("--message " + '"' +
|
||||
accent + "Agent: " + accent + a_name + " (" + a_id + ")" + "\n" +
|
||||
accent + "Event id: " + accent + e_id + "\n" +
|
||||
accent + "Description: " + accent + e_description + "\n" +
|
||||
accent + "Threat level: " + accent + e_level + "\n" +
|
||||
# Watch this last addition to the string. It should include the closing quote for the
|
||||
# basic_message string. It must be closed by -> '"'. This will be done outside this function
|
||||
# in order to enable another specific addition (event_full_message) in the calling procedure.
|
||||
accent + "Times fired: " + accent + e_fired_times + "\n")
|
||||
|
||||
return basic_message
|
||||
|
||||
|
||||
def main(argv):
|
||||
write_debug_file(argv[0], "Started")
|
||||
|
||||
# validate json and get command
|
||||
msg = setup_and_check_message(argv)
|
||||
|
||||
if msg.command < 0:
|
||||
sys.exit(OS_INVALID)
|
||||
|
||||
if msg.command == ADD_COMMAND:
|
||||
|
||||
""" Start Custom Key
|
||||
At this point, it is necessary to select the keys from the alert and add them into the keys array.
|
||||
"""
|
||||
|
||||
alert = msg.alert["parameters"]["alert"]
|
||||
keys = [alert["rule"]]
|
||||
|
||||
agent_id, agent_name, event_id, event_description, event_level, event_fired_times, event_full_message = \
|
||||
parameters_deconstruct(argv, alert)
|
||||
|
||||
action = send_keys_and_check_message(argv, keys)
|
||||
|
||||
# if necessary, abort execution
|
||||
if action != CONTINUE_COMMAND:
|
||||
|
||||
if action == ABORT_COMMAND:
|
||||
write_debug_file(argv[0], "Aborted")
|
||||
sys.exit(OS_SUCCESS)
|
||||
else:
|
||||
write_debug_file(argv[0], "Invalid command")
|
||||
sys.exit(OS_INVALID)
|
||||
|
||||
""" Start Custom Action Add """
|
||||
|
||||
if str(ic("discord_enabled")) == "1":
|
||||
|
||||
accent = "**"
|
||||
discord_notifier = '{0}/active-response/bin/wazuh-discord-notifier.py'.format(wazuh_path)
|
||||
discord_exec = "python3 " + discord_notifier + " "
|
||||
write_debug_file(argv[0], "Start Discord notifier")
|
||||
discord_message = construct_basic_message(argv, accent, agent_id, agent_name, event_id, event_description,
|
||||
event_level, event_fired_times)
|
||||
|
||||
|
||||
if ic("discord_full_message") == "1":
|
||||
discord_message = discord_message + "\n" + accent + "__Full event__" + accent + event_full_message + '"'
|
||||
else:
|
||||
discord_message = discord_message + '"'
|
||||
discord_command = discord_exec + discord_message
|
||||
os.system(discord_command)
|
||||
|
||||
if str(ic("ntfy_enabled")) == "1":
|
||||
accent = ""
|
||||
ntfy_notifier = '{0}/active-response/bin/wazuh-ntfy-notifier.py'.format(wazuh_path)
|
||||
ntfy_exec = "python3 " + ntfy_notifier + " "
|
||||
write_debug_file(argv[0], "Start NTFY notifier")
|
||||
ntfy_message = construct_basic_message(argv, accent, agent_id, agent_name, event_level, event_description,
|
||||
event_id, event_fired_times)
|
||||
|
||||
# If the full message flag is set, the full message PLUS the closing parenthesis will be added
|
||||
if ic("ntfy_full_message") == "1":
|
||||
ntfy_message = ntfy_message + "\n" + "Full event" + event_full_message + '"'
|
||||
else:
|
||||
ntfy_message = ntfy_message + '"'
|
||||
|
||||
ntfier_command = ntfy_exec + ntfy_message
|
||||
os.system(ntfier_command)
|
||||
|
||||
""" End Custom Action Add """
|
||||
|
||||
elif msg.command == DELETE_COMMAND:
|
||||
|
||||
""" Start Custom Action Delete """
|
||||
|
||||
pass
|
||||
|
||||
""" End Custom Action Delete """
|
||||
|
||||
else:
|
||||
write_debug_file(argv[0], "Invalid command")
|
||||
|
||||
write_debug_file(argv[0], "Ended")
|
||||
|
||||
sys.exit(OS_SUCCESS)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main(sys.argv)
|
||||
@ -1,151 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# This script is free software.
|
||||
#
|
||||
# Copyright (C) 2024, Rudi Klein.
|
||||
# All rights reserved.
|
||||
#
|
||||
# This program is free software; you can redistribute it
|
||||
# and/or modify it under the terms of the GNU General Public
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
#
|
||||
# This script is executed by the active response script (wazuh-active-response.py), which is triggered by rules firing.
|
||||
#
|
||||
# Discord is a voice, video and text communication service used by over a hundred million people to hang out and talk
|
||||
# with their friends and communities. It allows for receiving message using webhooks.
|
||||
# For more information: https://discord.com.
|
||||
|
||||
import getopt
|
||||
import os
|
||||
import sys
|
||||
from os.path import join, dirname
|
||||
|
||||
import requests
|
||||
from dotenv import load_dotenv
|
||||
|
||||
from wazuh_notifier_lib import import_config as ic
|
||||
from wazuh_notifier_lib import set_env as se
|
||||
from wazuh_notifier_lib import set_time as st
|
||||
from wazuh_notifier_lib import view_config as vc
|
||||
|
||||
# Get path values
|
||||
wazuh_path, ar_path, config_path = se()
|
||||
|
||||
# Get time value
|
||||
now_message, now_logging = st()
|
||||
|
||||
# Retrieve webhook from .env
|
||||
|
||||
# Catching some path errors.
|
||||
try:
|
||||
dotenv_path = join(dirname(__file__), '.env')
|
||||
load_dotenv(dotenv_path)
|
||||
if not os.path.isfile(dotenv_path):
|
||||
raise Exception(dotenv_path, "file not found")
|
||||
|
||||
discord_webhook = os.getenv("DISCORD_WEBHOOK")
|
||||
|
||||
except Exception as err:
|
||||
# output error, and return with an error code
|
||||
print(str(Exception(err.args)))
|
||||
exit(err)
|
||||
|
||||
# the POST builder. Prepares https and sends the request.
|
||||
|
||||
|
||||
def discord_command(n_server, n_sender, n_destination, n_priority, n_message, n_tags, n_click):
|
||||
x_message = (now_message +
|
||||
"\n\n" + n_message + "\n\n" +
|
||||
"Priority: " + n_priority + "\n" +
|
||||
"Tags: " + n_tags + "\n\n" + n_click
|
||||
)
|
||||
n_data = {"username": n_sender, "embeds": [{"description": x_message, "title": n_destination}]}
|
||||
|
||||
result = requests.post(n_server, json=n_data)
|
||||
|
||||
|
||||
# Remove 1st argument from the list of command line arguments
|
||||
argument_list: list = sys.argv[1:]
|
||||
|
||||
# Short options
|
||||
options: str = "u:s:p:m:t:c:hv"
|
||||
|
||||
# Long options
|
||||
long_options: list = ["server=", "sender=", "destination=", "priority=", "message=", "tags=", "click=", "help", "view"]
|
||||
|
||||
# Setting some basic defaults.
|
||||
d_sender: str = "Security message"
|
||||
d_destination: str = "WAZUH (IDS)"
|
||||
d_priority: str = "5"
|
||||
d_message: str = "Test message"
|
||||
d_tags: str = "informational, testing, hard-code"
|
||||
d_click: str = "https://google.com"
|
||||
|
||||
# Use the values from the config yaml if available. Overrides the basic defaults.
|
||||
server = discord_webhook
|
||||
sender = d_sender if (ic("discord_sender") is None) else ic("discord_sender")
|
||||
destination = d_destination if (ic("discord_destination") is None) else ic("discord_destination")
|
||||
priority = d_priority if (ic("discord_priority") is None) else ic("discord_priority")
|
||||
message = d_message if (ic("discord_message") is None) else ic("discord_message")
|
||||
tags = d_tags if (ic("discord_tags") is None) else ic("discord_tags")
|
||||
click = d_click if (ic("discord_click") is None) else ic("discord_click")
|
||||
|
||||
help_text: str = """
|
||||
-u, --server is the webhook URL of the Discord server. It is stored in .env.
|
||||
-s, --sender is the sender of the message, either an app name or a person.
|
||||
The default is "Security message".
|
||||
-d, --destination is the destination (actually the originator) of the message, either an app name or a person.
|
||||
Default is "Wazuh (IDS)"
|
||||
-p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest).
|
||||
Default is 5.
|
||||
-m, --message is the text of the message to be sent.
|
||||
Default is "Test message", but may include --tags and/or --click.
|
||||
-t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma).
|
||||
Default is "informational, testing, hard-coded".
|
||||
-c, --click is a link (URL) that can be followed by tapping/clicking inside the message.
|
||||
Default is https://google.com.
|
||||
-h, --help Shows this help message.
|
||||
-v, --view Show yaml configuration.
|
||||
"""
|
||||
|
||||
# Get params during execution. Params found here, override minimal defaults and/or config settings.
|
||||
try:
|
||||
# Parsing argument
|
||||
arguments, values = getopt.getopt(argument_list, options, long_options)
|
||||
|
||||
# checking each argument
|
||||
for current_argument, current_value in arguments:
|
||||
|
||||
if current_argument in ("-h", "--help"):
|
||||
print(help_text)
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-v", "--view"):
|
||||
vc()
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-s", "--sender"):
|
||||
sender = current_value
|
||||
|
||||
elif current_argument in ("-d", "--destination"):
|
||||
destination = current_value
|
||||
|
||||
elif current_argument in ("-p", "--priority"):
|
||||
priority = current_value
|
||||
|
||||
elif current_argument in ("-m", "--message"):
|
||||
message = current_value
|
||||
|
||||
elif current_argument in ("-t", "--tags"):
|
||||
tags = current_value
|
||||
|
||||
elif current_argument in ("-c", "--click"):
|
||||
click = current_value
|
||||
|
||||
except getopt.error as err:
|
||||
# output error, and return with an error code
|
||||
print(str(err))
|
||||
|
||||
# Finally, execute the POST request
|
||||
discord_command(discord_webhook, sender, destination, priority, message, tags, click)
|
||||
@ -1,77 +0,0 @@
|
||||
---
|
||||
#start of yaml
|
||||
|
||||
# This is the yaml config file for both the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py.
|
||||
# The yaml needs to be in the same folder as the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py
|
||||
|
||||
# COMMON (custom-wazuh-notifiers.py) configuration settings start here.
|
||||
# 1 = messages will be sent through this message server. 0 = messages will NOT be sent through this message server.
|
||||
|
||||
discord_enabled: 1
|
||||
ntfy_enabled: 1
|
||||
|
||||
# Exclude rules that are listed in the ossec.conf active response definition.
|
||||
|
||||
excluded_rules: "5401, 5402, 5403"
|
||||
excluded_agents: "999"
|
||||
|
||||
# COMMON configuration settings end here.
|
||||
|
||||
|
||||
# NTFY configuration settings start here.
|
||||
# The default values refer to the hard-coded defaults, if no yaml configuration is found.
|
||||
#
|
||||
# -u, --server is the URL of the NTFY server, ending with a "/". Default is https://ntfy.sh/.
|
||||
# -s, --sender is the sender of the message, either an app name or a person. Default is "Wazuh (IDS)".
|
||||
# -d, --destination is the NTFY subscription, to send the message to. Default is none.
|
||||
# -p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.
|
||||
# -m, --message is the text of the message to be sent. Default is "Test message".
|
||||
# -t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded".
|
||||
# -c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.
|
||||
# -h, --help shows this help message. Must have no value argument.
|
||||
# -v, --view show config.
|
||||
|
||||
ntfy_server: "https://ntfy.sh/"
|
||||
ntfy_sender: "Wazuh (IDS)"
|
||||
ntfy_destination: "__KleinTest"
|
||||
ntfy_priority: "5"
|
||||
ntfy_message: "Test message"
|
||||
ntfy_tags: "information, testing, yaml"
|
||||
ntfy_click: "https://google.com"
|
||||
|
||||
# 1 to send the full event data with the message. 0 only sends the message with basic details
|
||||
ntfy_full_message: "0"
|
||||
|
||||
# NTFY configuration settings end here.
|
||||
|
||||
# DISCORD configuration settings start here.
|
||||
# The default values refer to the hard-coded defaults, if no yaml configuration is found.
|
||||
|
||||
# -u, --server is the webhook URL of the Discord server. It is stored in .env.
|
||||
# -s, --sender is the sender of the message, either an app name or a person. The default is "Security message".
|
||||
# -d, --destination is the destination (actually the originator) of the message, either an app name or a person. Default is "Wazuh (IDS)"
|
||||
# -p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.
|
||||
# -m, --message is the text of the message to be sent. Default is "Test message", but may include --tags and/or --click.
|
||||
# -t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded".
|
||||
# -c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.
|
||||
# -h, --help shows this help message. Must have no value argument.
|
||||
# -v, --view show config.
|
||||
|
||||
discord_server: "not used. The webhook (server) is a secret stored in .env"
|
||||
discord_sender: "Security message"
|
||||
discord_destination: "WAZUH (IDS)"
|
||||
discord_priority: "5"
|
||||
discord_message: "Test message"
|
||||
discord_tags: "informational, testing, yaml"
|
||||
discord_click: "https://google.com"
|
||||
|
||||
# 1 to send the full event data with the message. 0 only sends the message with basic details
|
||||
discord_full_message: "0"
|
||||
|
||||
# DISCORD configuration settings ends here.
|
||||
|
||||
#end of yaml
|
||||
...
|
||||
|
||||
|
||||
|
||||
58
wazuh-notify-config.yaml
Normal file
58
wazuh-notify-config.yaml
Normal file
@ -0,0 +1,58 @@
|
||||
---
|
||||
# Start of wazuh notifier configuration yaml.
|
||||
|
||||
# This is the yaml config file for wazuh-active-response (for both the Python and Go version)
|
||||
|
||||
targets: "discord" # Platforms in this string with comma seperated values are triggered.
|
||||
full_message: "ntfy, slack" # Platforms in this string will enable the sending of the full event information.
|
||||
|
||||
# Exclude rule events that are enabled in the ossec.conf active response definition.
|
||||
# These settings provide an easier way to disable events from firing the notifiers.
|
||||
|
||||
excluded_rules: "99999, 00000" # Enter as a string with comma seperated values
|
||||
excluded_agents: "99999" # Enter as a string with comma seperated values
|
||||
|
||||
# Priority mapping from 0-15 (Wazuh threat levels) to 1-5 (in notifications) and their respective colors (Discord)
|
||||
# https://documentation.wazuh.com/current/user-manual/ruleset/rules-classification.html
|
||||
# Enter as lists of integers.
|
||||
|
||||
|
||||
priority_map:
|
||||
- threat_map: [ 15,14,13,12 ]
|
||||
mention_threshold: 1
|
||||
color: 0xcc3300
|
||||
- threat_map: [ 11,10,9 ]
|
||||
mention_threshold: 1
|
||||
color: 0xff9966
|
||||
- threat_map: [ 8,7,6 ]
|
||||
mention_threshold: 5
|
||||
color: 0xffcc00
|
||||
- threat_map: [ 5,4 ]
|
||||
mention_threshold: 20
|
||||
color: 0x99cc33
|
||||
- threat_map: [ 3,2,1,0 ]
|
||||
mention_threshold: 20
|
||||
color: 0x339900
|
||||
|
||||
# The next 2 settings are used to add information to the messages.
|
||||
sender: "Wazuh (IDS)"
|
||||
click: "https://documentation.wazuh.com/"
|
||||
|
||||
# From here on the settings are ONLY used by the Python version of wazuh-active-response.
|
||||
|
||||
# Below settings provide for a window that enable/disables events from firing the notifiers.
|
||||
excluded_days: "" # Enter as a string with comma seperated values. Be aware of your regional settings.
|
||||
excluded_hours: [ "23:59", "00:00" ] # Enter as a tuple of string values. Be aware of your regional settings.
|
||||
|
||||
# The next settings are used for testing. Test mode will add the example event in wazuh-notify-test-event.json instead of the
|
||||
# message received through wazuh. This enables testing for particular events when the test event is customized.
|
||||
test_mode: True
|
||||
|
||||
# Enabling this parameter provides more logging to the wazuh-notifier log.
|
||||
extended_logging: True
|
||||
|
||||
# Enabling this parameter provides extended logging to the console.
|
||||
extended_print: True
|
||||
|
||||
# End of wazuh notifier configuration yaml
|
||||
...
|
||||
2
wazuh-notify-go/.env
Normal file
2
wazuh-notify-go/.env
Normal file
@ -0,0 +1,2 @@
|
||||
DISCORD_URL=https://discord.com/api/webhooks/1237526475306176572/kHGnaQiM8qWOfdLIN1LWqgq3dsfqiHtsfs-Z5FralJNdX5hdw-MOPf4zzIDiFVjcIat4
|
||||
NTFY_URL=https://ntfy.sh/__KleinTest
|
||||
8
wazuh-notify-go/go.mod
Normal file
8
wazuh-notify-go/go.mod
Normal file
@ -0,0 +1,8 @@
|
||||
module wazuh-notify
|
||||
|
||||
go 1.22
|
||||
|
||||
require (
|
||||
github.com/joho/godotenv v1.5.1
|
||||
gopkg.in/yaml.v2 v2.4.0
|
||||
)
|
||||
6
wazuh-notify-go/go.sum
Normal file
6
wazuh-notify-go/go.sum
Normal file
@ -0,0 +1,6 @@
|
||||
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
|
||||
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
|
||||
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
||||
39
wazuh-notify-go/log/log.go
Normal file
39
wazuh-notify-go/log/log.go
Normal file
@ -0,0 +1,39 @@
|
||||
package log
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path"
|
||||
"time"
|
||||
)
|
||||
|
||||
var logFile *os.File
|
||||
|
||||
func OpenLogFile(BasePath string) {
|
||||
logFile, _ = os.OpenFile(path.Join(BasePath, "../../logs/active-responses.log"), os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0600)
|
||||
_, err := logFile.WriteString(
|
||||
"\n#######################################\n## START ##" +
|
||||
"\n" + time.Now().String() +
|
||||
"\n#######################################\n",
|
||||
)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
}
|
||||
|
||||
func CloseLogFile() {
|
||||
_, err := logFile.WriteString(
|
||||
"\n\n#######################################\n## CLOSE ##" +
|
||||
"\n" + time.Now().String() +
|
||||
"\n#######################################\n",
|
||||
)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
logFile.Close()
|
||||
}
|
||||
|
||||
func Log(message string) {
|
||||
if _, err := logFile.WriteString("\n" + message + ": " + time.Now().String()); err != nil {
|
||||
panic(err)
|
||||
}
|
||||
}
|
||||
24
wazuh-notify-go/main.go
Normal file
24
wazuh-notify-go/main.go
Normal file
@ -0,0 +1,24 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"wazuh-notify/log"
|
||||
"wazuh-notify/notification"
|
||||
"wazuh-notify/services"
|
||||
)
|
||||
|
||||
func main() {
|
||||
inputParams := services.InitNotify()
|
||||
|
||||
for _, target := range strings.Split(inputParams.Targets, ",") {
|
||||
switch target {
|
||||
case "discord":
|
||||
log.Log(target)
|
||||
notification.SendDiscord(inputParams)
|
||||
case "ntfy":
|
||||
log.Log(target)
|
||||
notification.SendNtfy(inputParams)
|
||||
}
|
||||
}
|
||||
log.CloseLogFile()
|
||||
}
|
||||
71
wazuh-notify-go/notification/discord.go
Normal file
71
wazuh-notify-go/notification/discord.go
Normal file
@ -0,0 +1,71 @@
|
||||
package notification
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"slices"
|
||||
"strconv"
|
||||
"strings"
|
||||
"wazuh-notify/types"
|
||||
)
|
||||
|
||||
func SendDiscord(params types.Params) {
|
||||
|
||||
var embedDescription string
|
||||
|
||||
if slices.Contains(strings.Split(params.FullMessage, ","), "discord") {
|
||||
fullMessage, _ := json.MarshalIndent(params.WazuhMessage, "", " ")
|
||||
fullMessageString := strings.ReplaceAll(string(fullMessage), `"`, "")
|
||||
fullMessageString = strings.ReplaceAll(fullMessageString, "{", "")
|
||||
fullMessageString = strings.ReplaceAll(fullMessageString, "}", "")
|
||||
fullMessageString = strings.ReplaceAll(fullMessageString, "[", "")
|
||||
fullMessageString = strings.ReplaceAll(fullMessageString, "]", "")
|
||||
fullMessageString = strings.ReplaceAll(fullMessageString, " ,", "")
|
||||
|
||||
embedDescription = "\n\n ```" +
|
||||
fullMessageString +
|
||||
"```\n\n" +
|
||||
"Priority: " + strconv.Itoa(params.Priority) + "\n" +
|
||||
"Tags: " + params.Tags + "\n\n" +
|
||||
params.Click
|
||||
} else {
|
||||
embedDescription = "\n\n" +
|
||||
"**Agent:** " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" +
|
||||
"**Event id:** " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" +
|
||||
"**Rule:** " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" +
|
||||
"**Description: **" + params.WazuhMessage.Parameters.Alert.FullLog + "\n" +
|
||||
"**Threat level:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" +
|
||||
"**Times fired:** " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) +
|
||||
"\n\n" +
|
||||
"Priority: " + strconv.Itoa(params.Priority) + "\n" +
|
||||
"Tags: " + params.Tags + "\n\n" +
|
||||
params.Click
|
||||
}
|
||||
|
||||
message := types.Message{
|
||||
Username: params.Sender,
|
||||
Content: params.Mention,
|
||||
Embeds: []types.Embed{
|
||||
{
|
||||
Title: params.Sender,
|
||||
Description: embedDescription,
|
||||
Color: params.Color,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
payload := new(bytes.Buffer)
|
||||
|
||||
err := json.NewEncoder(payload).Encode(message)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
_, err = http.Post(os.Getenv("DISCORD_URL"), "application/json", payload)
|
||||
if err != nil {
|
||||
log.Fatalf("An Error Occured %v", err)
|
||||
}
|
||||
}
|
||||
38
wazuh-notify-go/notification/ntfy.go
Normal file
38
wazuh-notify-go/notification/ntfy.go
Normal file
@ -0,0 +1,38 @@
|
||||
package notification
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
"wazuh-notify/types"
|
||||
)
|
||||
|
||||
func SendNtfy(params types.Params) {
|
||||
|
||||
payload := time.Now().Format(time.RFC3339) + "\n\n" +
|
||||
"Agent: " + params.WazuhMessage.Parameters.Alert.Agent.Name + "\n" +
|
||||
"Event id: " + params.WazuhMessage.Parameters.Alert.Rule.ID + "\n" +
|
||||
"Description: " + params.WazuhMessage.Parameters.Alert.Rule.Description + "\n" +
|
||||
"Threat level: " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Level) + "\n" +
|
||||
"Times fired: " + strconv.Itoa(params.WazuhMessage.Parameters.Alert.Rule.Firedtimes) + "\n"
|
||||
|
||||
req, _ := http.NewRequest("POST", os.Getenv("NTFY_URL"), strings.NewReader(payload))
|
||||
req.Header.Set("Content-Type", "text/plain")
|
||||
|
||||
if params.Sender != "" {
|
||||
req.Header.Add("Title", params.Sender)
|
||||
}
|
||||
if params.Tags != "" {
|
||||
req.Header.Add("Tags", params.Tags)
|
||||
}
|
||||
if params.Click != "" {
|
||||
req.Header.Add("Click", params.Click)
|
||||
}
|
||||
if params.Priority != 0 {
|
||||
req.Header.Add("Priority", strconv.Itoa(params.Priority))
|
||||
}
|
||||
|
||||
http.DefaultClient.Do(req)
|
||||
}
|
||||
24
wazuh-notify-go/services/filters.go
Normal file
24
wazuh-notify-go/services/filters.go
Normal file
@ -0,0 +1,24 @@
|
||||
package services
|
||||
|
||||
import (
|
||||
"os"
|
||||
"strings"
|
||||
"wazuh-notify/log"
|
||||
)
|
||||
|
||||
func Filter() {
|
||||
for _, rule := range strings.Split(inputParams.ExcludedRules, ",") {
|
||||
if rule == inputParams.WazuhMessage.Parameters.Alert.Rule.ID {
|
||||
log.Log("rule excluded")
|
||||
log.CloseLogFile()
|
||||
os.Exit(0)
|
||||
}
|
||||
}
|
||||
for _, agent := range strings.Split(inputParams.ExcludedAgents, ",") {
|
||||
if agent == inputParams.WazuhMessage.Parameters.Alert.Agent.ID {
|
||||
log.Log("agent excluded")
|
||||
log.CloseLogFile()
|
||||
os.Exit(0)
|
||||
}
|
||||
}
|
||||
}
|
||||
97
wazuh-notify-go/services/init.go
Normal file
97
wazuh-notify-go/services/init.go
Normal file
@ -0,0 +1,97 @@
|
||||
package services
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"encoding/json"
|
||||
"flag"
|
||||
"github.com/joho/godotenv"
|
||||
"gopkg.in/yaml.v2"
|
||||
"os"
|
||||
"path"
|
||||
"slices"
|
||||
"strings"
|
||||
"wazuh-notify/log"
|
||||
"wazuh-notify/types"
|
||||
)
|
||||
|
||||
var inputParams types.Params
|
||||
var configParams types.Params
|
||||
var wazuhData types.WazuhMessage
|
||||
|
||||
func InitNotify() types.Params {
|
||||
BaseFilePath, _ := os.Executable()
|
||||
BaseDirPath := path.Dir(BaseFilePath)
|
||||
|
||||
log.OpenLogFile(BaseDirPath)
|
||||
|
||||
err := godotenv.Load(path.Join(BaseDirPath, "../../etc/.env"))
|
||||
if err != nil {
|
||||
log.Log("env failed to load")
|
||||
godotenv.Load(path.Join(BaseDirPath, ".env"))
|
||||
} else {
|
||||
log.Log("env loaded")
|
||||
}
|
||||
|
||||
yamlFile, err := os.ReadFile(path.Join(BaseDirPath, "../../etc/wazuh-notify-config.yaml"))
|
||||
if err != nil {
|
||||
log.Log("yaml failed to load")
|
||||
yamlFile, err = os.ReadFile(path.Join(BaseDirPath, "wazuh-notify-config.yaml"))
|
||||
}
|
||||
err = yaml.Unmarshal(yamlFile, &configParams)
|
||||
if err != nil {
|
||||
print(err)
|
||||
}
|
||||
|
||||
log.Log("yaml loaded")
|
||||
configParamString, _ := json.Marshal(configParams)
|
||||
log.Log(string(configParamString))
|
||||
|
||||
flag.StringVar(&inputParams.Url, "url", "", "is the webhook URL of the Discord server. It is stored in .env.")
|
||||
flag.StringVar(&inputParams.Click, "click", configParams.Click, "is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.")
|
||||
flag.IntVar(&inputParams.Priority, "priority", 0, "is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.")
|
||||
flag.StringVar(&inputParams.Sender, "sender", configParams.Sender, "is the sender of the message, either an app name or a person. The default is \"Security message\".")
|
||||
flag.StringVar(&inputParams.Tags, "tags", "", "is an arbitrary strings of tags (keywords), seperated by a \",\" (comma). Default is \"informational,testing,hard-coded\".")
|
||||
flag.StringVar(&inputParams.Targets, "targets", "", "is a list of targets to send notifications to. Default is \"discord\".")
|
||||
|
||||
flag.Parse()
|
||||
|
||||
log.Log("params loaded")
|
||||
inputParamString, _ := json.Marshal(inputParams)
|
||||
log.Log(string(inputParamString))
|
||||
|
||||
inputParams.Targets = configParams.Targets
|
||||
inputParams.FullMessage = configParams.FullMessage
|
||||
inputParams.ExcludedAgents = configParams.ExcludedAgents
|
||||
inputParams.ExcludedRules = configParams.ExcludedRules
|
||||
inputParams.PriorityMaps = configParams.PriorityMaps
|
||||
|
||||
wazuhInput()
|
||||
|
||||
return inputParams
|
||||
}
|
||||
|
||||
func wazuhInput() {
|
||||
reader := bufio.NewReader(os.Stdin)
|
||||
|
||||
json.NewDecoder(reader).Decode(&wazuhData)
|
||||
|
||||
inputParams.Tags += strings.Join(wazuhData.Parameters.Alert.Rule.Groups, ",")
|
||||
|
||||
inputParams.WazuhMessage = wazuhData
|
||||
|
||||
for i, _ := range configParams.PriorityMaps {
|
||||
if slices.Contains(configParams.PriorityMaps[i].ThreatMap, wazuhData.Parameters.Alert.Rule.Level) {
|
||||
inputParams.Color = inputParams.PriorityMaps[i].Color
|
||||
if inputParams.WazuhMessage.Parameters.Alert.Rule.Firedtimes >= inputParams.PriorityMaps[i].MentionThreshold {
|
||||
inputParams.Mention = "@here"
|
||||
}
|
||||
inputParams.Priority = 5 - i
|
||||
}
|
||||
}
|
||||
|
||||
Filter()
|
||||
|
||||
log.Log("Wazuh data loaded")
|
||||
inputParamString, _ := json.Marshal(inputParams)
|
||||
log.Log(string(inputParamString))
|
||||
}
|
||||
36
wazuh-notify-go/types/types.go
Normal file
36
wazuh-notify-go/types/types.go
Normal file
@ -0,0 +1,36 @@
|
||||
package types
|
||||
|
||||
type Params struct {
|
||||
Url string
|
||||
Sender string `yaml:"sender,omitempty"`
|
||||
Priority int
|
||||
Tags string
|
||||
Click string `yaml:"click,omitempty"`
|
||||
Targets string `yaml:"targets,omitempty"`
|
||||
FullMessage string `yaml:"full_message,omitempty"`
|
||||
ExcludedRules string `yaml:"excluded_rules,omitempty"`
|
||||
ExcludedAgents string `yaml:"excluded_agents,omitempty"`
|
||||
Color int
|
||||
Mention string
|
||||
WazuhMessage WazuhMessage
|
||||
PriorityMaps []PriorityMap `yaml:"priority_map"`
|
||||
}
|
||||
|
||||
type PriorityMap struct {
|
||||
ThreatMap []int `yaml:"threat_map"`
|
||||
MentionThreshold int `yaml:"mention_threshold"`
|
||||
Color int `yaml:"color"`
|
||||
}
|
||||
|
||||
type Message struct {
|
||||
Username string `json:"username,omitempty"`
|
||||
AvatarUrl string `json:"avatar_url,omitempty"`
|
||||
Content string `json:"content,omitempty"`
|
||||
Embeds []Embed `json:"embeds,omitempty"`
|
||||
}
|
||||
|
||||
type Embed struct {
|
||||
Title string `json:"title,omitempty"`
|
||||
Description string `json:"description,omitempty"`
|
||||
Color int `json:"color,omitempty"`
|
||||
}
|
||||
72
wazuh-notify-go/types/wazuh.go
Normal file
72
wazuh-notify-go/types/wazuh.go
Normal file
@ -0,0 +1,72 @@
|
||||
package types
|
||||
|
||||
type WazuhMessage struct {
|
||||
Version int `json:"version"`
|
||||
Origin Origin `json:"origin"`
|
||||
Command string `json:"command"`
|
||||
Parameters Parameters `json:"parameters"`
|
||||
}
|
||||
|
||||
type Origin struct {
|
||||
Name string `json:"name"`
|
||||
Module string `json:"module"`
|
||||
}
|
||||
|
||||
type Parameters struct {
|
||||
ExtraArgs []interface{} `json:"extra_args"`
|
||||
Alert Alert `json:"alert"`
|
||||
Program string `json:"program"`
|
||||
}
|
||||
|
||||
type Alert struct {
|
||||
Timestamp string `json:"timestamp"`
|
||||
Rule Rule `json:"rule"`
|
||||
Agent Agent `json:"agent"`
|
||||
Manager Manager `json:"manager"`
|
||||
ID string `json:"id"`
|
||||
FullLog string `json:"full_log"`
|
||||
Decoder Decoder `json:"decoder"`
|
||||
Data Data `json:"data"`
|
||||
Location string `json:"location"`
|
||||
}
|
||||
|
||||
type Rule struct {
|
||||
Level int `json:"level"`
|
||||
Description string `json:"description"`
|
||||
ID string `json:"id"`
|
||||
Mitre Mitre `json:"mitre"`
|
||||
Info string `json:"info"`
|
||||
Firedtimes int `json:"firedtimes"`
|
||||
Mail bool `json:"mail"`
|
||||
Groups []string `json:"groups"`
|
||||
PciDss []string `json:"pci_dss"`
|
||||
Gdpr []string `json:"gdpr"`
|
||||
Nist80053 []string `json:"nist_800_53"`
|
||||
Tsc []string `json:"tsc"`
|
||||
}
|
||||
|
||||
type Mitre struct {
|
||||
ID []string `json:"id"`
|
||||
Tactic []string `json:"tactic"`
|
||||
Technique []string `json:"technique"`
|
||||
}
|
||||
|
||||
type Agent struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
type Manager struct {
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
type Decoder struct {
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
type Data struct {
|
||||
Protocol string `json:"protocol"`
|
||||
Srcip string `json:"srcip"`
|
||||
ID string `json:"id"`
|
||||
URL string `json:"url"`
|
||||
}
|
||||
49
wazuh-notify-go/wazuh-notify-config.yaml
Normal file
49
wazuh-notify-go/wazuh-notify-config.yaml
Normal file
@ -0,0 +1,49 @@
|
||||
---
|
||||
#start of yaml
|
||||
|
||||
# This is the yaml config file for both the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py.
|
||||
# The yaml needs to be in the same folder as the wazuh-ntfy-notifier.py and wazuh-discord-notifier.py
|
||||
|
||||
targets: "discord,ntfy"
|
||||
full_message: "ntfy"
|
||||
|
||||
# Exclude rules that are listed in the ossec.conf active response definition.
|
||||
|
||||
excluded_rules: "5401,5403"
|
||||
excluded_agents: "999"
|
||||
|
||||
# Priority mapping from 1-12 (Wazuh events) to 1-5 (Discord and ntfy notification)
|
||||
# Discord mention after x amount of event fired times
|
||||
|
||||
priority_map:
|
||||
-
|
||||
threat_map: [15,14,13,12]
|
||||
mention_threshold: 1
|
||||
color: 0xcc3300
|
||||
-
|
||||
threat_map: [11,10,9]
|
||||
mention_threshold: 1
|
||||
color: 0xff9966
|
||||
-
|
||||
threat_map: [8,7,6]
|
||||
mention_threshold: 5
|
||||
color: 0xffcc00
|
||||
-
|
||||
threat_map: [5,4]
|
||||
mention_threshold: 5
|
||||
color: 0x99cc33
|
||||
-
|
||||
threat_map: [3,2,1,0]
|
||||
mention_threshold: 5
|
||||
color: 0x339900
|
||||
|
||||
|
||||
sender: "Wazuh (IDS)"
|
||||
click: "https://google.com"
|
||||
|
||||
|
||||
#end of yaml
|
||||
...
|
||||
|
||||
|
||||
|
||||
3
wazuh-notify-python/requirements.txt
Normal file
3
wazuh-notify-python/requirements.txt
Normal file
@ -0,0 +1,3 @@
|
||||
requests~=2.31.0
|
||||
PyYAML~=5.4.1
|
||||
python-dotenv~=1.0.1
|
||||
105
wazuh-notify-python/wazuh-notify.py
Executable file
105
wazuh-notify-python/wazuh-notify.py
Executable file
@ -0,0 +1,105 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# This script is adapted version of the Python active response script sample, provided by Wazuh, in the documentation:
|
||||
# https://documentation.wazuh.com/current/user-manual/capabilities/active-response/custom-active-response-scripts.html
|
||||
# It is provided under the below copyright statement:
|
||||
#
|
||||
# Copyright (C) 2015-2022, Wazuh Inc.
|
||||
# All rights reserved.
|
||||
#
|
||||
# This program is free software; you can redistribute it
|
||||
# and/or modify it under the terms of the GNU General Public
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
#
|
||||
# This adapted version is free software. Rudi Klein, april 2024
|
||||
|
||||
import json
|
||||
import sys
|
||||
|
||||
import requests
|
||||
|
||||
from wazuh_notify_module import build_notification
|
||||
from wazuh_notify_module import construct_basic_message
|
||||
from wazuh_notify_module import exclusions_check
|
||||
from wazuh_notify_module import get_arguments
|
||||
from wazuh_notify_module import get_config
|
||||
from wazuh_notify_module import get_env
|
||||
from wazuh_notify_module import load_message
|
||||
from wazuh_notify_module import logger
|
||||
from wazuh_notify_module import set_environment
|
||||
from wazuh_notify_module import threat_mapping
|
||||
|
||||
|
||||
def main(argv):
|
||||
# Load the YAML config
|
||||
config: dict = get_config()
|
||||
|
||||
# Path variables assignments
|
||||
wazuh_path, ar_path, config_path = set_environment()
|
||||
|
||||
# Get the arguments used with running the script
|
||||
arg_url, arg_sender, arg_destination, arg_message, arg_priority, arg_tags, arg_click = get_arguments()
|
||||
|
||||
# Check if we are in test mode (test_mode setting in config yaml). If so, load test event instead of live event.
|
||||
if config.get("test_mode"):
|
||||
logger(config, "In test mode: using test message wazuh-notify-test-event.json")
|
||||
|
||||
with (open('wazuh-notify-test-event.json') as event_file):
|
||||
data: dict = json.loads(event_file.read())
|
||||
|
||||
else:
|
||||
logger(config, "In live mode: using live message")
|
||||
data = load_message()
|
||||
|
||||
# Extract the 'alert' section of the (JSON) event
|
||||
alert = data["parameters"]["alert"]
|
||||
|
||||
# Check the config for any exclusion rules
|
||||
fire_notification = exclusions_check(config, alert)
|
||||
|
||||
if not fire_notification:
|
||||
logger(config, "Event excluded, no notification sent. Exiting")
|
||||
exit()
|
||||
|
||||
# Include a specific control sequence for Discord bold text
|
||||
if "discord" in config["targets"]:
|
||||
accent: str = "**"
|
||||
else:
|
||||
accent: str = ""
|
||||
|
||||
# Create the notification text to be sent.
|
||||
notification: str = construct_basic_message(accent, alert)
|
||||
logger(config, "Notification constructed")
|
||||
|
||||
# todo Not used?
|
||||
# Get the mapping from event threat level to priority (Discord/ntfy), color (Discord) and mention_flag (Discord)
|
||||
priority, color, mention = threat_mapping(config, alert['rule']['level'],
|
||||
alert['rule']['firedtimes'])
|
||||
|
||||
result = ""
|
||||
# Prepare the messaging platform specific request and execute
|
||||
if "discord" in config["targets"]:
|
||||
caller = "discord"
|
||||
discord_url, _, _ = get_env()
|
||||
payload = build_notification(caller, config, notification, alert, priority, color, mention)
|
||||
result = requests.post(discord_url, json=payload)
|
||||
exit(result)
|
||||
|
||||
if "ntfy" in config["targets"]:
|
||||
caller = "ntfy"
|
||||
ntfy_url, _, _ = get_env()
|
||||
payload = build_notification(caller, config, notification, alert, priority, color, mention)
|
||||
result = requests.post(ntfy_url, json=payload)
|
||||
exit(result)
|
||||
|
||||
if "slack" in config["targets"]:
|
||||
caller = "slack"
|
||||
slack_url, _, _ = get_env()
|
||||
payload = build_notification(caller, config, notification, alert, priority, color, mention)
|
||||
result = requests.post(slack_url, json=payload)
|
||||
exit(result)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main(sys.argv)
|
||||
391
wazuh-notify-python/wazuh_notify_module.py
Executable file
391
wazuh-notify-python/wazuh_notify_module.py
Executable file
@ -0,0 +1,391 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
import datetime
|
||||
import getopt
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import time
|
||||
from os.path import join, dirname
|
||||
from pathlib import PureWindowsPath, PurePosixPath
|
||||
|
||||
import yaml
|
||||
from dotenv import load_dotenv
|
||||
|
||||
|
||||
# Define paths: wazuh_path = wazuh root directory
|
||||
# ar_path = active-responses.log path,
|
||||
# config_path = wazuh-notify-config.yaml
|
||||
#
|
||||
def set_environment() -> tuple:
|
||||
# todo fix reference when running manually/in process
|
||||
|
||||
set_wazuh_path = "/home/rudi/pycharm"
|
||||
# set_wazuh_path = os.path.abspath(os.path.join(__file__, "../../.."))
|
||||
set_ar_path = '{0}/logs/wazuh-notifier.log'.format(set_wazuh_path)
|
||||
set_config_path = '{0}/etc/wazuh-notify-config.yaml'.format(set_wazuh_path)
|
||||
|
||||
return set_wazuh_path, set_ar_path, set_config_path
|
||||
|
||||
|
||||
# Set paths for use in this module
|
||||
wazuh_path, ar_path, config_path = set_environment()
|
||||
|
||||
|
||||
# Set structured timestamps for logging and notifications.
|
||||
|
||||
|
||||
def set_time_format():
|
||||
now_message = time.strftime('%A, %d %b %Y %H:%M:%S')
|
||||
now_logging = time.strftime('%Y/%m/%d %H:%M:%S')
|
||||
now_time = time.strftime('%H:%M')
|
||||
now_weekday = time.strftime('%A')
|
||||
return now_message, now_logging, now_weekday, now_time
|
||||
|
||||
|
||||
# Logger
|
||||
def logger(config, message):
|
||||
# todo fix logging
|
||||
|
||||
_, log_path, _ = set_environment()
|
||||
|
||||
if config.get('extended_print', True):
|
||||
print(time.strftime('%Y/%m/%d %H:%M:%S'), "|", message)
|
||||
|
||||
if config.get("extended_logging"):
|
||||
with open(ar_path, mode="a") as log_file:
|
||||
ar_name_posix = str(PurePosixPath(PureWindowsPath(log_path[log_path.find("active-response"):])))
|
||||
log_file.write(
|
||||
str(datetime.datetime.now().strftime(
|
||||
'%Y/%m/%d %H:%M:%S')) + " " + ar_name_posix + ": " + message + "\n")
|
||||
else:
|
||||
pass
|
||||
|
||||
|
||||
# Get the content of the .env file
|
||||
|
||||
|
||||
def get_env():
|
||||
config: dict = get_config()
|
||||
|
||||
try:
|
||||
dotenv_path = join(dirname(__file__), '.env')
|
||||
load_dotenv(dotenv_path)
|
||||
if not os.path.isfile(dotenv_path):
|
||||
logger(config, ".env not found")
|
||||
raise Exception(dotenv_path, "file not found")
|
||||
|
||||
# Retrieve url from .env
|
||||
discord_url = os.getenv("DISCORD_URL")
|
||||
ntfy_url = os.getenv("NTFY_URL")
|
||||
slack_url = os.getenv("SLACK_URL")
|
||||
|
||||
except Exception as err:
|
||||
# output error, and return with an error code
|
||||
logger(config, str(Exception(err.args)))
|
||||
exit(err)
|
||||
|
||||
return discord_url, ntfy_url, slack_url
|
||||
|
||||
|
||||
# Process configuration settings from wazuh-notify-config.yaml
|
||||
|
||||
|
||||
def get_config():
|
||||
# DO NOT USE logger() IN THIS FUNCTION. IT WILL CREATE A RECURSION LOOP!
|
||||
|
||||
this_config_path: str = ""
|
||||
|
||||
try:
|
||||
_, _, this_config_path = set_environment()
|
||||
|
||||
with open(this_config_path, 'r') as ntfier_config:
|
||||
config: dict = yaml.safe_load(ntfier_config)
|
||||
except (FileNotFoundError, PermissionError, OSError):
|
||||
print(time.strftime('%Y/%m/%d %H:%M:%S') + " | " + this_config_path + " missing")
|
||||
|
||||
print(time.strftime('%Y/%m/%d %H:%M:%S') + " | " + "reading config: " + this_config_path)
|
||||
config['targets'] = config.get('targets', 'ntfy, discord')
|
||||
config['excluded_rules'] = config.get('excluded_rules', '')
|
||||
config['excluded_agents'] = config.get('excluded_agents', '')
|
||||
config['excluded_days'] = config.get('excluded_days', '')
|
||||
config['excluded_hours'] = config.get('excluded_hours', '')
|
||||
config['test_mode'] = config.get('test_mode', True)
|
||||
config['extended_logging'] = config.get('extended_logging', True)
|
||||
config['extended_print'] = config.get('extended_print', True)
|
||||
|
||||
config['sender'] = 'Wazuh (IDS)'
|
||||
config['click'] = 'https://wazuh.org'
|
||||
|
||||
return config
|
||||
|
||||
|
||||
# Show configuration settings from wazuh-notify-config.yaml
|
||||
|
||||
|
||||
def view_config():
|
||||
_, _, this_config_path, _ = set_environment()
|
||||
|
||||
try:
|
||||
with open(this_config_path, 'r') as ntfier_config:
|
||||
print(ntfier_config.read())
|
||||
except (FileNotFoundError, PermissionError, OSError):
|
||||
print(this_config_path + " does not exist or is not accessible")
|
||||
return
|
||||
|
||||
# Get params during execution. Params found here override config settings.
|
||||
|
||||
|
||||
def get_arguments():
|
||||
config: dict = get_config()
|
||||
# Short options
|
||||
options: str = "u:s:p:m:t:c:hv"
|
||||
|
||||
# Long options
|
||||
long_options: list = ["url=", "sender=", "destination=", "priority=", "message=", "tags=", "click=", "help",
|
||||
"view"]
|
||||
|
||||
help_text: str = """
|
||||
-u, --url is the url for the server, ending with a "/".
|
||||
-s, --sender is the sender of the message, either an app name or a person.
|
||||
-d, --destination is the NTFY subscription or Discord title, to send the message to.
|
||||
-p, --priority is the priority of the message, ranging from 1 (lowest), to 5 (highest).
|
||||
-m, --message is the text of the message to be sent.
|
||||
-t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma).
|
||||
-c, --click is a link (URL) that can be followed by tapping/clicking inside the message.
|
||||
-h, --help shows this help message. Must have no value argument.
|
||||
-v, --view show config.
|
||||
|
||||
"""
|
||||
url: str
|
||||
sender: str
|
||||
destination: str
|
||||
message: str
|
||||
priority: int
|
||||
tags: str
|
||||
click: str
|
||||
|
||||
url, sender, destination, message, priority, tags, click = "", "", "", "", 0, "", ""
|
||||
|
||||
argument_list: list = sys.argv[1:]
|
||||
|
||||
if not argument_list:
|
||||
logger(config, 'No argument list found (no arguments provided with script execution')
|
||||
return url, sender, destination, message, priority, tags, click
|
||||
|
||||
else:
|
||||
|
||||
try:
|
||||
|
||||
logger(config, "Parsing arguments")
|
||||
|
||||
# Parsing arguments
|
||||
arguments, values = getopt.getopt(argument_list, options, long_options)
|
||||
|
||||
# checking each argument
|
||||
for current_argument, current_value in arguments:
|
||||
|
||||
if current_argument in ("-h", "--help"):
|
||||
print(help_text)
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-v", "--view"):
|
||||
view_config()
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-u", "--url"):
|
||||
url: str = current_value
|
||||
|
||||
elif current_argument in ("-s", "--sender"):
|
||||
sender: str = current_value
|
||||
|
||||
elif current_argument in ("-d", "--destination"):
|
||||
destination: str = current_value
|
||||
|
||||
elif current_argument in ("-p", "--priority"):
|
||||
priority: int = int(current_value)
|
||||
|
||||
elif current_argument in ("-m", "--message"):
|
||||
message: str = current_value
|
||||
|
||||
elif current_argument in ("-t", "--tags"):
|
||||
tags: str = current_value
|
||||
|
||||
elif current_argument in ("-c", "--click"):
|
||||
click: str = current_value
|
||||
|
||||
except getopt.error as err:
|
||||
# output error, and return with an error code
|
||||
|
||||
logger(config, str(err))
|
||||
|
||||
return url, sender, destination, message, priority, tags, click
|
||||
|
||||
|
||||
# Receive and load message from Wazuh
|
||||
|
||||
|
||||
def load_message():
|
||||
config: dict = get_config()
|
||||
|
||||
# get alert from stdin
|
||||
|
||||
logger(config, "Loading event message from STDIN")
|
||||
|
||||
input_str: str = ""
|
||||
for line in sys.stdin:
|
||||
input_str: str = line
|
||||
break
|
||||
|
||||
data: json = json.loads(input_str)
|
||||
|
||||
if data.get("command") == "add":
|
||||
logger(config, "Relevant event data found")
|
||||
return data
|
||||
else:
|
||||
# todo fix error message
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
# Check if there are reasons not to process this event (as per config yaml)
|
||||
|
||||
|
||||
def exclusions_check(config, alert):
|
||||
# Set some environment
|
||||
now_message, now_logging, now_weekday, now_time = set_time_format()
|
||||
|
||||
# Check the exclusion records from the configuration yaml
|
||||
ex_hours: tuple = config.get('excluded_hours')
|
||||
|
||||
# Start hour may not be later than end hours. End hour may not exceed 00:00 midnight to avoid day jump
|
||||
ex_hours = [ex_hours[0], "23:59"] if (ex_hours[1] >= '23:59' or ex_hours[1] < ex_hours[0]) else ex_hours
|
||||
|
||||
# Get some more exclusion records from the config
|
||||
ex_days = config.get('excluded_days')
|
||||
ex_agents = config.get("excluded_agents")
|
||||
ex_rules = config.get("excluded_rules")
|
||||
|
||||
# Check agent and rule from within the event
|
||||
ev_agent = alert['agent']['id']
|
||||
ev_rule = alert['rule']['id']
|
||||
|
||||
# Let's assume all lights are green
|
||||
ex_hours_eval, ex_weekday_eval, ev_rule_eval, ev_agent_eval = True, True, True, True
|
||||
|
||||
# Evaluate the conditions for sending a notification. Any False will cause the notification to be discarded.
|
||||
if (now_time > ex_hours[0]) and (now_time < ex_hours[1]):
|
||||
logger(config, "excluded: event inside exclusion time frame")
|
||||
ex_hours_eval = False
|
||||
elif now_weekday in ex_days:
|
||||
logger(config, "excluded: event inside excluded weekdays")
|
||||
ex_weekday_eval = False
|
||||
elif ev_rule in ex_rules:
|
||||
logger(config, "excluded: event id inside exclusion list")
|
||||
ev_rule_eval = False
|
||||
elif ev_agent in ex_agents:
|
||||
logger(config, "excluded: event agent inside exclusion list")
|
||||
ev_rule_eval = False
|
||||
|
||||
notification_eval = ex_hours_eval and ex_weekday_eval and ev_rule_eval and ev_agent
|
||||
|
||||
return notification_eval
|
||||
|
||||
|
||||
# Map the event threat level to the appropriate 5-level priority scale and color for use in the notification platforms.
|
||||
|
||||
|
||||
def threat_mapping(config, threat_level, fired_times):
|
||||
# Map threat level v/s priority
|
||||
|
||||
p_map = config.get('priority_map')
|
||||
|
||||
for i in range(len(p_map)):
|
||||
|
||||
if threat_level in p_map[i]["threat_map"]:
|
||||
color_mapping = p_map[i]["color"]
|
||||
priority_mapping = 5 - i
|
||||
if fired_times >= p_map[i]["mention_threshold"]:
|
||||
mention_flag = "@here"
|
||||
else:
|
||||
mention_flag = ""
|
||||
return priority_mapping, color_mapping, mention_flag
|
||||
else:
|
||||
return 0, 0, 0
|
||||
|
||||
|
||||
# Construct the message that will be sent to the notifier platforms
|
||||
|
||||
|
||||
def construct_basic_message(accent: str, data: dict) -> str:
|
||||
# Adding the BOLD text string for Discord use
|
||||
|
||||
basic_msg: str = (accent +
|
||||
"Agent:" + " " + accent + data["agent"]["name"] + " (" + data["agent"][
|
||||
"id"] + ")" + "\n" + accent +
|
||||
"Rule id: " + accent + data["rule"]["id"] + "\n" + accent +
|
||||
"Rule: " + accent + data["rule"]["description"] + "\n" + accent +
|
||||
"Description: " + accent + data["full_log"] + "\n" + accent +
|
||||
"Threat level: " + accent + str(data["rule"]["level"]) + "\n" + accent +
|
||||
"Times fired: " + accent + str(data["rule"]["firedtimes"]) + "\n")
|
||||
|
||||
return basic_msg
|
||||
|
||||
|
||||
def build_notification(caller, config, notification, alert, priority, color, mention):
|
||||
click: str = config.get('click')
|
||||
sender: str = config.get('sender')
|
||||
priority: str = str(priority)
|
||||
tags = (str(alert['rule']['groups']).replace("[", "")
|
||||
.replace("]", "")
|
||||
.replace("'", "")
|
||||
.replace(",", ", ")
|
||||
)
|
||||
full_event: str = str(json.dumps(alert, indent=4)
|
||||
.replace('"', '')
|
||||
.replace('{', '')
|
||||
.replace('}', '')
|
||||
.replace('[', '')
|
||||
.replace(']', '')
|
||||
.replace(',', ' ')
|
||||
)
|
||||
# Add the full alert data to the notification
|
||||
if caller in config["full_message"]:
|
||||
notification: str = ("\n\n" + notification + "\n" +
|
||||
"**" + "__Full event__" + "**" + "\n" + "```\n" + full_event + "```")
|
||||
|
||||
# Add Priority & tags to the notification
|
||||
notification = (notification + "\n\n" + "Priority: " + priority + "\n" +
|
||||
"Tags: " + tags + "\n\n" + click)
|
||||
|
||||
# Prepare the messaging platform specific notification and execute
|
||||
if "discord" in config["targets"]:
|
||||
url, _, _ = get_env()
|
||||
|
||||
payload = {"username": "sender",
|
||||
"content": mention,
|
||||
"embeds": [{"description": notification,
|
||||
"color": color,
|
||||
"title": sender}]}
|
||||
return payload
|
||||
|
||||
if "ntfy" in config["targets"]:
|
||||
caller = "ntfy"
|
||||
ntfy_url, _, _ = get_env()
|
||||
|
||||
payload = {"username": "sender",
|
||||
"content": mention,
|
||||
"embeds": [{"description": notification,
|
||||
"color": color,
|
||||
"title": sender}]}
|
||||
return payload
|
||||
|
||||
if "slack" in config["targets"]:
|
||||
caller = "slack"
|
||||
slack_url, _, _ = get_env()
|
||||
|
||||
payload = {"username": "sender",
|
||||
"content": mention,
|
||||
"embeds": [{"description": notification,
|
||||
"color": color,
|
||||
"title": sender}]}
|
||||
return payload
|
||||
76
wazuh-notify-test-event.json
Normal file
76
wazuh-notify-test-event.json
Normal file
@ -0,0 +1,76 @@
|
||||
{
|
||||
"version": 1,
|
||||
"origin": {
|
||||
"name": "worker01",
|
||||
"module": "wazuh-execd"
|
||||
},
|
||||
"command": "add",
|
||||
"parameters": {
|
||||
"extra_args": [],
|
||||
"alert": {
|
||||
"timestamp": "2021-02-01T20:58:44.830+0000",
|
||||
"rule": {
|
||||
"level": 15,
|
||||
"description": "Shellshock attack detected",
|
||||
"id": "31168",
|
||||
"mitre": {
|
||||
"id": [
|
||||
"T1068",
|
||||
"T1190"
|
||||
],
|
||||
"tactic": [
|
||||
"Privilege Escalation",
|
||||
"Initial Access"
|
||||
],
|
||||
"technique": [
|
||||
"Exploitation for Privilege Escalation",
|
||||
"Exploit Public-Facing Application"
|
||||
]
|
||||
},
|
||||
"info": "CVE-2014-6271https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271",
|
||||
"firedtimes": 2,
|
||||
"mail": true,
|
||||
"groups": [
|
||||
"web",
|
||||
"accesslog",
|
||||
"attack"
|
||||
],
|
||||
"pci_dss": [
|
||||
"11.4"
|
||||
],
|
||||
"gdpr": [
|
||||
"IV_35.7.d"
|
||||
],
|
||||
"nist_800_53": [
|
||||
"SI.4"
|
||||
],
|
||||
"tsc": [
|
||||
"CC6.1",
|
||||
"CC6.8",
|
||||
"CC7.2",
|
||||
"CC7.3"
|
||||
]
|
||||
},
|
||||
"agent": {
|
||||
"id": "000",
|
||||
"name": "wazuh-server"
|
||||
},
|
||||
"manager": {
|
||||
"name": "wazuh-server"
|
||||
},
|
||||
"id": "1612213124.6448363",
|
||||
"full_log": "192.168.0.223 - - [01/Feb/2021:20:58:43 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"() { :; }; /bin/cat /etc/passwd\"",
|
||||
"decoder": {
|
||||
"name": "web-accesslog"
|
||||
},
|
||||
"data": {
|
||||
"protocol": "GET",
|
||||
"srcip": "192.168.0.223",
|
||||
"id": "200",
|
||||
"url": "/"
|
||||
},
|
||||
"location": "/var/log/nginx/access.log"
|
||||
},
|
||||
"program": "/var/ossec/active-response/bin/firewall-drop"
|
||||
}
|
||||
}
|
||||
@ -1,133 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# This script is free software.
|
||||
#
|
||||
# Copyright (C) 2024, Rudi Klein.
|
||||
# All rights reserved.
|
||||
#
|
||||
# This program is free software; you can redistribute it
|
||||
# and/or modify it under the terms of the GNU General Public
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
#
|
||||
# This script is executed by the active response script (wazuh-active-response.py), which is triggered by rules firing.
|
||||
#
|
||||
# ntfy (pronounced notify) is a simple HTTP-based pub-sub notification service.
|
||||
# It allows you to send notifications to your phone or desktop via scripts from any computer, and/or using a REST API.
|
||||
# It's infinitely flexible, and 100% free software. For more information: https://ntfy.sh.
|
||||
|
||||
import getopt
|
||||
import json
|
||||
import sys
|
||||
|
||||
import requests
|
||||
|
||||
from wazuh_notifier_lib import import_config as ic
|
||||
from wazuh_notifier_lib import set_env as se
|
||||
from wazuh_notifier_lib import set_time as st
|
||||
from wazuh_notifier_lib import view_config as vc
|
||||
|
||||
# Get path values
|
||||
wazuh_path, ar_path, config_path = se()
|
||||
|
||||
# Get time value
|
||||
now_message, now_logging = st()
|
||||
|
||||
# the POST builder
|
||||
|
||||
|
||||
def ntfy_command(n_server, n_sender, n_destination, n_priority, n_message, n_tags, n_click):
|
||||
n_header = ""
|
||||
if n_sender != "": n_header = n_header + '"Title"' + ": " + '"' + n_sender + '"' + ", "
|
||||
if n_tags != "": n_header = n_header + '"Tags"' + ": " + '"' + n_tags + '"' + ", "
|
||||
if n_click != "": n_header = n_header + '"Click"' + ": " + '"' + n_click + '"' + ", "
|
||||
if n_priority != "": n_header = n_header + '"Priority"' + ": " + '"' + n_priority + '"'
|
||||
n_header = json.loads("{" + n_header + "}")
|
||||
x_message = now_message + "\n\n" + n_message
|
||||
|
||||
# todo POST the request **** NEEDS future TRY ****
|
||||
requests.post(n_server + n_destination, data=x_message, headers=n_header)
|
||||
|
||||
# Remove 1st argument from the list of command line arguments
|
||||
argument_list = sys.argv[1:]
|
||||
|
||||
# Short options
|
||||
options: str = "u:s:d:p:m:t:c:hv"
|
||||
|
||||
# Long options
|
||||
long_options: list = ["server=", "sender=", "destination=", "priority=", "message=", "tags=", "click", "help", "view"]
|
||||
|
||||
# Setting some minimal defaults in case the yaml config isn't available
|
||||
d_server: str = "https://ntfy.sh/"
|
||||
d_sender: str = "Security message"
|
||||
d_destination: str = "phil_alerts"
|
||||
d_priority: str = "5"
|
||||
d_message: str = "Test message"
|
||||
d_tags: str = "informational, testing, hard-coded"
|
||||
d_click: str = "https://google.com"
|
||||
|
||||
# Use the values from the config yaml if available. Overrides the minimal defaults.
|
||||
server = d_server if (ic("ntfy_server") is None) else ic("ntfy_server")
|
||||
sender = d_sender if (ic("ntfy_sender") is None) else ic("ntfy_sender")
|
||||
destination = d_destination if (ic("ntfy_destination") is None) else ic("ntfy_destination")
|
||||
priority = d_priority if (ic("ntfy_priority") is None) else ic("ntfy_priority")
|
||||
message = d_message if (ic("ntfy_message") is None) else ic("ntfy_message")
|
||||
tags = d_tags if (ic("ntfy_tags") is None) else ic("ntfy_tags")
|
||||
click = d_click if (ic("ntfy_click") is None) else ic("ntfy_click")
|
||||
|
||||
help_text: str = """
|
||||
-u, --server is the URL of the NTFY server, ending with a "/". Default is https://ntfy.sh/.
|
||||
-s, --sender is the sender of the message, either an app name or a person. Default is "Wazuh (IDS)".
|
||||
-d, --destination is the NTFY subscription, to send the message to. Default is none.
|
||||
-p, --priority is the priority of the message, ranging from 1 (highest), to 5 (lowest). Default is 5.
|
||||
-m, --message is the text of the message to be sent. Default is "Test message".
|
||||
-t, --tags is an arbitrary strings of tags (keywords), seperated by a "," (comma). Default is "informational, testing, hard-coded".
|
||||
-c, --click is a link (URL) that can be followed by tapping/clicking inside the message. Default is https://google.com.
|
||||
-h, --help shows this help message. Must have no value argument.
|
||||
-v, --view show config.
|
||||
"""
|
||||
|
||||
# Get params during execution. Params found here, override minimal defaults and/or config settings.
|
||||
try:
|
||||
# Parsing argument
|
||||
arguments, values = getopt.getopt(argument_list, options, long_options)
|
||||
|
||||
# Checking each argument
|
||||
for current_argument, current_value in arguments:
|
||||
|
||||
if current_argument in ("-h", "--help"):
|
||||
print(help_text)
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-v", "--view"):
|
||||
vc()
|
||||
exit()
|
||||
|
||||
elif current_argument in ("-u", "--server"):
|
||||
server = current_value
|
||||
|
||||
elif current_argument in ("-s", "--sender"):
|
||||
sender = current_value
|
||||
|
||||
elif current_argument in ("-d", "--destination"):
|
||||
destination = current_value
|
||||
|
||||
elif current_argument in ("-p", "--priority"):
|
||||
priority = current_value
|
||||
|
||||
elif current_argument in ("-m", "--message"):
|
||||
message = current_value
|
||||
|
||||
elif current_argument in ("-t", "--tags"):
|
||||
tags = current_value
|
||||
|
||||
elif current_argument in ("-c", "--click"):
|
||||
click = current_value
|
||||
|
||||
except getopt.error as err:
|
||||
# output error, and return with an error code
|
||||
print(str(err))
|
||||
|
||||
# Finally, execute the POST request
|
||||
ntfy_command(server, sender, destination, priority, message, tags, click)
|
||||
|
||||
@ -1,69 +0,0 @@
|
||||
import os
|
||||
import time
|
||||
|
||||
import yaml
|
||||
|
||||
|
||||
# Set structured timestamp for logging and discord/ntfy message.
|
||||
|
||||
|
||||
def set_time():
|
||||
now_message = time.strftime('%a, %d %b %Y %H:%M:%S')
|
||||
now_logging = time.strftime('%Y/%m/%d %H:%M:%S')
|
||||
return now_message, now_logging
|
||||
|
||||
|
||||
# Define paths: wazuh_path = wazuh root directory
|
||||
# ar_path = active-responses.log path,
|
||||
# config_path = wazuh-notifier-config.yaml
|
||||
|
||||
def set_env():
|
||||
|
||||
wazuh_path = os.path.abspath(os.path.join(__file__, "../../.."))
|
||||
ar_path = '{0}/logs/active-responses.log'.format(wazuh_path)
|
||||
config_path = '{0}/etc/wazuh-notifier-config.yaml'.format(wazuh_path)
|
||||
|
||||
return wazuh_path, ar_path, config_path
|
||||
|
||||
|
||||
# Import configuration settings from wazuh-notifier-config.yaml
|
||||
|
||||
|
||||
def import_config(key):
|
||||
try:
|
||||
_, _, config_path = set_env()
|
||||
|
||||
with open(config_path, 'r') as ntfier_config:
|
||||
config: dict = yaml.safe_load(ntfier_config)
|
||||
value: str = config.get(key)
|
||||
return value
|
||||
except (FileNotFoundError, PermissionError, OSError):
|
||||
return None
|
||||
|
||||
|
||||
# Show configuration settings from wazuh-notifier-config.yaml
|
||||
|
||||
|
||||
def view_config():
|
||||
|
||||
_, _, config_path = set_env()
|
||||
|
||||
try:
|
||||
with open(config_path, 'r') as ntfier_config:
|
||||
print(ntfier_config.read())
|
||||
except (FileNotFoundError, PermissionError, OSError):
|
||||
print(config_path + " does not exist or is not accessible")
|
||||
return
|
||||
|
||||
|
||||
# Logging the Wazuh active Response request
|
||||
|
||||
|
||||
def ar_log():
|
||||
now = set_time()
|
||||
_, ar_path, _ = set_env()
|
||||
msg = '{0} {1} {2}'.format(now, os.path.realpath(__file__), 'Post JSON Alert')
|
||||
f = open(ar_path, 'a')
|
||||
f.write(msg + '\n')
|
||||
f.close()
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user