-
Notifications
You must be signed in to change notification settings - Fork 0
/
audit_log_forwarder_slack.py
79 lines (66 loc) · 3.18 KB
/
audit_log_forwarder_slack.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
# Example of how to build a custom integration to pull new Audit Log entries
# at a defined interval and then push them to a Slack channel.
#---import required libraries---
import time, json, requests, datetime, deepinstinct30 as di
from dateutil import parser
#---configuration---
di.fqdn = 'SERVERNAME.customers.deepinstinctweb.com'
di.key = 'API-KEY'
slack_webhook_url = 'https://hooks.slack.com/workflows/WEBHOOK-URL'
sleep_time_in_seconds = 300
categories=['LOGIN', 'FAILED_LOGIN', 'LOGOUT', 'NOTIFICATION', 'COMMENT', 'ADMINISTRATOR_MANAGEMENT', 'POLICY', 'ALLOW_LIST_DENY_LIST', 'GROUP', 'SYSTEM_SETTINGS', 'DEPLOYMENT', 'SYSTEM_REPORT_SEEN', 'SANDBOX_REPORT', 'BACKUP_AND_RESTORE', 'REMEDIATION', 'SERVER_TLS_CERTIFICATE', 'REPORTING']
persistent_config_file_name = f'audit_log_forwarder_slack_{di.fqdn.split(".",1)[0]}.conf'
# a method for forwarding a single Audit Log to Slack using the provided webhook_url
def send_to_slack(entry, simulate=False):
slack_data = { 'timestamp': parser.parse(entry['timestamp']).strftime("%Y-%m-%d %H:%M:%S %Z"),
'user': entry['user_id'],
'category': entry['category'].capitalize(),
'type': entry['type'].capitalize(),
'source': entry['source'],
'text': entry['description']
}
if simulate:
print('The following data would have been sent to', slack_webhook_url, '\n', json.dumps(slack_data,indent=4))
else:
requests.post(slack_webhook_url, json=slack_data, headers={'Content-Type': 'application/json'})
# a method to read config from .conf file on disk
def get_config():
try:
with open(persistent_config_file_name, 'r') as f:
return int(f.read())
except OSError as e:
return 0
# a method to write config to .conf file on disk
def save_config(offset):
try:
with open(persistent_config_file_name, 'w') as f:
f.write(str(offset))
except OSError as e:
now = datetime.datetime.now()
print(now.strftime("%H:%M"), 'ERROR:', e)
#---runtime---
while True:
offset = get_config()
print('Getting new entries with id greater than', offset)
try:
new_entries = di.get_audit_log(offset=offset, categories=categories)
except requests.exceptions.RequestException as e:
now = datetime.datetime.now()
print(now.strftime("%H:%M"), 'ERROR:', e)
new_entries = []
print(len(new_entries), 'items were returned')
if len(new_entries) > 0:
for entry in new_entries:
print('Sending entry', entry['id'], 'to Slack')
try:
send_to_slack(entry)
#send_to_slack(entry, simulate=True)
except requests.exceptions.RequestException as e:
now = datetime.datetime.now()
print(now.strftime("%H:%M"), 'ERROR:', e)
if entry['id'] > offset:
offset = entry['id']
print('Highest Audit Log Entry ID is now', offset)
save_config(offset)
print('Sleeping for', sleep_time_in_seconds, 'seconds')
time.sleep(sleep_time_in_seconds)