开源主机安全平台企业微信、飞书机器人预警

vim /var/ossec/etc/ossec.conf<integration>    <name>custom-wechat</name>    <hook_url>WEBHOOK</hook_url>    <level>12</level>    <api_key>APIKEY</api_key> <!-- Replace with your external service API key -->    <alert_format>json</alert_format>  </integration>

#!/usr/bin/env python# -*- coding: utf-8 -*-import requestsimport jsonimport sysimport wechat_work_webhook# 替换为你的企业微信webhook URLwebhook_url = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key="wechat = wechat_work_webhook.connect(webhook_url)# 读取配置参数alert_file = open(sys.argv[1])# 读取告警文件alert_json = json.loads(alert_file.read())alert_file.close()alert_level = alert_json['rule']['level']ruleid = alert_json['rule']['id']description = alert_json['rule']['description']agentid = alert_json['agent']['id']agentname = alert_json['agent']['name']#wechat.markdown(u'<font color="warning">告警</font> n'+"HostName: "+agentname+"n"+"AlertLevel: "+str(alert_level)+"n"+"Description: "+description)wechat.markdown(u'<font color="warning">告警</font> n'+u'主机名: '+agentname+"n"+u"告警级别: "+str(alert_level)+"n"+u"告警内容: "+description)#wechat.text('test',['@all'])

#!/usr/local/bin/python3# -*- coding: utf-8 -*-import sysimport reimport requestswebhook_url = "https://open.feishu.cn/open-apis/bot/v2/hook/xxxxxxxxxx"# 使用一个变量记录当前的日志段落current_log = ""for line in sys.stdin:    # 将每一行添加到当前的日志段落    current_log += line    # 检查是否到达一个新的日志段落的末尾    if line.strip() == "":        # 解析日志段落        match = re.search(r'Rule: d+ (level (12|13|14|15))', current_log)        if match:            alert_level = match.group(1)            # 发送到飞书机器人            payload = {                "msg_type": "text",                "content": {                    "text": f"New Alert (Level {alert_level}):n{current_log}"                }            }            headers = {"Content-Type": "application/json"}            response = requests.post(webhook_url, json=payload, headers=headers)            # 打印HTTP响应码和响应内容（用于调试）            print(f"HTTP Response Code: {response.status_code}")            print(f"HTTP Response Content: {response.text}")            if response.status_code == 200:                print("Notification sent successfully.")            else:                print(f"Failed to send notification. Status code: {response.status_code}")        # 重置当前的日志段落        current_log = ""

nohup tail -n 0 -F /var/ossec/logs/alerts/alerts.log | python3 process_log.py > output.log 2>&1 & disown