зеркало из https://github.com/mozilla/MozDef.git
Revert "Remove unnecessary alert plugin"
This reverts commit 3653984c11a6570bbf149bc8df5ac4bc6716987a.
This commit is contained in:
Родитель
db56a5bf7f
Коммит
a0be94bfbc
|
@ -0,0 +1,4 @@
|
|||
[options]
|
||||
smtpserver = <add_smtpserver>
|
||||
sender = <add_sender_email>
|
||||
recipients = <add_recipient_email>,<add_recipient2_email>
|
|
@ -0,0 +1,73 @@
|
|||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
# Copyright (c) 2017 Mozilla Corporation
|
||||
#
|
||||
# Contributors:
|
||||
# Alicia Smith <asmith@mozilla.com>
|
||||
# Michal Purzynski <mpurzynski@mozilla.com>
|
||||
# Brandon Myers <bmyers@mozilla.com>
|
||||
|
||||
import os
|
||||
import sys
|
||||
from datetime import datetime
|
||||
from configlib import getConfig, OptionParser
|
||||
import smtplib
|
||||
from email.mime.text import MIMEText
|
||||
from email.Utils import formatdate
|
||||
from time import mktime
|
||||
|
||||
|
||||
class message(object):
|
||||
def __init__(self):
|
||||
'''
|
||||
takes an incoming alert
|
||||
and uses it to trigger an email sent to
|
||||
the releng signing server team
|
||||
'''
|
||||
|
||||
self.registration = ['access']
|
||||
self.priority = 2
|
||||
|
||||
# set my own conf file
|
||||
# relative path to the alerts alertWorker.py file
|
||||
self.configfile = './plugins/ssh_access_signreleng.conf'
|
||||
self.options = None
|
||||
if os.path.exists(self.configfile):
|
||||
sys.stdout.write('found conf file {0}\n'.format(self.configfile))
|
||||
self.initConfiguration()
|
||||
|
||||
def initConfiguration(self):
|
||||
myparser = OptionParser()
|
||||
# setup self.options by sending empty list [] to parse_args
|
||||
(self.options, args) = myparser.parse_args([])
|
||||
|
||||
# email settings
|
||||
self.options.smtpserver = getConfig('smtpserver', 'localhost', self.configfile)
|
||||
self.options.sender = getConfig('sender', 'donotreply@localhost.com', self.configfile)
|
||||
recipients_str = getConfig('recipients', 'noone@localhost.com', self.configfile)
|
||||
self.options.recipients = recipients_str.split(',')
|
||||
|
||||
def onMessage(self, message):
|
||||
# here is where you do something with the incoming alert message
|
||||
|
||||
emailMessage = MIMEText(message['summary'] + ' on ' + message['events'][0]['documentsource']['utctimestamp'])
|
||||
emailMessage['Subject'] = 'MozDef Alert: Releng Restricted Servers Successful SSH Access'
|
||||
emailMessage['From'] = self.options.sender
|
||||
emailMessage['To'] = ','.join(self.options.recipients)
|
||||
nowtuple = mktime(datetime.utcnow().timetuple())
|
||||
# The Date field needs to be in a specific format, and we must
|
||||
# define it or gmail struggles to parse it.
|
||||
emailMessage['Date'] = formatdate(nowtuple)
|
||||
smtpObj = smtplib.SMTP(self.options.smtpserver, 25)
|
||||
try:
|
||||
smtpObj.sendmail(self.options.sender, self.options.recipients, emailMessage.as_string())
|
||||
smtpObj.quit()
|
||||
except smtplib.SMTPException as e:
|
||||
sys.stderr.write('Error: failed to send email {0}\n'.format(e))
|
||||
|
||||
# you can modify the message if needed
|
||||
# plugins registered with lower (>2) priority
|
||||
# will receive the message and can also act on it
|
||||
# but even if not modified, you must return it
|
||||
return message
|
Загрузка…
Ссылка в новой задаче