updated to support notifications
@@ -13,17 +13,22 @@ import importlib
import datetime
if __name__ == '__main__':
- path = "./modules/"
+ path = './modules/'
module_folders = os.listdir(path)
print(module_folders)
+ connectors_path = './connectors/'
+ connectors_folders = os.listdir(connectors_path)
+
mD = {}
+ cD = {}
for module in module_folders:
# only take folders and not '__pycache__'
if os.path.isdir(os.path.join(path, module)) and module != '__pycache__':
try:
- m = importlib.import_module('modules.%s.%s'%(module,'module'))
+ m = importlib.import_module(
+ 'modules.%s.%s' % (module, 'module'))
if (hasattr(m, 'info') and hasattr(m, 'Module')):
module_type = m.info.get('type', None)
print(module_type)
@@ -31,10 +36,15 @@ if __name__ == '__main__':
mD[module] = {}
mD[module]['info'] = m.info
mD[module]['m'] = m
+ elif module_type == 'redelk_connector':
+ cD[module] = {}
+ cD[module]['info'] = m.info
+ cD[module]['m'] = m
except Exception as e:
- print("error in 1: %s" % e)
+ print('[e] error in module %s: %s' % (module, e))
stackTrace = traceback.format_exc()
pass
+
print('[i] looping module dict')
# this means we've loaded the modules and will now loop over those one by one
for m in mD:
@@ -42,6 +52,7 @@ if __name__ == '__main__':
moduleClass = mD[m]['m'].Module()
print('[i] Running Run() from the Module class in %s' % m)
mD[m]['result'] = moduleClass.run()
+
# now we can loop over the modules once again and log the lines
for m in mD:
r = mD[m]['result']
@@ -51,5 +62,12 @@ if __name__ == '__main__':
alarm['info'] = mD[m]['info']
alarm['line'] = rHit
alarm['@timstamp'] = datetime.datetime.utcnow().isoformat()
- ESindex = "alarms-%s"%datetime.datetime.utcnow().strftime("%Y.%m.%d")
- r = es.index(index=ESindex, ignore=400, doc_type='_doc', body=alarm)
+ ESindex = 'alarms-%s' % datetime.datetime.utcnow().strftime('%Y.%m.%d')
+ ri = es.index(index=ESindex, ignore=400,
+ doc_type='_doc', body=alarm)
+ for c in cD:
+ connector = cD[c]['m'].Module()
+ print(pprint(r))
+ if r['hits']['total'] > 0:
+ connector.send_alarm(r)
+ pass
