crowdsec-notifications : init

crowdsec-notifications/README.md

@@ -0,0 +1,7 @@
+# Crowdsec Notifications
+Crowdsec Notification for Discord and Line
+
+**Remember to replace placeholder line with your authentication keys!**
+
+![Discord Example](img/Discord_94N3DVisn8.png)
+![Line Example](img/LINE_Q5uZ32zoph.png)

crowdsec-notifications/discord.yaml

@@ -0,0 +1,38 @@
+type: http
+
+name: discord
+
+log_level: info
+
+format: |
+  {
+    "content": null,
+    "embeds": [
+      {{range . -}}
+      {{$alert := . -}}
+      {{range .Decisions -}}
+      {{if $alert.Source.Cn -}}
+      {
+        "title": "{{.Scenario}}",
+        "description": ":flag_{{ $alert.Source.Cn | lower }}: {{$alert.Source.IP}}\n Hostname: {{Hostname}}\nAction: {{.Type}} {{.Duration}}\nLinks: [CTI](https://app.crowdsec.net/cti/{{$alert.Source.IP}}) | [Shodan](https://www.shodan.io/host/{{$alert.Source.IP}})",
+        "color": "16711680"
+      }
+      {{end}}
+      {{if not $alert.Source.Cn -}}
+      {
+        "title": "{{.Scenario}}",
+        "description": ":pirate_flag: {{$alert.Source.IP}}\nHostname: {{Hostname}}\nAction: {{.Type}} {{.Duration}}\nLinks: [CTI](https://app.crowdsec.net/cti/{{$alert.Source.IP}}) | [Shodan](https://www.shodan.io/host/{{$alert.Source.IP}})",
+        "color": "16711680"
+      }
+      {{end}}
+      {{end -}}
+      {{end -}}
+    ]
+  }
+
+url: https://discord.com/api/webhooks/[]/[]
+
+method: POST
+
+headers:
+  Content-Type: application/json

crowdsec-notifications/line.yaml

@@ -0,0 +1,25 @@
+type: http
+
+name: line
+
+log_level: info
+
+format: |
+  message=
+  {{range . -}}{{$alert := . -}}{{range .Decisions -}}
+  [ *{{.Scenario}}* ]
+  {{if $alert.Source.Cn -}}{{ $alert.Source.Cn  }}{{end}}{{if not $alert.Source.Cn -}}N/A{{end}} {{$alert.Source.IP}}
+  Hostname: {{Hostname}}
+  Action: {{.Type}} {{.Duration}}
+  Links: https://app.crowdsec.net/cti/{{$alert.Source.IP}}
+  Links: https://www.shodan.io/host/{{$alert.Source.IP}}
+  {{end -}}
+  {{end -}}
+
+url: https://notify-api.line.me/api/notify
+
+method: POST
+
+headers:
+  Content-Type: application/x-www-form-urlencoded
+  Authorization: Bearer <access_token>