ar-template.py

#!/usr/bin/env python3
#
# Just a simple Python script for Wazuh active-response. This script get alert data, prepare a JSON and call a remote API. 
#
import os
import sys
from os.path import dirname, abspath
import re
import datetime
import requests
import urllib3
import json

LOG_FILE = "/var/ossec/logs/active-responses.log"

urllib3.disable_warnings()

post_data = {
    "key": "",
    "hostname": "",
}

post_args = {
     "srcip": "srcip",
     "dstip": "dstip",
     "dstport": "port",
     "user": "user",
     "app": "service",
     "msg": "reason",
     "level": "level"
}

def DEBUG(ar_name,msg):
    with open(LOG_FILE, mode="a") as log_file:
        log_file.write(str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')) + " " + ar_name + " : " + msg +"\n")

# ===============================================================
# MAIN()
#
def main(argv):
    input_str = ""
    for line in sys.stdin:
        input_str = line
        break

    try:
        ALERT = json.loads(input_str)
    except Exception as e:
        DEBUG(argv[0],"Error while load JSON: %s"%(e))
        sys.exit(-1)

    try:
        ALERTDATA = ALERT["parameters"]["alert"]
    except Exception as e:
        DEBUG(argv[0],"Error on JSON %s"%(e))
        sys.exit(-1)

    # Prepare post data
    for (key,value) in post_args.items():
        if key in ALERTDATA["data"]:
            post_data[value] = ALERTDATA["data"][key].strip().replace(" ", "")

    post_data["description"] = ALERTDATA["rule"]["description"].strip();

    try:
        res = requests.post('https://[API HOST]/api/[API METHOD]', data=post_data, verify=False)
    except Exception as e:
        print("Error while connecting to [API HOST]: %s"%(e))
        return
    # OK, finished
    if res.status_code == 200:
        DEBUG(argv[0], "SUCCESS! %s"%(res.text))
    else:
        DEBUG(argv[0], "API call failed! Return code %s"%(res.status_code))

if __name__ == "__main__":
    main(sys.argv)