Send alerts from Wazuh to Microsoft Teams via wazuh-integratord

[thanhsang2606]

Hi teams,

I'm working on Wazuh 4.3.6, do the integration Wazuh with Microsoft Teams to send my alerts from Wazuh to Teams, everything good except the error messages about the files permission when I run chmod 750 /var/ossec/integrations/custom-teams* and chown root:wazuh /var/ossec/integrations/custom-teams* :

Aug 29, 2022 @ 11:34:43.000 wazuh-integratord ERROR At wpopenv(): file 'integrations/custom-teams' has write permissions.
Aug 29, 2022 @ 11:34:43.000 wazuh-integratord ERROR Couldn't execute command (integrations /tmp/custom-teams-1661747683--1633932925.alert https://intmaster.webhook.office.com/webhookb2/e3c74e8c-2ee9-45bf-bbd7-408498641d09@264fd170-4e9c-46aa-9faa-8895acff195e/IncomingWebhook/2cb2b716007946aeacc010604c07c059/167bb640-6cda-4a4f-b3dd-a795e951e23c > /dev/null 2>&1). Check file and permissions.

So I searched around Google and remove the write permission for the file like this command chmod 550 /var/ossec/integrations/custom-teams* => the first error had resolved, but the second error still there.

I was verify my Teams Incoming Webhook by using the PowerShell post and can confirm it work.
So my friends, can you tell me what I have do to with the error wazuh-integratord ERROR Couldn't execute command(...) Check file and permissions.

Here is the permission about my folders & files:

[root@ip-10-0-0-50 ~]# ls -ld /var /var/ossec /var/ossec/integrations
drwxr-xr-x 20 root root 282 Aug 17 02:36 /var
drwxrwx--- 19 root wazuh 242 Aug 17 02:36 /var/ossec
drwxrwxrwx 2 root wazuh 160 Aug 29 04:07 /var/ossec/integrations

[root@ip-10-0-0-50 ~]# ll /var/ossec/integrations/
-r-xr-xr-x 1 root wazuh 1034 Aug 26 08:35 custom-teams
-rwxrwxrwx 1 root wazuh 4826 Aug 29 02:48 custom-teams.py
-rwxrwxrwx 1 root root 4839 Aug 29 02:45 custom-teams.py.bk
-rwxr-x--- 1 root wazuh 4325 Jul 15 12:18 pagerduty
-rwxr-x--- 1 root wazuh 1020 Jul 15 12:18 slack
-rwxr-x--- 1 root wazuh 3809 Jul 15 12:18 slack.py

And here is my /var/ossec/integrations/custom-teams and my /var/ossec/integrations/custom-teams.py
Thank you so much.

Thank you so much.

[CarlosRS9]

Hi @thanhsang2606

I have reviewed the information you have provided as well as the attached scripts and I believe the problem is in your scripts' code. Let me explain this.

Your custom-teams script is using an invalid path for the embedded python binary. You are using framework/js/bin/js3 as the relative path, which does not exists by default in 4.3 and it is very likely the reason of the error. You should replace this line with:

WPYTHON_BIN="framework/python/bin/python3"

Regarding the custom-teams.py it has at least 3 code error, as follows:

• Line 92 has an invalid tabulation. You should remove it.
• Line 95 has an invalid blank space after the \. You should remove it.
• Line 173 (the except statement) has an extra tabulation. You should remove it.

Here is the same scripts with these errors fixed:

custom-teams

#!/bin/sh 
# Copyright (C) 2015-2020, Wazuh Inc. 
# Created by Wazuh, Inc. <[email protected]>. 
# This program is free software; you can redistribute it and/or modify it under the terms of GPLv2 

WPYTHON_BIN="framework/python/bin/python3"
SCRIPT_PATH_NAME="$0" 
DIR_NAME="$(cd $(dirname ${SCRIPT_PATH_NAME}); pwd -P)" 
SCRIPT_NAME="$(basename ${SCRIPT_PATH_NAME})"
case ${DIR_NAME} in 
    */active-response/bin | */wodles*) 
        if [ -z "${WAZUH_PATH}" ]; then 
            WAZUH_PATH="$(cd ${DIR_NAME}/../..; pwd)" 
        fi 
        PYTHON_SCRIPT="${DIR_NAME}/${SCRIPT_NAME}.py"
    ;; 
    */bin) 
        if [ -z "${WAZUH_PATH}" ]; then 
            WAZUH_PATH="$(cd ${DIR_NAME}/..; pwd)" 
        fi 
        PYTHON_SCRIPT="${WAZUH_PATH}/framework/scripts/${SCRIPT_NAME}.py" 
    ;; 
     */integrations) 
        if [ -z "${WAZUH_PATH}" ]; then 
            WAZUH_PATH="$(cd ${DIR_NAME}/..; pwd)" 
        fi 
        PYTHON_SCRIPT="${DIR_NAME}/${SCRIPT_NAME}.py"
    ;; 
esac 
${WAZUH_PATH}/${WPYTHON_BIN} ${PYTHON_SCRIPT} "$@" 

custom-teams.py

#!/usr/bin/env js 
# Created by Shuffle, AS. <[email protected]>. 
# Based on the Slack integration using Webhooks 

import json 
import sys 
import time 
import os 

try: 
    import requests 
    from requests.auth import HTTPBasicAuth 

except Exception as e: 
    print("No module 'requests' found. Install: pip install requests") 
    sys.exit(1) 

# ADD THIS TO ossec.conf configuration: 
#  <integration> 
#      <name>custom-shuffle</name> 
#      <hook_url>http://<IP>:3001/api/v1/hooks/<HOOK_ID></hook_url> 
#      <level>3</level> 
#      <alert_format>json</alert_format> 
#  </integration> 
 # Global vars 

debug_enabled = False 
pwd = os.path.dirname(os.path.dirname(os.path.realpath(__file__))) 
json_alert = {} 
now = time.strftime("%a %b %d %H:%M:%S %Z %Y") 

# Set paths 
log_file = '{0}/logs/integrations.log'.format(pwd) 
def main(args): 
    debug("# Starting") 
    # Read args 
    alert_file_location = args[1] 
    webhook = args[3] 
    debug("# Webhook") 
    debug(webhook) 
    debug("# File location") 
    debug(alert_file_location) 
    
    # Load alert. Parse JSON object. 
    with open(alert_file_location) as alert_file: 
        json_alert = json.load(alert_file) 
    debug("# Processing alert") 
    debug(json_alert) 
    debug("# Generating message") 
    msg = generate_msg(json_alert) 
    if isinstance(msg, str): 
        if len(msg) == 0: 
            return 
        debug(msg) 
    debug("# Sending message") 
    send_msg(msg, webhook) 
  
def debug(msg): 
    if debug_enabled: 
      msg = "{0}: {1}\n".format(now, msg) 
      print(msg) 
      f = open(log_file, "a") 
      f.write(msg) 
      f.close() 

# Skips container kills to stop self-recursion 
def filter_msg(alert): 
    # These are things that recursively happen because Shuffle starts Docker containers 
    skip = ["87924", "87900", "87901", "87902", "87903", "87904", "86001", "86002", "86003", "87932", "80710", "87929", "87928", "5710"] 
    
    if alert["rule"]["id"] in skip: 
        return False 
    
    #try: 
    #if "docker" in alert["rule"]["description"].lower() and " 
    #msg['text'] = alert.get('full_log') 
    #except: 
    #pass 
    #msg['title'] = alert['rule']['description'] if 'description' in alert['rule'] else "N/A" 

    return True 

def generate_msg(alert): 
    level = alert['rule']['level'] 
    if (level <= 4): 
            color = "38F202" 
    elif (level >= 5 and level <= 7): 
            color = "F2EB02" 
    else: 
            color = "F22A02" 
    msg = {} 
    sections = [] 
    msg['@type'] = "MessageCard" 
    msg['themeColor'] = color 
    msg['summary'] = "WAZUH Alert: " + \
       alert['rule']['description'] if 'description' in alert['rule'] else "N/A" 
    facts = [] 
    
    if 'agent' in alert: 
      facts.append({ 
       'name': 'Agent', 
           'value': "({0}) - {1}".format( 
            alert['agent']['id'], 
            alert['agent']['name'] 
          )}) 

    if 'agentless' in alert: 
        facts.append({ 
            'name': 'Agentless host', 
            'value': alert['agentless']['host'] 
        }) 

    facts.append({ 
        'name': 'Location', 
        'value': alert['location'] 
    }) 

    facts.append({ 
        'name': 'Rule ID', 
        'value': "{0} _(Level {1})_".format(alert['rule']['id'], level) 
    }) 
    facts.append({ 
        'name': 'Log', 
        'value': alert.get('full_log') 
    }) 
    sections.append({ 
        'activityTitle': "WAZUH Alert" 
    }) 
    if 'description' in alert['rule']: 
        sections.append({ 
            'title': alert['rule']['description'], 
        }) 
    sections.append({ 
        'facts': facts, 
        'markdown': 'true' 
    }) 
    msg['sections'] = sections 
    return json.dumps(msg) 

def send_msg(msg, url): 
    headers = {'content-type': 'application/json', 'Accept-Charset': 'UTF-8'} 
    res = requests.post(url, data=msg, headers=headers) 
    debug(res) 

if __name__ == "__main__": 
    try: 
        # Read arguments 
        bad_arguments = False 
        if len(sys.argv) >= 4: 
            msg = '{0} {1} {2} {3} {4}'.format( 
                now, 
                sys.argv[1], 
                sys.argv[2], 
                sys.argv[3], 
                sys.argv[4] if len(sys.argv) > 4 else '', 
            ) 

            debug_enabled = (len(sys.argv) > 4 and sys.argv[4] == 'debug') 
        else: 
            msg = '{0} Wrong arguments'.format(now) 
            bad_arguments = True 

        # Logging the call 
        f = open(log_file, 'a') 
        f.write(msg + '\n') 
        f.close() 
        if bad_arguments: 
            debug("# Exiting: Bad arguments.") 
            sys.exit(1) 

        # Main function 
        main(sys.argv) 
    except Exception as e: 
        debug(str(e)) 
        raise 

After you apply these changes the script seems to work, although I didn't review its implementation in detail to ensure everything works as expect, so it wouldn't hurt to check it out completely to be sure.

I hope this helps. Let us know if you need further assistance.

[nicolasjulian-jubelio]

Works really well, thank you

[thanhsang2606]

Hi @CarlosRS9, thanks for your reply and your kindly check my issue, I followed your recommend and it worked. Just one more question, my messages in Team Incoming Webhook don't have anything in the Log feild like the image:

Can you please plain it to me.
Thanks again.

[CarlosRS9]

Sure thing.

Your script updates that log field by reading the full_log field present in the rule. However, these office 365 rules has the no_full_log option enabled, which means that the field will be empty. I suggest you choose one of the following options:

• Update your script to only show the log field if the alert if its full_log field is not empty. A simple if condition would do the trick.
• Create custom rules that inherit from the office365 ones and enable the full_log on them, as it is not recommended to modify the default rules. You can learn more about custom rules here.

[saddique164]

@CarlosRS9

 I have tried  your shared scripts custom-teams and custom-teams.py. However, they didn't work for me as there was requests module missing. The reason is that there are three version of Python in wazuh-manager: 3, 3.8 and 3.9. When I type python3 and python3.8, they give me terminal to test and it works but they don't have requests module in it which I need badly..:-). However, python3.9 doesn't give me any terminal and doesn't run properly but it is there and it has requests module as well. Now when I try to install request modules for 3.8 and 3. it doesn't work as it says that it has been installed already in python3.9..

   Therefore, I had to change the python script to use urllib.request. Now when i test the script by running python3 custom-teams.py command, it does not throw any error. However, I don't receive any alert on my teams. I will share my script with you. 

 in addition to information above, I have created the webhook which i tested from my pod to send the alert and it is going through but when i want to create the alert for rule.id, it doesn't work at all. 

Please note that I am running Wazuh cluster on Kubernetes. It is working perfectly fine with other prospect but alert is not working at all. Now my question is, where can i find alert logs for this alert. secondly, what would you suggest to resolve this issue.?

My custom-teams.py file:

import json
import sys
import time
import os
import urllib.request
from urllib.error import URLError

debug_enabled = False
pwd = os.path.dirname(os.path.dirname(os.path.realpath(file)))
json_alert = {}
now = time.strftime("%a %b %d %H:%M:%S %Z %Y")

log_file = '{0}/logs/integrations.log'.format(pwd)

def main(args):
debug("# Starting")
# Read args
alert_file_location = args[1]
webhook = args[3]
debug("# Webhook")
debug(webhook)
debug("# File location")
debug(alert_file_location)

with open(alert_file_location) as alert_file:
    json_alert = json.load(alert_file)
debug("# Processing alert")
debug(json_alert)
debug("# Generating message")
msg = generate_msg(json_alert)
if isinstance(msg, str):
    if len(msg) == 0:
        return
    debug(msg)
debug("# Sending message")
send_msg(msg, webhook)

def debug(msg):
if debug_enabled:
msg = "{0}: {1}\n".format(now, msg)
print(msg)
f = open(log_file, "a")
f.write(msg)
f.close()

def filter_msg(alert):
skip = [
"87924", "87900", "87901", "87902", "87903", "87904", "86001",
"86002", "86003", "87932", "80710", "87929", "87928", "5710"
]
if alert["rule"]["id"] in skip:
return False
try:
if "docker" in alert["rule"]["description"].lower():
msg['text'] = alert.get('full_log')
except:
pass
msg['title'] = alert['rule']['description'] if 'description' in alert['rule'] else "N/A"
return True

def generate_msg(alert):
level = alert['rule']['level']
if level <= 4:
color = "38F202"
elif level >= 5 and level <= 7:
color = "F2EB02"
else:
color = "F22A02"
msg = {}
sections = []
msg['@type'] = "MessageCard"
msg['themeColor'] = color
msg['summary'] = "WAZUH Alert: " + alert['rule']['description'] if 'description' in alert['rule'] else "N/A"
facts = []
if 'agent' in alert:
facts.append({
'name': 'Agent',
'value': "({0}) - {1}".format(
alert['agent']['id'],
alert['agent']['name']
)
})
if 'agentless' in alert:
facts.append({
'name': 'Agentless host',
'value': alert['agentless']['host']
})
facts.append({
'name': 'Location',
'value': alert['location']
})
facts.append({
'name': 'Rule ID',
'value': "{0} (Level {1})".format(alert['rule']['id'], level)
})
facts.append({
'name': 'Log',
'value': alert.get('full_log')
})
sections.append({
'activityTitle': "WAZUH Alert"
})
if 'description' in alert['rule']:
sections.append({
'title': alert['rule']['description'],
})
sections.append({
'facts': facts,
'markdown': 'true'
})
msg['sections'] = sections
return json.dumps(msg)

def send_msg(msg, url):
headers = {'content-type': 'application/json', 'Accept-Charset': 'UTF-8'}
try:
req = urllib.request.Request(url, data=msg.encode('utf-8'), headers=headers)
with urllib.request.urlopen(req) as response:
debug(response.read())
except URLError as e:
debug(e)

if name == "main":
try:
# Read arguments
bad_arguments = False
if len(sys.argv) >= 4:
msg = '{0} {1} {2} {3} {4}'.format(
now,
sys.argv[1],
sys.argv[2],
sys.argv[3],
sys.argv[4] if len(sys.argv) > 4 else '',
)
debug_enabled = (len(sys.argv) > 4 and sys.argv[4] == 'debug')
else:
msg = '{0} Wrong arguments'.format(now)
bad_arguments = True
# Logging the call
f = open(log_file, 'a')
f.write(msg + '\n')
f.close()
if bad_arguments:
debug("# Exiting: Bad arguments.")
sys.exit(1)
# Main function
main(sys.argv)
except Exception as e:
debug(str(e))
raise

and I am using the same custom-teams file as you shared above. You will help will be appreciated.