Tripwire Alerting Script

send-tripwire-to-goole.sh

#!/bin/bash

rm -f /etc/cron.daily/tripwire-check

LOCALPASS=TeamF!23
SITEPASS=TeamF!23

TRIPWIRE=/usr/sbin/tripwire
TWADMIN=/usr/sbin/twadmin
TWPRINT=/usr/sbin/twprint
TWLOG=/tmp/tripwire.log
cd /etc/tripwire

${TRIPWIRE} -m c -s -c tw.cfg > $TWLOG

if [ -s $TWLOG ]; then
  if [ $(grep "Total violations found" $TWLOG | awk '{print $4}') -ne 0 ]; then  
   HOST=`hostname`
   REPORT=`ls -dt /var/lib/tripwire/report/* | head -1`
   LOG=`${TWPRINT} -m r --report-level 1 -c tw.cfg -r $REPORT | sed -e 's/"//g'`
   CURL=`cat <<EOS
curl
 -XPOST
 'https://script.google.com/macros/s/*****/exec'
 -H
 'Content-Type: application/json'
 -d
 '{"host": "$HOST", "log": "tripwire", "message": "$LOG"}'
EOS`
   eval ${CURL} &> /dev/null

   ${TWADMIN} -m p -c tw.cfg -p tw.pol -S site.key > twpol.txt
   perl twpolmake.pl twpol.txt > twpol.txt.new
   ${TWADMIN} -m P -c tw.cfg -p tw.pol -S site.key -Q $SITEPASS twpol.txt.new > /dev/null
   rm -f twpol.txt* *.bak

   rm -f /var/lib/tripwire/*.twd.bak
   ${TRIPWIRE} -m i -s -c tw.cfg -P $LOCALPASS

  fi
fi