rawr.py

rawr.py

import os
import sys
import requests
import time
import json
from multiprocessing import Process


def follow(thefile):
    thefile.seek(0,2)
    while True:
        line = thefile.readline()
        if not line:
            time.sleep(0.1)
            continue
        yield line
        
        
def notify_slack():

    logfile = open('/path/to/raptor/logs/VelociraptorFrontend_debug.log', 'r')
    loglines = follow(logfile)

    for line in loglines:       
    
            line = json.loads(line)
            if "Please Enrol" in line["msg"]:
                try:
                    client = line["msg"].split("Please Enrol (")[1].split(")")[0]
                except:
                    pass
                timestamp = line["time"]

                webhook_url = "https://hooks.slack.com/services/pickles"
                data = {
                    "attachments": [
                        {
                            "fallback": client + " enrolled at " + timestamp,
                            "icon_emoji": ":velociraptor:",
                            "color": "#33E3FF",
                            "title": "Velociraptor - Client Added",
                            "title_link": "https://raptors.com/app/index.html#/host/%s/" % (client),
                            "fields": [
                                {
                                    "title": "Client",
                                    "value": client,
                                    "short": False
                                },
                                {
                                    "title": "Time",
                                    "value": timestamp,
                                    "short": False
                                }
                            ]
                        }
                    ]
                }

                response = requests.post(webhook_url, data=json.dumps(data), headers={'Content-Type': 'application/json'})


if __name__ == '__main__':
    Process(target=notify_slack).start()