Skip to content
This repository has been archived by the owner on Feb 13, 2024. It is now read-only.

Add Telegram alerting #38

Merged
merged 4 commits into from Oct 28, 2020

Conversation

zufardhiyaulhaq
Copy link
Contributor

@zufardhiyaulhaq zufardhiyaulhaq commented Oct 28, 2020

Summary

Proposed changes

This PR fixes/implements the following bugs/features:

  • Add telegram alerting

How has this been tested?

configuring teler.yaml using telegram alert provider

Proof:

example logging in telegram

######################
Warning: teler Alert
######################

 Crawler

Request:  / HTTP/1.1
Date:  +0700
IP Address: ::1
User Agent: curl/7.47.0
Referrer: -
Status code: 200
Bytes sent: 5

######################
Warning: teler Alert
######################

 Bruteforce

Request:  /_private HTTP/1.1
Date:  +0700
IP Address: 127.0.0.1
User Agent:  (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36
Referrer: -
Status code: 404
Bytes sent: 580

######################
Warning: teler Alert
######################

 Web Attack: Detects JavaScript location/document property access and window access obfuscation

Request:  /?_=1%20AND%20%28SELECT%202000%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x716b786b71%2C%28SELECT%20%28ELT%282000%3D2000%2C1%29%29%29%2C0x716a707871%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x%29a%29 HTTP/1.1
Date:  +0700
IP Address: ::1
User Agent:  (http://sqlmap.org)
Referrer: -
Status code: 200
Bytes sent: 160

Closing issues

Fixes #36

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
    • I have updated the documentation accordingly.
  • I have followed the guidelines in our CONTRIBUTING.md document.
  • I have written new tests for my changes.
    • My changes successfully ran and pass tests locally.

@kitabisa-bot
Copy link

kitabisa-bot bot commented Oct 28, 2020

Please consider taking a moment for us to review this pull request.

review needed

@dwisiswant0
Copy link
Member

dwisiswant0 commented Oct 28, 2020

Can you please provide a screenshot attachment of Telegram alert, @zufardhiyaulhaq?

@zufardhiyaulhaq
Copy link
Contributor Author

@dwisiswant0 give you the screenshot
gambar

@dwisiswant0
Copy link
Member

It looks like the first word of threat category got trimmed, e.g. Bad Crawler, Common Web Attack.

@zufardhiyaulhaq
Copy link
Contributor Author

let me check, that is weird since the markdown generated from the template is normal.

\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#
*Warning: teler Alert*
\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#

```Bad Crawler```

*Request*: ```GET / HTTP/1.1```
*Date*: ```28/Oct/2020:08:23:43 +0700```
*IP Address*: ```127.0.0.1```
*User Agent*: ```check_http/v2.1.2 (monitoring-plugins 2.1.2)```
*Referrer*: ```-```
*Status code*: ```200```
*Bytes sent*: ```5```

@zufardhiyaulhaq
Copy link
Contributor Author

@dwisiswant0 this is done.
gambar

Copy link
Member

@dwisiswant0 dwisiswant0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @zufardhiyaulhaq,
After reviewing, I still need some revisions of this.

Please note that we provide the parse_mode option in the configuration file because we have to provide some formatting options for the user. If I see; you only provide MarkdownV2 when referring to currently templates you created, but not for Markdown and HTML.

References:

.gitignore Outdated Show resolved Hide resolved
internal/alert/telegram.go Outdated Show resolved Hide resolved
internal/alert/telegram.go Outdated Show resolved Hide resolved
internal/alert/telegram.go Outdated Show resolved Hide resolved
internal/alert/telegram.go Outdated Show resolved Hide resolved
internal/alert/telegram.go Outdated Show resolved Hide resolved
internal/alert/telegram.go Outdated Show resolved Hide resolved
internal/alert/telegram.go Outdated Show resolved Hide resolved
README.md Show resolved Hide resolved
teler.example.yaml Outdated Show resolved Hide resolved
@dwisiswant0 dwisiswant0 added this to the Notification Providers milestone Oct 28, 2020
@dwisiswant0 dwisiswant0 added the Status: Revision Needed A round of revision is needed before this work may be published label Oct 28, 2020
@kitabisa-bot
Copy link

kitabisa-bot bot commented Oct 28, 2020

We thank reviewers for the constructive comments on this pull request.
Where appropriate, we believe the additional analyses discussed and/or suggested above have helped us to substantially improve to teler development.

revision needed

@dwisiswant0
Copy link
Member

/assign @zufardhiyaulhaq

@zufardhiyaulhaq
Copy link
Contributor Author

@dwisiswant0 I am aware that we can use MarkdownV2 or HTML, but why in the first place we can make user can customize this? since we manage the template and I believe it is not necessary for the user to select HTML or MarkdownV2 if the user cannot customize the template from the first place.

@dwisiswant0
Copy link
Member

What I mean is, when the user choose HTML; the template format we'll use is to generate a message using table fields, since the Markdown(V2) style doesn't support generating tables for messages on Telegram.

I'm going to change the base branch to development, as I will refactor configuration requirements and so on from this. You makes a good point, @zufardhiyaulhaq!

Thanks for your contributions! Approving now.

@dwisiswant0 dwisiswant0 changed the base branch from master to development October 28, 2020 10:40
@dwisiswant0 dwisiswant0 added Status: Accepted and removed Status: Revision Needed A round of revision is needed before this work may be published labels Oct 28, 2020
@kitabisa-bot
Copy link

kitabisa-bot bot commented Oct 28, 2020

Accepted! Thanks for your patience & contributions, wait to be merged.

@dwisiswant0 dwisiswant0 merged commit 8d9d2bf into kitabisa:development Oct 28, 2020
@dwisiswant0
Copy link
Member

@all-contributors please add @zufardhiyaulhaq for code.

@allcontributors
Copy link
Contributor

@dwisiswant0

I've put up a pull request to add @zufardhiyaulhaq! 🎉

@dwisiswant0 dwisiswant0 added this to In progress in teler via automation Oct 28, 2020
@dwisiswant0 dwisiswant0 moved this from In progress to Done in teler Oct 28, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
teler
  
Done
Development

Successfully merging this pull request may close these issues.

[FEATURE] Telegram notification alerts
2 participants