【Graylog告警联动篇】部署webhook服务实现自动传参并自动执行shell脚本

https://blog.51cto.com/mlxia/5829465

# use_devicesfile = 1
use_devicesfile = 0

https://github.com/adnanh/webhook

https://github.com/adnanh/webhook/releases/download/2.8.1/webhook-linux-amd64.tar.gz

cd /opt
tar -zxvf webhook-linux-amd64.tar.gz 
mv webhook-linux-amd64 webhook
chown root:root webhook 
mkdir /opt/webhook/logs

[
 {
  "id": "diskinfo",
  "execute-command" : "/opt/diskdf_info.sh",
  "include-command-output-in-response": true,
  "incoming-payload-content-type": "application/json",
  "pass-arguments-to-command":
  [
    {
      "source":"url",
      "name":"parameter1"
    },
     {
      "source":"url",
      "name":"parameter2"
    }
  ]
 },
 {
  "id": "sshloginip_block",
  "execute-command" : "/opt/sshloginip_block.sh",
  "include-command-output-in-response": true,
  "incoming-payload-content-type": "application/json",
  "pass-arguments-to-command":
  [
    {
      "source":"url",
      "name":"blockIP"
    }
  ]
 } 
]

vim /etc/systemd/system/webhook.service
插入如下内容
[Unit]
Description=Webhooks

[Service]
ExecStart=/opt/webhook/webhook -port 9001 --verbose -hooks /opt/webhook/hooks.json -hotreload -logfile /opt/webhook/logs/webhook.log

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable webhook.service 
systemctl start webhook.service
systemctl status webhook.service 
netstat -anp | grep 9001
tail -f /opt/webhook/logs/webhook.log

cd /etc/nginx/conf.d/
vim nginx2webhook.conf
添加如下行
server {
  listen 9090;
  server_name _;

  #ssl_certificate     /my-certificate/my-server.com/fullchain.pem;
  #ssl_certificate_key /my-certificate/my-server.com/privkey.pem;

  location / {
    try_files $uri @proxy;
  }

  location @proxy {
    proxy_pass http://webhooks;
  }
}

upstream webhooks {
  server 127.0.0.1:9001;
}

systemctl enable nginx.service
systemctl start nginx
firewall-cmd --permanent --zone=public --add-port=9090/tcp

curl -H "Content-Type: application/json" -X POST  'http://192.168.31.54:9090/hooks/diskinfo?parameter1=/data&parameter2=/boot'
curl -H "Content-Type: application/json" -X POST  'http://192.168.31.54:9090/hooks/sshloginip_block?blockIP=2.3.4.5'

#!/bin/bash
BlockIP=$1
# 判断是否为内网IP
if [[ $BlockIP =~ ^(10\.|172\.16\.|192\.168\.|100\.|198\.) ]]; then
    echo "Error: $BlockIP is an internal IP. Exiting script."
    exit 1
fi
cat  > /opt/blockIP_request.json << \EOF
{
 "msgtype": "actionCard",
 "actionCard": {
  "title":"调用webhook服务手动封锁攻击IP",
  "text":"
   ##### 请确认是否调用webhook服务并封锁攻击IP \n
>  ##### <font color=#FF0000>  待封锁的攻击IP:tempIP  </font> \n
        ",
        "btnOrientation": "1",
        "btns": [
            {
                "title": "同意封锁",
                "actionURL": "http://192.168.31.54:9090/hooks/sshloginip_block?blockIP=tempIP"
            },
            {
                "title": "忽略",
                "actionURL": "http://192.168.31.54:9090/hooks/sshloginip_block"
            }
        ]
    }
}
EOF
sed -i "s^tempIP^$BlockIP^g" /opt/blockIP_request.json
curl -k  -H "Content-Type: application/json" -X POST -d @/opt/blockIP_request.json 'https://oapi.dingtalk.com/robot/send?access_token=XXXXX'

https://github.com/adnanh/webhook/blob/master/docs/Hook-Examples.md
https://github.com/adnanh/webhook/issues/543
https://cloud.tencent.com/developer/article/1922704