in NfwSlackIntegartion/src/slack-lambda.py [0:0]
def isPublishable (nfwAlert):
# Liberal filter
srcCidr = os.environ['srcCidr']
destCidr = os.environ['destCidr']
srcCheckReqd = (len(srcCidr) != 0)
destCheckReqd = (len(destCidr) != 0)
if len(srcCidr) == 0 and len(destCidr)== 0 :
return True
srcCondition = os.environ['srcCondition']
destCondition = os.environ['destCondition']
srcIP = nfwAlert["event"]["src_ip"]
destIP = nfwAlert["event"]["dest_ip"]
includeSrc = True
if (srcCheckReqd):
net = ip_network(srcCidr)
logger.info("Check-Src:"+str (ip_address(srcIP) in net) )
if (not (ip_address(srcIP) in net) and (srcCondition == "include")):
includeSrc = False
if ( (ip_address(srcIP) in net) and (srcCondition != "include")):
logger.info("srcCheckReqd:"+str (srcCheckReqd) )
includeSrc = False
includeDest = True
if (destCheckReqd):
net = ip_network(destCidr)
logger.info("Check-Dest:"+str (ip_address(destIP) in net) )
if (not (ip_address(destIP) in net) and (destCondition == "include")):
includeDest = False
if ( (ip_address(destIP) in net) and (destCondition != "include")):
includeDest = False
return includeSrc or includeDest