#!/usr/bin/python3 # -*- coding: utf-8 -*- """ Part of RedELK This connector sends RedELK alerts via email Authors: - Outflank B.V. / Mark Bergman (@xychix) - Lorenzo Bernardi (@fastlorenzo) """ import os import logging import smtplib import base64 from email.header import Header from email.mime.application import MIMEApplication from email.mime.multipart import MIMEMultipart from email.mime.text import MIMEText from email.utils import formataddr, formatdate from json2html import json2html from config import notifications, project_name from modules.helpers import get_value, pprint info = { "version": 0.1, "name": "email connector", "description": "This connector sends RedELK alerts via email", "type": "redelk_connector", "submodule": "email", } FILEDIR = os.path.abspath(os.path.dirname(__file__)) class Module: """email connector module""" def __init__(self): self.logger = logging.getLogger(info["submodule"]) def send_mail( self, to_addresses, mail, subject, from_address=notifications["email"]["from"], attachment=None, smtp_host=notifications["email"]["smtp"]["host"], smtp_port=notifications["email"]["smtp"]["port"], smtp_user=notifications["email"]["smtp"]["login"], smtp_pass=notifications["email"]["smtp"]["pass"], ): # pylint: disable=too-many-arguments """Sends the email""" message = MIMEMultipart() # Read html File html = mail message["Subject"] = f"[{project_name}] {subject}" message["From"] = formataddr((str(Header(from_address, "utf-8")), from_address)) message["To"] = ", ".join(to_addresses) message["Date"] = formatdate() # DONE PREPARATION, BUILD MAIL message.attach(MIMEText(html, "html")) if attachment is not None: message = self.attach_file(message, attachment) # Sending the stuff connection = smtplib.SMTP(smtp_host, int(smtp_port)) connection.starttls() connection.login(smtp_user, smtp_pass) resp = connection.sendmail(from_address, to_addresses, message.as_string()) self.logger.debug("smtpd response: %s", resp) connection.close() def attach_file(self, message, filename): # pylint: disable=no-self-use """Attaches the HTML version of the email to the message""" with open(filename, "rb") as file: part = MIMEApplication(file.read(), Name=filename) part["Content-Disposition"] = f'attachment; filename="{filename}"' message.attach(part) return message def send_alarm(self, alarm): """Send the alarm""" # Read the RedELK logo from file and base64 encode it with open(f"{FILEDIR}/redelk_white.png", "rb") as logo_file: redelk_logo_b64 = base64.b64encode(logo_file.read()).decode("utf-8") mail = f""" Alarm from RedELK """ subject = f'Alarm from {alarm["info"]["name"]} [{alarm["hits"]["total"]} hits]' if len(alarm["groupby"]) > 0: mail += f""" """ try: for hit in alarm["hits"]["hits"]: index = 0 title = hit["_id"] while index < len(alarm["groupby"]): val = get_value(f'_source.{alarm["groupby"][index]}', hit) if index == 0: title = val else: title = f"{title} / {val}" index += 1 mail += f""" """ row = 0 for field in alarm["fields"]: bgcolor = "#FAFAFA" if row % 2 == 0 else "#F1F1F1" val = get_value(f"_source.{field}", hit) value = json2html.convert(json=val) mail += f""" """ row += 1 mail += '' mail += "
img RedELK alarm: {alarm["info"]["name"]}
Project: {project_name}
Total hits: {alarm["hits"]["total"]}

{alarm["info"]["description"]}

Please note that the items below have been grouped by: {pprint(alarm["groupby"])}
{title}
{field} {value}
 
\n\n" except Exception as error: # pylint: disable=broad-except self.logger.error("Error sending email: %s", error) self.logger.exception(error) mail += "\n" self.send_mail(notifications["email"]["to"], mail, subject)