Added extension folder for Shuffle

functions/extensions/wazuh/ossec.conf

@@ -0,0 +1,7 @@
+<integration>
+  <name>Shuffle</name>
+  <hook_url>http://<IP>:3001/api/v1/hooks/webhook_<HOOK_ID></hook_url>
+  <level>2</level>
+  <group>multiple_drops|authentication_failures</group>
+  <alert_format>json</alert_format>
+</integration>

functions/extensions/wazuh/requirements.txt

@@ -0,0 +1 @@
+requests

functions/extensions/wazuh/shuffle.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+
+# Based on 
+# https://wazuh.com/blog/how-to-integrate-external-software-using-integrator/
+  
+import sys
+import json
+import requests
+from requests.auth import HTTPBasicAuth
+  
+# Set the project attributes
+project_alias = 'TI'
+issue_name ='FIM'
+ 
+# Read configuration parameters
+alert_file = open(sys.argv[1])
+user = sys.argv[2].split(':')[0]
+api_key = sys.argv[2].split(':')[1]
+hook_url = sys.argv[3]
+  
+# Read the alert file
+alert_json = json.loads(alert_file.read())
+alert_file.close()
+  
+# Extract issue fields
+alert_level = alert_json['rule']['level']
+description = alert_json['rule']['description']
+path = alert_json['syscheck']['path']
+ 
+# Generate request
+msg_data = {}
+msg_data['fields'] = {}
+msg_data['fields']['project'] = {}
+msg_data['fields']['project']['key'] = project_alias
+msg_data['fields']['summary'] = 'FIM alert on [' + path + ']'
+msg_data['fields']['description'] = '- State: ' + description + '\n- Alert level: ' + str(alert_level)
+msg_data['fields']['issuetype'] = {}
+msg_data['fields']['issuetype']['name'] = issue_name
+headers = {'content-type': 'application/json', 'Accept-Charset': 'UTF-8'}
+ 
+# Send the request
+requests.post(hook_url, data=json.dumps(msg_data), headers=headers, auth=(user, api_key))
+ 
+sys.exit(0)