Wazuh使用企业微信机器人预警

vim /var/ossec/etc/ossec.conf 
 <integration>
    <name>custom-wechat</name>
    <hook_url>WEBHOOK</hook_url>
    <level>12</level>
    <api_key>APIKEY</api_key> <!-- Replace with your external service API key -->
    <alert_format>json</alert_format>
  </integration>

只有name属性是必填的，该参数值是自定义脚本文件的文件名
自定义脚本必须要以"custom-"作为文件名的前缀，可以是shell或python脚本文件
自定义脚本必须读取和解析处理命令行参数，其中参数1对应着包含报警消息内容的文件、参数2对应着api_key的值、参数3对应着hook_url的值。

cat /var/ossec/integrations/custom-wechat

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import requests
import json
import sys
import wechat_work_webhook


# 替换为你的企业微信webhook URL
webhook_url = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key="
wechat = wechat_work_webhook.connect(webhook_url)


# 读取配置参数
alert_file = open(sys.argv[1])
# 读取告警文件
alert_json = json.loads(alert_file.read())
alert_file.close()

alert_level = alert_json['rule']['level']
ruleid = alert_json['rule']['id']
description = alert_json['rule']['description']
agentid = alert_json['agent']['id']
agentname = alert_json['agent']['name']
#wechat.markdown(u'<font color=\"warning\">告警</font> \n'+"HostName: "+agentname+"\n"+"AlertLevel: "+str(alert_level)+"\n"+"Description: "+description)
wechat.markdown(u'<font color=\"warning\">告警</font> \n'+u'主机名: '+agentname+"\n"+u"告警级别: "+str(alert_level)+"\n"+u"告警内容: "+description)
#wechat.text('test',['@all'])