FastNetMon — notify_about_attack.sh — отправка уведомлений

# This script will get following params:
#  $1 client_ip_as_string
#  $2 data_direction
#  $3 pps_as_string
#  $4 action (ban or unban)

# # # = = =

#
# For ban and attack_details actions we will receive attack details to stdin
# if option notify_script_pass_details enabled in FastNetMon's configuration file
# 
# If you do not need this details, please set option notify_script_pass_details to "no".
#
# Please do not remove "cat" command if you have notify_script_pass_details enabled, because
# FastNetMon will crash in this case (it expect read of data from script side).
#

if [ "$4" = "ban" ]; then
    cat | mail -s "FastNetMon Guard: IP $1 blocked because $2 attack with power $3 pps" $email_notify;
    # You can add ban code here!
    exit 0
fi

# читаем из stdin
cat > dump
# смотрим что мы получили от FNM
cat dump
IP: 10.125.125.10
Attack type: unknown
Initial attack power: 10701 packets per second
Peak attack power: 10701 packets per second
Attack direction: incoming
Attack protocol: tcp
Total incoming traffic: 121 mbps
Total outgoing traffic: 7 mbps
Total incoming pps: 10701 packets per second
Total outgoing pps: 1539 packets per second
Total incoming flows: 0 flows per second
Total outgoing flows: 0 flows per second
Average incoming traffic: 121 mbps
Average outgoing traffic: 7 mbps
Average incoming pps: 10701 packets per second
Average outgoing pps: 1539 packets per second
Average incoming flows: 0 flows per second
Average outgoing flows: 0 flows per second
Incoming ip fragmented traffic: 0 mbps
Outgoing ip fragmented traffic: 0 mbps
Incoming ip fragmented pps: 0 packets per second
Outgoing ip fragmented pps: 0 packets per second
Incoming tcp traffic: 83 mbps
Outgoing tcp traffic: 0 mbps
Incoming tcp pps: 7029 packets per second
Outgoing tcp pps: 392 packets per second
Incoming syn tcp traffic: 0 mbps
Outgoing syn tcp traffic: 0 mbps
Incoming syn tcp pps: 0 packets per second
Outgoing syn tcp pps: 0 packets per second
Incoming udp traffic: 38 mbps
Outgoing udp traffic: 7 mbps
Incoming udp pps: 3643 packets per second
Outgoing udp pps: 1127 packets per second
Incoming icmp traffic: 0 mbps
Outgoing icmp traffic: 0 mbps
Incoming icmp pps: 0 packets per second
Outgoing icmp pps: 0 packets per second

Network:10.125.125.0/24
Network incoming traffic: 343 mbps
Network outgoing traffic: 0 mbps
Network incoming pps: 49152 packets per second
Network outgoing pps: 0 packets per second
Average network incoming traffic: 347 mbps
Average network outgoing traffic: 25 mbps
Average network incoming pps: 34114 packets per second
Average network outgoing pps: 4922 packets per second
Average packet size for incoming traffic: 1424.4 bytes 
Average packet size for outgoing traffic: 635.4 bytes

cat notify_about_attack.sh 
# так как в контейнере по умолчанию sh - подгоняем все под него
#!/usr/bin/env sh
#Telegram options
# Токен бота
TOKEN=1155682:AAGKAxWa4Lndgty67_45tghnLU
# chat ID
CHAT_ID=-1001100004650
URL="https://api.telegram.org/bot$TOKEN/sendMessage"

# тут я тяну из конфига номер фейковой автономки где сработал триггер
# как у меня это настроено я писал раньше
AS=$(grep "graphite_prefix =" /etc/fastnetmon.conf | awk '{print $3}')

# складываю данные из stdin в файл
cat > dump-a
# и выбираю то что мне интересно
attack_info=$(cat /dump-a | egrep "Attack protocol|Total incoming traffic|Total outgoing traffic|Total incoming pps|Total outgoing pps")
a_protocol=$(echo "$attack_info" | grep protocol | awk '{print $3}')
in_traf=$(echo "$attack_info" | grep "incoming traffic" | awk '{print $4}')
out_traf=$(echo "$attack_info" | grep "outgoing traffic" |awk '{print $4}')
in_pps=$(echo "$attack_info" | grep "incoming pps" | awk '{print $4}')
out_pps=$(echo "$attack_info" | grep "outgoing pps" |awk '{print $4}')

if [ "$4" = "unban" ]; then
    exit 0
fi

# и формирую сообщение в телеграм
if [ "$4" = "ban" ]; then
curl -s -X POST "$URL" -d "chat_id=$CHAT_ID" -d "text=FNM Guard on *$AS: IP $1* blocked *$2* attack via *$a_protocol* protocol with power:
Bandwidth in/out: *$in_traf / $out_traf* mbps
Packet per second in/out: *$in_pps / $out_pps* pps
[Link to Grafana](http://grafana.com.ua/d/TNzC_zciz2/fnm-by-as?var-Datacenter=$AS)" -d "parse_mode=markdown" >> /dev/null;
    exit 0
fi

if [ "$4" == "attack_details" ]; then
curl -s -X POST "$URL" -d "chat_id=$CHAT_ID" -d "text=FNM Guard on *$AS: IP $1* blocked *$2* attack via *$a_protocol* protocol with power:
Bandwidth in/out: *$in_traf / $out_traf* mbps
Packet per second in/out: *$in_pps / $out_pps* pps
[Link to Grafana](http://grafana.com.ua/d/TNzC_zciz2/fnm-by-as?var-Datacenter=$AS)" -d "parse_mode=markdown" >> /dev/null;
    exit 0
fi