Format as Slack message.
(self, event: SIEMEvent)
| 79 | def _format_slack(self, event: SIEMEvent) -> dict: |
| 80 | """Format as Slack message.""" |
| 81 | color_map = { |
| 82 | "critical": "#FF0000", |
| 83 | "high": "#FF6600", |
| 84 | "medium": "#FFCC00", |
| 85 | "low": "#00CCFF", |
| 86 | "info": "#808080", |
| 87 | } |
| 88 | |
| 89 | color = color_map.get(event.severity.lower(), "#808080") |
| 90 | |
| 91 | blocks = [ |
| 92 | { |
| 93 | "type": "header", |
| 94 | "text": { |
| 95 | "type": "plain_text", |
| 96 | "text": f"🔒 Security Alert: {event.event_type.value}", |
| 97 | } |
| 98 | }, |
| 99 | { |
| 100 | "type": "section", |
| 101 | "fields": [ |
| 102 | {"type": "mrkdwn", "text": f"*Target:*\n{event.target}"}, |
| 103 | {"type": "mrkdwn", "text": f"*Severity:*\n{event.severity.upper()}"}, |
| 104 | {"type": "mrkdwn", "text": f"*Module:*\n{event.module}"}, |
| 105 | {"type": "mrkdwn", "text": f"*Time:*\n{event.timestamp.strftime('%Y-%m-%d %H:%M:%S')}"}, |
| 106 | ] |
| 107 | }, |
| 108 | ] |
| 109 | |
| 110 | if event.finding_title: |
| 111 | blocks.append({ |
| 112 | "type": "section", |
| 113 | "text": { |
| 114 | "type": "mrkdwn", |
| 115 | "text": f"*Finding:* {event.finding_title}\n{event.finding_description or ''}", |
| 116 | } |
| 117 | }) |
| 118 | |
| 119 | return { |
| 120 | "attachments": [ |
| 121 | { |
| 122 | "color": color, |
| 123 | "blocks": blocks, |
| 124 | } |
| 125 | ] |
| 126 | } |
| 127 | |
| 128 | def _format_discord(self, event: SIEMEvent) -> dict: |
| 129 | """Format as Discord webhook message.""" |
| 130 | color_map = { |
| 131 | "critical": 0xFF0000, |