|
| 1 | +package alerts |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + "html" |
| 7 | + "strings" |
| 8 | + |
| 9 | + mail_connectors "github.com/utmstack/utmstack/backend/internal/mail/connectors" |
| 10 | + "github.com/utmstack/utmstack/backend/modules/alerts/connectors" |
| 11 | + "github.com/utmstack/utmstack/backend/modules/alerts/domain" |
| 12 | + appconfig_connectors "github.com/utmstack/utmstack/backend/modules/appconfig/connectors" |
| 13 | +) |
| 14 | + |
| 15 | +const ( |
| 16 | + ConfigKeyNotificationTo = "utmstack.alerts.notification_to" |
| 17 | + ConfigKeyNotificationCc = "utmstack.alerts.notification_cc" |
| 18 | +) |
| 19 | + |
| 20 | +const ( |
| 21 | + ConfigKeyBaseURL = "utmstack.mail.baseUrl" |
| 22 | + ConfigKeyOrganization = "utmstack.mail.organization" |
| 23 | +) |
| 24 | + |
| 25 | +type alertMailer struct { |
| 26 | + mail mail_connectors.MailService |
| 27 | + store appconfig_connectors.Store |
| 28 | +} |
| 29 | + |
| 30 | +func NewAlertMailer(mail mail_connectors.MailService, store appconfig_connectors.Store) connectors.AlertMailer { |
| 31 | + return &alertMailer{mail: mail, store: store} |
| 32 | +} |
| 33 | + |
| 34 | +func (m *alertMailer) SendAlertRaised(ctx context.Context, alert domain.UtmAlert) error { |
| 35 | + if m.mail == nil { |
| 36 | + return nil |
| 37 | + } |
| 38 | + to := readList(ctx, m.store, ConfigKeyNotificationTo) |
| 39 | + if len(to) == 0 { |
| 40 | + return nil |
| 41 | + } |
| 42 | + cc := readList(ctx, m.store, ConfigKeyNotificationCc) |
| 43 | + |
| 44 | + subject, body := m.render(ctx, alert) |
| 45 | + return m.mail.SendMail(ctx, to, cc, subject, body, nil) |
| 46 | +} |
| 47 | + |
| 48 | +func (m *alertMailer) render(ctx context.Context, a domain.UtmAlert) (subject, body string) { |
| 49 | + org := readString(ctx, m.store, ConfigKeyOrganization) |
| 50 | + subject = fmt.Sprintf("[%s] %s", shortID(a.ID), a.Name) |
| 51 | + if org != "" { |
| 52 | + subject = org + " " + subject |
| 53 | + } |
| 54 | + |
| 55 | + rows := [][2]string{ |
| 56 | + {"Severity", string(a.Severity)}, |
| 57 | + {"Category", a.Category}, |
| 58 | + {"Technique", a.Technique}, |
| 59 | + {"Data source", a.DataSource}, |
| 60 | + {"Data type", a.DataType}, |
| 61 | + {"When", a.Timestamp}, |
| 62 | + } |
| 63 | + if a.Adversary != nil && a.Adversary.Host != "" { |
| 64 | + rows = append(rows, [2]string{"Adversary", a.Adversary.Host}) |
| 65 | + } |
| 66 | + if a.Target != nil && a.Target.Host != "" { |
| 67 | + rows = append(rows, [2]string{"Target", a.Target.Host}) |
| 68 | + } |
| 69 | + |
| 70 | + var b strings.Builder |
| 71 | + b.WriteString("<html><body>") |
| 72 | + fmt.Fprintf(&b, "<h2>%s</h2>", html.EscapeString(a.Name)) |
| 73 | + if a.Description != "" { |
| 74 | + fmt.Fprintf(&b, "<p>%s</p>", html.EscapeString(a.Description)) |
| 75 | + } |
| 76 | + b.WriteString("<table cellpadding=\"4\">") |
| 77 | + for _, r := range rows { |
| 78 | + if r[1] == "" { |
| 79 | + continue |
| 80 | + } |
| 81 | + fmt.Fprintf(&b, "<tr><td><strong>%s</strong></td><td>%s</td></tr>", |
| 82 | + html.EscapeString(r[0]), html.EscapeString(r[1])) |
| 83 | + } |
| 84 | + b.WriteString("</table>") |
| 85 | + |
| 86 | + if base := strings.TrimRight(readString(ctx, m.store, ConfigKeyBaseURL), "/"); base != "" { |
| 87 | + link := fmt.Sprintf("%s/threat-management/alerts?alertId=%s", base, a.ID) |
| 88 | + fmt.Fprintf(&b, "<p><a href=\"%s\">Open in UTMStack</a></p>", html.EscapeString(link)) |
| 89 | + } |
| 90 | + b.WriteString("</body></html>") |
| 91 | + |
| 92 | + return subject, b.String() |
| 93 | +} |
| 94 | + |
| 95 | +func shortID(id string) string { |
| 96 | + if len(id) > 8 { |
| 97 | + return id[:8] |
| 98 | + } |
| 99 | + return id |
| 100 | +} |
| 101 | + |
| 102 | +func readString(ctx context.Context, store appconfig_connectors.Store, key string) string { |
| 103 | + if store == nil { |
| 104 | + return "" |
| 105 | + } |
| 106 | + v, ok, err := store.GetString(ctx, key) |
| 107 | + if err != nil || !ok { |
| 108 | + return "" |
| 109 | + } |
| 110 | + return strings.TrimSpace(v) |
| 111 | +} |
| 112 | + |
| 113 | +func readList(ctx context.Context, store appconfig_connectors.Store, key string) []string { |
| 114 | + v := readString(ctx, store, key) |
| 115 | + if v == "" { |
| 116 | + return nil |
| 117 | + } |
| 118 | + parts := strings.Split(v, ",") |
| 119 | + out := make([]string, 0, len(parts)) |
| 120 | + for _, p := range parts { |
| 121 | + if p = strings.TrimSpace(p); p != "" { |
| 122 | + out = append(out, p) |
| 123 | + } |
| 124 | + } |
| 125 | + return out |
| 126 | +} |
0 commit comments