Refactor

alerts/base-alert.js

@@ -0,0 +1,145 @@
+const { ButtonBuilder, ActionRowBuilder, ButtonStyle, EmbedBuilder } = require('discord.js');
+const discord_key = process.env.DISCORD_TOKEN
+const slackBotToken = process.env.SLACK_TOKEN
+const slack = require('../components/slack')
+const discord = require('../components/discord')
+
+
+const alertTypes = {
+    DOS_DETECTION: 'dosDetectionIncident',
+    MALWARE_CATCH: 'malwareCatch',
+    WAF_INCIDENT: 'wafIncident'
+};
+
+class BaseAlert {
+
+    alertName;
+    alertType;
+    alertData;
+
+    constructor(alertData) {
+        this.alertData = alertData
+    }
+
+    async sendAlertToSlack() {
+        if (!slackBotToken) {
+            return;
+        }
+
+        let blockMessage = [
+            {
+                "type": "header",
+                "text": {
+                    "type": "plain_text",
+                    "text": "DoS Alert",
+                    "emoji": true
+                }
+            },
+            {
+                "type": "divider"
+            },
+            {
+                "type": "section",
+                "fields": [
+                    {
+                        "type": "mrkdwn",
+                        "text": `*ServerID*\n ${this.alertData.serverId}`
+                    },
+                    {
+                        "type": "mrkdwn",
+                        "text": `*Threshold*\n ${this.alertData.threshold}`
+                    },
+                    {
+                        "type": "mrkdwn",
+                        "text": `*ServerName*\n ${this.alertData.serverName}`
+                    }
+                ]
+            },
+            {
+                "type": "actions",
+                "elements": [
+                    {
+                        "type": "button",
+                        "text": {
+                            "type": "plain_text",
+                            "text": ":bitninja: View on BitNinja",
+                            "emoji": true
+                        },
+                        "value": "click_me_123",
+                        "url": `https://console.bitninja.io/server/${this.alertData.serverId}`
+                    },
+                    {
+                        "type": "button",
+                        "text": {
+                            "type": "plain_text",
+                            "text": ":whm: View WHM",
+                            "emoji": true
+                        },
+                        "value": "click_me_123",
+                        "url": `https://${this.alertData.serverName}:2087`
+                    }
+                ]
+            },
+            {
+                "type": "divider"
+            },
+            {
+                "type": "context",
+                "elements": [
+                    {
+                        "type": "plain_text",
+                        "text": `AlertId: ${this.alertData.alertId}`,
+                        "emoji": true
+                    }
+                ]
+            }
+        ];
+
+        await slack.chat.postMessage({
+            channel: `#${process.env.SLACK_CH}`,
+            text: `Malware Alert on ${this.alertData.serverName}`,
+            blocks: blockMessage
+        });
+        const date = new Date();
+        const isoDate = date.toISOString();
+        console.log(`[` + isoDate + `] Slack Notification | ${this.alertData.alertId}`);
+    }
+
+    async sendAlertToDiscord() {
+        if (discord_key) {
+            return;
+        }
+
+        const notificationEmbed = new EmbedBuilder()
+            .setTitle(this.alertName)
+            .setDescription('The threshold has been reached in the last 30 minutes.')
+            .setColor('#E84545')
+            .addFields(
+                { name: 'ServerID', value: this.alertData.serverId.toString(), inline: true },
+                { name: 'ServerName', value: this.alertData.serverName.toString(), inline: true },
+                { name: 'Threshold', value: this.alertData.threshold.toString(), inline: true },
+            )
+
+            //.setAuthor('BitNinja Alert')*/
+            .setFooter({ text: `alertId: ${this.alertData.alertId}` })
+            .setTimestamp();
+        const button1 = new ButtonBuilder()
+            .setLabel('WHM Access')
+            .setStyle(ButtonStyle.Link)
+            .setURL(`https://${this.alertData.serverName}:2087`);
+
+        const button2 = new ButtonBuilder()
+            .setLabel('View on BitNinja')
+            .setStyle(ButtonStyle.Link)
+            .setURL(`https://console.bitninja.io/server/${this.alertData.serverId}`);
+
+        const row = new ActionRowBuilder().addComponents(button1, button2)
+        const channel = await discord.channels.fetch(process.env.DISCORD_CH); // replace CHANNEL_ID with the ID of the channel you want to send the message to
+        await channel.send({ embeds: [notificationEmbed], components: [row] });
+    }
+}
+
+module.exports = {
+    BaseAlert,
+    alertTypes
+}

alerts/dos.js

@@ -0,0 +1,7 @@
+const { BaseAlert } = require("./base-alert");
+
+class DosAlert extends BaseAlert {
+    alertName = 'DoS Alert'
+}
+
+module.exports = DosAlert

alerts/malware.js

@@ -0,0 +1,7 @@
+const { BaseAlert } = require("./base-alert");
+
+class MalwareAlert extends BaseAlert {
+    alertName = 'Malware Alert'
+}
+
+module.exports = MalwareAlert

alerts/waf.js

@@ -0,0 +1,7 @@
+const { BaseAlert } = require("./base-alert");
+
+class WAFAlert extends BaseAlert {
+    alertName = 'WAF Alert'
+}
+
+module.exports = WAFAlert

components/discord.js

@@ -0,0 +1,15 @@
+const { Client } = require('discord.js');
+const discord_key = process.env.DISCORD_TOKEN
+
+const client = new Client({
+    intents: []
+});
+
+if (discord_key) {
+    client.on('ready', () => {
+        console.log(`Discord bot ${client.user.tag} has started`);
+    });
+    client.login(discord_key);
+}
+
+module.exports = client

components/slack.js

@@ -0,0 +1,5 @@
+const slackBotToken = process.env.SLACK_TOKEN
+const { WebClient } = require('@slack/web-api');
+const slack = new WebClient(slackBotToken);
+
+module.exports = slack;

endpoints/alerts.js

@@ -0,0 +1,35 @@
+const MalwareAlert = require('../alerts/malware')
+const WafAlert = require('../alerts/waf')
+const DosAlert = require('../alerts/dos')
+
+const { alertType } = require('../alerts/base-alert')
+
+
+module.exports = async (req, res) => {
+    const data = await req.body
+
+    let alertInstance
+
+    switch (data.alertType) {
+        case alertType.MALWARE_CATCH:
+            alertInstance = new MalwareAlert(data);
+            break;
+        case alertType.DOS_DETECTION:
+            alertInstance = new DosAlert(data);
+            break;
+        case alertType.WAF_INCIDENT:
+            alertInstance = new WafAlert(data);
+            break;
+    }
+
+    try {
+        await alertInstance.sendAlertToDiscord();
+    } catch (e) {
+        console.error('Failed to send alert to discord!', e)
+    }
+    try {
+        await alertInstance.sendAlertToSlack();
+    } catch (e) {
+        console.error('Failed to send alert to slack channel!', e)
+    }
+};

endpoints/home.js

@@ -0,0 +1,8 @@
+module.exports = (req, res) => {
+    const key = req.query.key;
+    if (key === process.env.WEBHOOK_KEY) {
+        res.status(200).json("Welcome to " + process.env.APP_NAME);
+    } else {
+        res.status(403).json("Unauthorized");
+    }
+};

endpoints/middlewares/check-request.js

@@ -0,0 +1,17 @@
+const { alertType } = require('../../alerts/base-alert')
+
+
+module.exports = async (req, res, next) => {
+    const key = req.query.key;
+    const data = await req.body
+
+    if (key === process.env.WEBHOOK_KEY) {
+        return res.status(403).json("Unauthorized");
+    }
+
+    if (!Object.values(alertType).includes(data.alertType)) {
+        return res.status(400).json("Error: Invalid incident Type")
+    }
+
+    next();
+}