So, after a little fiddling I have something that's working.
To recap there are three hurdles here to deal with
1. Create the web hook in Slack
2. Create a way to achieve a HTTPS POST so you can use he web hook
3. Create a way to tie the results of #2 into UIM
Item 1 is pretty easy depending on the authority you have in Slack. The instructions are covered at https://api.slack.com/apps/AA24FKHC0/incoming-webhooks?success=1 . Essentially you create a custom App, choose web hook as the type, and associate it with a Slack channel. It generates a URL that you use to interact with Slack.
Item 2 proves to be a little more challenging on Windows. If running this on Linux, you have curl natively and can use something like:
curl -X POST -H 'Content-type: application/json' --data '{"text":"Hello, World!"}' https://hooks.slack.com/services/TheRestOfYourURLHere
Windows doesn't have curl so you can either download it (if you can find a source you trust) or write something in one of the Windows natively supported languages.
I would have liked to do this in Lua completely but there's no native socket library available. Given the move towards REST-style APIs in UIM, adding a HTTP library to the nas/nsa would be a fabulous thing to do in my perspective....
My final choice was to do it in PowerShell. In retrospect, it might have been easier to do in Java but so be it. This code presented is somewhat based on the work at PowerShell : Http Get/Post | Sacha's Blog . Turns out that the older Powerscript versions (V2 in the case of Windows 2008 R2) haven't yet refined the HTTP interaction functions that are so prevalent in examples on the web.
To use this you will need to update the web_hook and rawtext variables with what's specific to you:
Param([string] $msg_content)
$web_hook = "https://hooks.slack.com/services/TheRestOfYourURLHere"
$rawtext = '{"text":"' + $msg_content + '","channel":"__YourChannelHere"}'
write-host "URL: $web_hook"
write-host "Payload: $rawtext"
$Request = [System.Net.WebRequest]::Create($web_hook)
$Request.ContentType = "application/json"
$encodedContent = [System.Text.Encoding]::UTF8.GetBytes($rawtext)
$Request.Method = "POST"
write-host "UTF8 Encoded Payload: $encodedContent"
write-host $encodedContent.length
if($encodedContent.length -gt 0) {
$Request.ContentLength = $encodedContent.length
$requestStream = $Request.GetRequestStream()
$requestStream.Write($encodedContent, 0, $encodedContent.length)
$requestStream.Close()
}
[System.Net.WebResponse] $resp = $Request.GetResponse();
if($resp -ne $null)
{
$rs = $resp.GetResponseStream();
[System.IO.StreamReader] $sr = New-Object System.IO.StreamReader -argumentList $rs;
[string] $results = $sr.ReadToEnd();
write-host "Results : $results"
return $results
}
else
{
exit ''
}
This gives you an app that will post to Slack whatever you supply on the command line. You call it like:
PowerShell.exe -ExecutionPolicy Bypass -File ".\SlackPost.ps1" -msg_content "This is a parameter"
Now all you need is a Lua script that creates the "msg_content" parameter and launches this OS command. I'm using something like:
local a = alarm.get()
if (a ~= nil) then
local msg_content = [[PowerShell.exe -ExecutionPolicy Bypass -File ".\SlackPost.ps1" ]]
msg_content = msg_content .. [[ -msg_content "Level : ]] .. a.severity .. [[\nSerial : ]] .. a.nimid .. [[\nAlert : ]] .. a.message .. [[\nCase : https://salesforce.com/_ui/search/ui/UnifiedSearchResults?searchType=2&sen=500&str=]] .. a.nimid ..[["]]
print(msg_content)
local handle = io.popen(msg_content)
local result = handle:read("*a")
handle:close()
print(result)
else
print("unable to get alarm")
end
And with all the pieces together and in the right places, you get a somewhat crude but very usable message in Slack.
That message will look something like:
Level : minor
Serial : YB89388120-92123
Alert : Some UIM alert message text here that's interesting enough to post to Slack
Case : https://salesforce.com/_ui/search/ui/UnifiedSearchResults?searchType=2&sen=500&str=YB89388120-92123
I'd love feedback and suggestions for improvement.
Otherwise I hope this helps someone else.
-Garin