#!/bin/sh

. /etc/PG.conf

FLOWEYE="/usr/ramdisk/bin/floweye"
MSGPUSH="/usr/ramdisk/bin/ipe_msgpush"

ALERT_ENABLE=`${FLOWEYE} malc list | awk '{print $NF}' | grep 1`

[ "${ALERT_ENABLE}" = "" ] && exit 0

while true
do

    ${FLOWEYE} malc get logevent=1 | while read -r db time proto srcip srcport dstip dstport risk ioc user drop is_malicious is_apt local acct type family
    do

                dbid=`${FLOWEYE} malc list | awk -v db="${db}" '$2==db {print $1}'`
                name=`${FLOWEYE} malc list db=${dbid} | awk -v cname="${type}" '$2==cname {print $1}'`
                match_num=`${FLOWEYE} malc list db=${dbid} | awk -v cname="${type}" '$2==cname {print $7}'`
        filename="${PGETC}/${db}_malc.conf"

        [ -f "${filename}" ] && . ${filename}
                threshold=${!name:-0}
                [ ${threshold} -eq 0 ] && continue
                [ ${match_num} -le "${threshold}" ] && continue

        # Ϣ
        msg="%0aʱ:${time}%0a"
        msg="${msg}û:${user}"
        if [ "$acct" != "NULL" ]; then
            msg="${msg} [${acct}]%0a"
        else
            msg="${msg}%0a"
        fi
        msg="${msg}:${srcip}:${srcport} <-> ${dstip}:${dstport}%0a"
        msg="${msg}IOC:${ioc} [${family}]%0a"
        msg="${msg}鱨:${type}%0a"
        msg="${msg}:${risk}%0a"

        msg="${msg// /%20}"

        ${MSGPUSH} -s msg_title="в鱨澯" msg_ctx="${msg}" weixin_src=1 malc_alert=1
    done
        sleep 60
done