topic Re: Smartevent automatic reaction external script in General Topics

Smartevent automatic reaction external script

dehaasm — Wed, 26 Jul 2023 12:13:23 GMT

For smartevents server we would like to implement an external script for automatic reaction on correlated events and to send this event to syslog.

Now i found this article

https://community.checkpoint.com/t5/Management/SmartEvent-External-Script-for-Mail/td-p/78994#

So for my use case i would need something like this, we just want to send the entire event via syslog using Automatic Reaction

[Expert@checkpoint-management:0]# cat $RTDIR/bin/ext_commands/automaticreactionsyslog #!/bin/bash INPUT=$(cat); EVENT="${INPUT//[^a-zA-Z0-9 ().,:;+_-]}"; logger ......;

Does someone here perhaps has any guidence on how to achieve this?

Re: Smartevent automatic reaction external script

PhoneBoy — Wed, 26 Jul 2023 14:23:01 GMT

The automatic reaction script should receive all the details on stdin.
Which means your script will simply need to parse that data and take whatever action is desired.

Re: Smartevent automatic reaction external script

dehaasm — Wed, 26 Jul 2023 14:47:53 GMT

Yes so i guess above script is a good script to start with? I just have to define the syslog action with command logger correct?

I believe these two will collect the event data and then I should include $EVENT in logger command as the data to be send?

INPUT=$(cat);
EVENT="${INPUT//[^a-zA-Z0-9 ().,:;+_-]}";

Re: Smartevent automatic reaction external script

PhoneBoy — Wed, 26 Jul 2023 16:50:52 GMT

That's what it looks like to me.