hubblestack/pulsar

slack_pulsar returner

Closed this issue · 2 comments

I've been testing Pulsar with other returners, and I'd like to see a slack_pulsar.py returner. Sending returns through Slack currently doesn't include minion information, meaning it's impossible to identify the source. Example:

id: None
function: None
function args: None
jid: None
return: {'change': 'IN_MODIFY',
 'checksum': '434728a410a78f56fc1b5899c3593436e61ab0c731e9072d95e96db290205e53',
 'checksum_type': 'sha256',
 'name': 'h4x0r.pl',
 'path': '/usr/local/bin/h4x0r.pl',
 'stats': {'atime': 1468704250.6502364,
           'ctime': 1468704250.031237,
           'gid': 0,
           'group': 'root',
           'inode': 18096,
           'mode': '0644',
           'mtime': 1468704250.031237,
           'size': 8,
           'target': '/usr/local/bin/h4x0r.pl',
           'type': 'file',
           'uid': 0,
           'user': 'root'},
 'tag': '/usr/local/bin'}

This should be really simple to modify the existing returner to add this information. It will also be a good opportunity to drop some of the empty fields that pulsar doesn't provide, to clean up the output.

I think we're ready to close this.