I wanted to highlight this quick modification configuration to send this notification to a Discord channel.Īs always, happy logging with Graylog. Hopefully, it’s something new that you might want to try or just something you didn’t know about. The actual user is Jdar and the timestamp. It was a Graylog channel and is highlighted in red the actual SSH log on open to the long message that we built. What it did was send this to my individual channel. Some things are online to send tests from different endpoints, whether it be bash shell with curl or PowerShell or command prompt within DOS.Īs you’ll see, once we’ve built this out, my alerts are set up, the events are set up, and they’re happening because they’re being triggered. Going to our documentation, we find more advanced documentation regarding setting up Slack alerts and going through and creating the webhook and all this good stuff. Right within Graylog, whether it’s a Slack notification or this modified Slack notification to transmit to Discord, you can trigger it and test it to ensure that it’s working. As you’ll see here down below, there is an execute test notification.

That will be transmitted, and Discord will take that notification as a Slack-type message integration and build it out. If you have a server that is very important (for example work related or competition related), having the red notification on the app icon would be very useful. (I alsove found another bug but I think its gone now, but if its not then -> When I got notification. Paste the entire URL in here, but at the end of it, put forward-slash Slack. Discord app is up-to-date and idk what to do else. You copy that URL, and you paste it in here except for one small twist. Once you’ve selected the channel… In my case, I’ve used Graylog as the channel. Make me a push notification icon in png format for an app I am making. In the webhook URL, what you would do is in the Discord channel, edit the channel and add an integration for a webhook. Then I’ve gone into the notifications and created an actual notification called SSH session open too long as a Slack notification, colored it red. I’ve created an alert, and I include some fields here for the user string to know who the user was. If that does not happen for that particular unique connection or that unique situation, send an alert.

The two events are one SSH session open and an SSH session closed. I’ve created a correlation, and that correlation is set up to look at a sequence of events that must be satisfied within 16 minutes. I want to go into here under the SSH log on open too long definition. So I can actually demonstrate this, for example. This is more of just a triggered event for a correlation event. In that, I wanted to create an event that said, if someone logs in and they’re logged in for more than 16 minutes, I want to know about it.

Discord server notification icon