First Commit

2025-07-29 10:51:21 -04:00
commit 67330e4017
5 changed files with 223 additions and 0 deletions
@@ -0,0 +1,145 @@
+import dotenv
+import os
+import requests
+dotenv.load_dotenv()
+
+def teamswebhook(victimname, date_discovered, domain, group, ip_address, description):
+    webhook_url = os.getenv('WEBHOOK_URL')
+
+    headers = {"Content-Type": "application/json"}
+
+    adaptive_card = {
+    "type": "AdaptiveCard",
+    "body": [
+        {
+            "type": "TextBlock",
+            "size": "Medium",
+            "weight": "Bolder",
+            "text": "Ransomware.live Alert!"
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "weight": "Bolder",
+                            "text": f"{victimname}",
+                            "wrap": "true"
+                        },
+                        {
+                            "type": "TextBlock",
+                            "spacing": "None",
+                            "text": f"{date_discovered}",
+                            "isSubtle": "true",
+                            "wrap": "true"
+                        }
+                    ],
+                    "width": "stretch"
+                }
+            ]
+        },
+        {
+            "type": "TextBlock",
+            "text": f"{description}",
+            "wrap": "true"
+        },
+        {
+            "type": "ColumnSet",
+            "separator": "true",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "Domain",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{domain}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "IP Addresses",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{ip_address}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "Ransomware Group",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{group}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        }
+    ],
+    "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
+    "version": "1.6"
+}
+
+    payload = {
+        "card": adaptive_card
+    }
+
+    response = requests.post(webhook_url, headers=headers, json=payload)
+
+    if response.ok:
+        print("✅ Card sent to Teams successfully!")
+    else:
+        print(f"❌ Failed to send card: {response.status_code} - {response.text}")