import dotenv import os import requests dotenv.load_dotenv() def teamswebhook(victimname, date_discovered, domain, group, ip_address, description): webhook_url = os.getenv('WEBHOOK_URL') headers = {"Content-Type": "application/json"} adaptive_card = { "type": "AdaptiveCard", "body": [ { "type": "TextBlock", "size": "Medium", "weight": "Bolder", "text": "Ransomware.live Alert!" }, { "type": "ColumnSet", "columns": [ { "type": "Column", "items": [ { "type": "TextBlock", "weight": "Bolder", "text": f"{victimname}", "wrap": "true" }, { "type": "TextBlock", "spacing": "None", "text": f"{date_discovered}", "isSubtle": "true", "wrap": "true" } ], "width": "stretch" } ] }, { "type": "TextBlock", "text": f"{description}", "wrap": "true" }, { "type": "ColumnSet", "separator": "true", "columns": [ { "type": "Column", "width": "stretch", "items": [ { "type": "TextBlock", "text": "Domain", "wrap": "true" } ] }, { "type": "Column", "width": "stretch", "items": [ { "type": "TextBlock", "text": f"{domain}", "wrap": "true" } ] } ] }, { "type": "ColumnSet", "columns": [ { "type": "Column", "width": "stretch", "items": [ { "type": "TextBlock", "text": "IP Addresses", "wrap": "true" } ] }, { "type": "Column", "width": "stretch", "items": [ { "type": "TextBlock", "text": f"{ip_address}", "wrap": "true" } ] } ] }, { "type": "ColumnSet", "columns": [ { "type": "Column", "width": "stretch", "items": [ { "type": "TextBlock", "text": "Ransomware Group", "wrap": "true" } ] }, { "type": "Column", "width": "stretch", "items": [ { "type": "TextBlock", "text": f"{group}", "wrap": "true" } ] } ] } ], "$schema": "http://adaptivecards.io/schemas/adaptive-card.json", "version": "1.6" } payload = { "card": adaptive_card } response = requests.post(webhook_url, headers=headers, json=payload) if response.ok: print("✅ Card sent to Teams successfully!") else: print(f"❌ Failed to send card: {response.status_code} - {response.text}")