jessefmoore / PingCastle-Notify

Send the result of a PingCastle scan into Slack and highlight the rule diff between two scans

PingCastle Notify

PingCastle Notify will run a PingCastle scan, compare the difference between a previous scan, highlight the diff and send the result into a Slack channel. The slack message will notify you regarding the different states: correction, recession etc

---

▶️ First scan

▶️ No new vulnerability but some rules have been updated

▶️ New vulnerabilty

▶️ Some vulnerability have been removed

▶️ No new vulnerability

No result in slack since reports are the same

How to install ?

Structure of the project

SECU-TOOL-SCAN/
    - PingCastle-Notify.ps1
    - PingCastle/
        - Reports/
            - domain.local.xml
            - domain.local.html
        - Pingcastle.exe
        - ...

PingCastle & PingCastle-Notify.ps1

1. Download PingCastle
2. Unzip the archive
3. Create a "Reports" folder inside the PingCastle folder
4. Download and add the file PingCastle-Notify.ps1 on the parent directory

Create a Slack application

1. In Slack create an application https://api.slack.com/apps
2. Add the following rights
   • Click on "Add features and functionality" -> Bots (configure the name)
   • Click on "Add features and functionality" -> Permissions (add the following permissions)
   • Generate a "Bot User OAuth Token" on the Permissions tab

3. Get your token add it to the PingCastle-Notify.ps1 script
4. Create a slack channel and add your bot user to the channel
5. You can test your bot using https://api.slack.com/methods/chat.postMessage/test
6. Add the channel to the script
7. Run the script to test using this command: powershell.exe -exec bypass C:\YOUR_PATH\SECU-TOOL-SCAN\PingCastle-Notify.ps1

Deploy a Scheduled Task

On your Windows Server go to

1. Create a service account that will run the PS1 script every night
2. Give privileges to the service account on the folder "Reports"

3. Run taskschd.msc to open the Scheduler Task
4. Create a Task and use the service account you just created
5. Give the permission "Log on as Batch Job" to service account https://danblee.com/log-on-as-batch-job-rights-for-task-scheduler/
6. Run the scheduled task to test the result
7. Enjoy :)

Acknowledgement

• Vincent Le Toux - https://twitter.com/mysmartlogon
• Romain Tiennot - https://github.com/aikiox
• Lilian Arago - https://github.com/NahisWayard

License

MIT License