Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 32 additions & 4 deletions docs/scanning/output.md
Original file line number Diff line number Diff line change
Expand Up @@ -88,43 +88,56 @@ mail.evilcorp.com

![bbot-discord](https://github.com/blacklanternsecurity/bbot/assets/20261699/6d88045c-8eac-43b6-8de9-c621ecf60c2d)

BBOT supports output via webhooks to `discord`, `slack`, and `teams`. To use them, you must specify a webhook URL either in the config:
BBOT supports output via webhooks to `discord`, `slack`, and `teams`. To use them, you need to enable the output module and configure a webhook URL.

Via preset:

```yaml title="discord_preset.yml"
output_modules:
- discord

config:
modules:
discord:
webhook_url: https://discord.com/api/webhooks/1234/deadbeef
```

...or on the command line:
Via command line:

```bash
bbot -t evilcorp.com -om discord -c modules.discord.webhook_url=https://discord.com/api/webhooks/1234/deadbeef
```

By default, only `FINDING` events are sent, but this can be customized by setting `event_types` in the config like so:

```yaml title="discord_preset.yml"
output_modules:
- discord

config:
modules:
discord:
webhook_url: https://discord.com/api/webhooks/1234/deadbeef
event_types:
- FINDING
- STORAGE_BUCKET
```

...or on the command line:
```bash
bbot -t evilcorp.com -om discord -c modules.discord.event_types=["STORAGE_BUCKET","FINDING"]
bbot -t evilcorp.com -om discord -c modules.discord.webhook_url=https://discord.com/api/webhooks/1234/deadbeef -c modules.discord.event_types=["STORAGE_BUCKET","FINDING"]
```

You can also filter on the severity of `FINDING` events by setting `min_severity`:


```yaml title="discord_preset.yml"
output_modules:
- discord

config:
modules:
discord:
webhook_url: https://discord.com/api/webhooks/1234/deadbeef
min_severity: HIGH
```

Expand All @@ -140,6 +153,9 @@ bbot -t evilcorp.com -om webhook -c modules.webhook.url=http://localhost:8000
You can customize the HTTP method if needed. Authentication is also supported:

```yaml title="webhook_preset.yml"
output_modules:
- webhook

config:
modules:
webhook:
Expand Down Expand Up @@ -173,6 +189,9 @@ bbot -t evilcorp.com -om elastic -c \
Alternatively, via a preset:

```yaml title="elastic_preset.yml"
output_modules:
- elastic

config:
modules:
elastic:
Expand All @@ -187,6 +206,9 @@ The `splunk` output module sends [events](events.md) in JSON format to a desired
You can customize this output with the following config options:

```yaml title="splunk_preset.yml"
output_modules:
- splunk

config:
modules:
splunk:
Expand Down Expand Up @@ -229,6 +251,9 @@ bbot -t evilcorp.com -om postgres -c modules.postgres.database=custom_bbot_db
```

```yaml title="postgres_preset.yml"
output_modules:
- postgres

config:
modules:
postgres:
Expand All @@ -249,6 +274,9 @@ bbot -t evilcorp.com -om mysql -c modules.mysql.database=custom_bbot_db
```

```yaml title="mysql_preset.yml"
output_modules:
- mysql

config:
modules:
mysql:
Expand Down
Loading