Package: rnotify
rnotifyTable of ContentsAboutInstallationUsageAboutOperators use several tools to perform internal security assessments. These tools can be difficult to track remotely and have output that is time sensitive. The tool rnotify tries to solve this problem. Some example use cases are listed below:Monitor hashcat process and notify when cracking job is completedMonitor folder for hashes captured using ResponderMonitor and notify on computer account creation when using mitm6 and ntlmrelayxNotify when password spraying job completesFollowing a change to the monitoried object, the tool can then notify using a webhook for the following communication platforms:SlackMS TeamsDiscordInstallationThe project can be installed using pipx:pipx install rnotifyUsageThe tool is only useable on Unix based operating systems. The utility can be called using the commandrnotifyorrnand can monitor:File changesNew files added to a folderProcess exit (PID)Usage: rn [OPTIONS] COMMAND [ARGS]...

  Notify on arbitrary filesystem events and process state changes.

Options:
  --help  Show this message and exit.

Commands:
  file    Notify on file changes
  folder  Notify on directory changes
  pid     Notify on process changesAll modules require the specificiation of the following options:Webhook URL used for notificationsNotification provider associated with the provided webhookTarget to monitor (file, folder, pid)All modules optionally allow the specification of the following options:Daemonization of the utility to run rnotify in the backgroundSleep interval used by tool when checking for changesConfiguration file in the format shown belowwebhook = 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'
target = '/tmp/screen.log'
notifier = 'slack'
create_daemon = 'True'File MonitoringFile changes can be monitored using thefilesubcommand:Usage: rn file [OPTIONS] TARGET

  Notify on file changes

Options:
  -w, --webhook TEXT              Webhook URL  [required]
  -n, --notifier [teams|slack|discord]
                                  Notification provider.  [required]
  -f, --filter TEXT               Filter changes by string.
  -s, --sleep INTEGER             Sleep time between checks  [default: 5]
  -d, --daemon                    Daemonize the utility
  --config FILE                   Read configuration from FILE.
  -h, --help                      Show this message and exit.Changes to logfiles can be filtered using the-fflag.Folder MonitoringFolder changes can be monitored using thefoldersubcommand:Usage: rn folder [OPTIONS] TARGET

  Notify on directory changes

Options:
  -w, --webhook TEXT              Webhook URL  [required]
  -d, --daemon                    Daemonize the utility
  -n, --notifier [teams|slack|discord]
                                  Notification provider.  [required]
  -s, --sleep INTEGER             Sleep time between checks  [default: 5]
  --config FILE                   Read configuration from FILE.
  -h, --help                      Show this message and exit.PID MonitoringProcess exits can be monitored using thepidsubcommand:Usage: rn pid [OPTIONS] TARGET

  Notify on process changes

Options:
  -w, --webhook TEXT              Webhook URL  [required]
  -n, --notifier [teams|slack|discord]
                                  Notification provider.  [required]
  -s, --sleep INTEGER             Sleep time between checks  [default: 5]
  -d, --daemon                    Daemonize the utility
  --config FILE                   Read configuration from FILE.
  -h, --help                      Show this message and exit.Usage examplesWatch Responder logs folder in the foreground:rn folder /opt/Responder/logs -w https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX -n slackWatch for hashcat process to stop in the background:rn pid 54782 -w https://hooks.teams.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX -n teams -dWatch for changes to gnu screen log with a filter in the foreground:rn file /top/screen.log -f Account -w https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX -n slack