Event Callback

The EventCallback function allows notifications about various events. At the moment, only the new agent registration event is implemented.

new_agent_message - register new agent events:

• %type% - Agent type

• %id% - Agent ID

• %user% - Username

• %computer% - Computer

• %domain% - Domain name

• %pid% - Process ID

• %internalip% - Internal IPv4 address

• %externalip% - External IPv4 address

• %elevated% - true, if the agent has high context

Telegram

To send events to Telegram, in the EventCallback.Telegram configuration, you need to specify the bot token, as well as the chat ID to which the bot will send the message.

  "EventCallback": {
    "Telegram": {
      "token": "number:token",
      "chats_id": ["id1","id2",...]
    },
    "new_agent_message": "New agent: %type% (%id%)\n\n%user% @ %computer% (%internalip%)\nelevated: %elevated%\nfrom: %externalip%\ndomain: %domain%"
  }

Create BOT

1. Go to the official @BotFather bot in Telegram and create your own bot. The API token will be shown for the created bot.

1. Go to the created bot, activate the chat and send it any test message.

2. Make a request to the Telegram API, specifying your token. The response will contain your test message and chat ID (which you will need to specify in the config)

curl https://api.telegram.org/bot<TOKEN_HERE>/getUpdates | jq

If you want the bot to write to a group: add the bot to the group, assign the administrator role and write a test message to the group. Getting the chat ID is the same as for the user account.