Ransomware Feed Slackbot

The Ransomware Feed Slackbot is a Python-based bot that fetches real-time updates on new ransomware victims and their affected entities from a JSON feed and posts the information in a specified Slack channel. The bot allows you to stay informed about the latest ransomware incidents and receive timely alerts on significant events.

Features

• Fetches data from a JSON feed: The bot retrieves ransomware news data from a specified JSON feed hosted on GitHub.

• Customizable alert mentions: The bot uses custom logic to determine if specific entities or known members are affected by the ransomware group, and it triggers an alert with a <!channel> mention to notify relevant team members.

• Slack integration: The bot uses the Slack API to post formatted messages with the latest ransomware victim information in a designated Slack channel.

• Timestamp tracking: The bot keeps track of the last processed timestamp to ensure that it only posts updates for new ransomware victims since the last check.

Getting Started

Prerequisites

• Python 3.7 or higher
• requests library: You can install it using pip install requests.

Installation

1. Clone this repository to your local machine:

git clone https://github.com/yourusername/ransomware-feed-slackbot.git

2. CD into the new directory

cd ransomware-feed-slackbot

3. Install the required dependencies:

pip install -r requirements.txt

Configuration Before running the bot, you need to configure your Slack Bot Token and specify the Slack channel where you want to post updates.

Create a new Slack bot and obtain the Bot Token. Follow Slack's documentation on how to create a bot and get the Bot Token: Creating a new bot user.

Update the SLACK_BOT_TOKEN and SLACK_CHANNEL variables in main.py with your Bot Token and the target Slack channel, respectively.

Usage Run the bot with the following command:

python slackRansomwareFeed.py

The bot will start fetching the latest ransomware victims from the specified JSON feed and post updates in the Slack channel. It will continue to check for new victims every hour.

Customization You can customize the bot to fit your specific requirements:

Modify the format_message function in slackRansomwareFeed.py to change the message format and mentions based on your organization's needs.

Adjust the timestamp tracking logic if you want to change how the bot determines the last processed timestamp.

Update the known members list in the format_message function with the entities you want to trigger special mentions for.

Feel free to contribute, report issues, or suggest enhancements. Happy coding!