# Send Fail2Ban notifications to Slack, via the chat.postMessage API method
# Add your Slack API token and channel at end of this file
# Author: Gavin Botica
# gbotica@gmail.com

[Definition]
# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
actionstart = curl -s -o /dev/null 'https://slack.com/api/chat.postMessage' -d 'token=<slack_api_token>' -d 'channel=#<slack_channel>' -d 'parse=none' -d "text=:white_check_mark: *<fq-hostname>*: jail *<name>* started"

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
actionstop = curl -s -o /dev/null 'https://slack.com/api/chat.postMessage' -d 'token=<slack_api_token>' -d 'channel=#<slack_channel>' -d 'parse=none' -d "text=:negative_squared_cross_mark: *<fq-hostname>*: jail *<name>* stopped"

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
actionban = curl -s -o /dev/null 'https://slack.com/api/chat.postMessage' -d 'token=<slack_api_token>' -d 'channel=#<slack_channel>' -d 'parse=none' -d "text=:red_circle: *<fq-hostname>*: jail *<name>* BAN *<https://ipinfo.io/<ip>|<ip>>* for <failures> failure(s)"

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
actionunban = curl -s -o /dev/null 'https://slack.com/api/chat.postMessage' -d 'token=<slack_api_token>' -d 'channel=#<slack_channel>' -d 'parse=none' -d "text=:white_circle: *<fq-hostname>*: jail *<name>* UNBAN *<https://ipinfo.io/<ip>|<ip>>*"

[Init]
init = 'Sending notification to Slack'
slack_api_token = 
slack_channel =