notifyd

Purpose

notifyd is a scheduler-and-worker daemon that sends alerts for two recurring security events: certificates approaching expiry, and TLS handshakes matching a known-malicious JA3 fingerprint. It uses asynq’s built-in cron-style scheduler to enqueue check tasks on a schedule, and a worker pool to process them and dispatch notifications over email (SMTP), Slack (webhook), or a generic webhook. Every notification sent is also logged to a ClickHouse notifications history table.

Usage

notifyd -c <config.yaml> [-debug]

Flag	Description
`-c`	Path to config file (required)
`-debug`	Enable debug logging

Configuration

name: notifyd

clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: insights
  password: "secret"

redis:
  host: localhost
  port: 6379
  password: ""
  db: 0

debug: false
concurrency: 3   # concurrent notification tasks, default 3 if unset/0

notifications:
  smtp_host: smtp.example.com
  smtp_port: 587
  smtp_user: notifications@example.com
  smtp_password: ""
  smtp_from: "EonCore Insights <notifications@example.com>"

  slack_webhook_url: ""

  cert_expiry_recipients:
    - security@example.com
    # - https://hooks.slack.com/services/xxx/yyy/zzz

  malware_recipients:
    - security@example.com
    - soc@example.com

scheduler:
  cert_expiry_schedule: "0 9 * * *"    # cron format
  cert_expiry_days: 30                  # alert for certs expiring within N days

  malware_schedule: "*/5 * * * *"       # cron format
  malware_minutes: 5                    # check handshakes from the last N minutes

Recipients can be plain email addresses (routed through SMTP) or webhook URLs (Slack or generic), mixed freely in the same list.

Cron schedule format

┌───────────── minute (0 - 59)
│ ┌───────────── hour (0 - 23)
│ │ ┌───────────── day of month (1 - 31)
│ │ │ ┌───────────── month (1 - 12)
│ │ │ │ ┌───────────── day of week (0 - 6)
│ │ │ │ │
* * * * *

Examples: "0 9 * * *" (daily at 9 AM), "*/5 * * * *" (every 5 minutes), "0 */4 * * *" (every 4 hours), "0 9 * * 1" (every Monday at 9 AM).

Example

# Run as a daemon
notifyd -c configs/notifyd.yaml

# Run with debug logging
notifyd -c configs/notifyd.yaml -debug

pcapworker sca