How to enable e-mail alerts via hooks or notifications in ImunifyAV+

Issue

How to enable e-mail notifications via hooks or notification subsystem in ImunifyAV+.

Environment

• ImunifyAV+
• cPanel
• DirectAdmin

Solution

Note: hooks are deprecated. We recommend using notifications-config instead.

ImunifyAV/AV+ provides a hooks system configuration. Hooks can be configured via the separate UI “Notifications” tab in the Settings, or via the command-line interface (CLI).
https://docs.imunify360.com/imunifyav/#notifications

1. Create a simple script that will send email to your email box in a directory that Imunify has access to, for example, /etc/imunify360 or /home/myhook: 

Script for notification subsystem.

#!/bin/bash
data=$(cat)
event=$(jq -r '.event_id' <<< ${data})
case ${event} in
    CUSTOM_SCAN_MALWARE_FOUND)
      total_malicious=$(jq -r '.total_malicious' <<<${data})
      malicious_files=$(jq -r '.malicious_files[]' <<<${data})
      path=$(jq -r '.path' <<< ${data})
      echo "The path $path was scanned and there are $total_malicious malisious files were found: ${malicious_files}" | mail -s malware-detected-dda [e-mail]
      ;;
    USER_SCAN_MALWARE_FOUND)
      total_malicious=$(jq -r '.total_malicious' <<<${data})
      malicious_files=$(jq -r '.malicious_files[]' <<<${data})
      path=$(jq -r '.path' <<< ${data})
      echo "The path $path was scanned and there are $total_malicious malisious files were found: ${malicious_files}" | mail -s malware-detected-dda [e-mail]
      ;;
esac

Script for hooks subsystem

#!/bin/bash

data=$(cat)
event=$(jq -r '.event' <<< ${data})
subtype=$(jq -r '.subtype' <<< ${data})

case ${event} in
    malware-detected)
        case ${subtype} in
            critical)
            path=$(jq -r '.params.path' <<< ${data})
            total_malicious=$(jq -r '.params.total_malicious' <<< ${data})
            echo "The path $path was scanned and there are $total_malicious  malisious files were found"  | mail -s malware-detected-dda [e-mail]
            ;;
        esac
esac

 2. Add execution permission for your hook script

chmod +x /home/myhook 

3. Add this path to the necessary hook, for instance: ImunifyAV+ >>Settings>>Notifications>>"User scan: malware detected".

/home/myhook

https://docs.imunify360.com/imunifyav/#notifications
4. Perform a restart of an imunify-notifier service:     

systemctl restart imunify-notifier

Related logs available in journald:

journalctl -u imunify-notifier

Please, do not create a script in /root folder.

Useful links

• https://docs.imunifyav.com/imunifyav/#notifications
• https://docs.imunifyav.com/cli/#example-of-script-to-create-custom-scripts-to-use-with-notifications-config