Lion Cipher Lab
Wire your scripts to alerts: a reusable notification pipeline
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Every monitoring script you write ends at the same cliff: it correctly detects the thing you care about — a new open port, a certificate with nine days left, a disk filling up — and then prints it to a terminal or a log file that no human is looking at. Detection without delivery is theatre. The finding that matters most is the one that fires at 3am on a holiday weekend, which is precisely when nobody is watching the screen, so the alert has to come to a person, not wait for one. This lab builds the missing half: a small, reusable, dependency-free notify.py that any of your scripts can import…
What you'll learn
- building a reusable, standard-library-only notify.py module with a notify(message, severity) function
- creating a Slack incoming webhook and a Discord webhook URL step by step, from scratch, with no prior account setup
- POSTing JSON to a webhook with urllib.request (Slack {"text": ...}, Discord {"content": ...}) and sending email with smtplib
- treating a webhook URL as a bearer secret: reading it from an environment variable, never hardcoding it, never committing it
- adding severity levels (info/warn/critical) so alerts can be routed and triaged instead of all looking the same
- stopping alert spam with a JSON dedupe + cooldown state file so a check that fires every 5 minutes doesn't page you 288 times a day
- failing gracefully: catching network errors, retrying with exponential backoff, and returning a non-zero exit code on give-up
- proving the payload with NO external account by pointing the webhook at a local python -m http.server listener
- wiring notify() into the nmap-diff / cert-expiry monitor and scheduling the whole thing with cron and schtasks
- judgment: alert on ACTIONABLE events only, and when to graduate from a homegrown notifier to PagerDuty / Opsgenie / Alertmanager
Steps in this lab
- The gap: your monitor detects, but it doesn't deliver
- Confirm Python 3 — and fix the secret rule in your head first
- Get a webhook URL — Slack and Discord, step by step
- Write notify.py — the reusable notifier (standard library only)
- Prove it with NO account — point the webhook at a local listener
- Arm it for real — set the secret in the environment, then send
- Wire it into a monitor and schedule the whole thing
- Alert fatigue, and when NOT to build this at all (reflection)