From 824082e8099d979eb820520d31ad8f3741742622 Mon Sep 17 00:00:00 2001
From: ygalnezri <ygalnezri@icloud.com>
Date: Wed, 18 Dec 2024 17:09:56 +0100
Subject: [PATCH] Fix minor bugs, resolve TheHive observables creation issue,
 and add group notifications

- Fixed a minor bug .

- Addressed an issue with the creation of observables in TheHive.

- Added support for group notifications.
---
 Watcher/Watcher/common/core.py                | 369 +++++++++++++++---
 .../mail_template/data_leak_group_template.py |   2 +-
 .../mail_template/data_leak_template.py       |   2 +-
 .../dns_finder_cert_transparency.py           |   2 +-
 .../dns_finder_group_template.py              |   2 +-
 .../mail_template/dns_finder_template.py      |   2 +-
 .../mail_template/site_monitoring_template.py |   4 +-
 .../mail_template/threats_watcher_template.py |   2 +-
 .../common/utils/send_thehive_alerts.py       |  16 +-
 .../Watcher/common/utils/update_thehive.py    |   7 +-
 Watcher/Watcher/data_leak/core.py             |  65 +--
 Watcher/Watcher/dns_finder/core.py            |  65 ++-
 Watcher/Watcher/site_monitoring/core.py       |  14 +-
 Watcher/Watcher/threats_watcher/core.py       |   2 +-
 14 files changed, 403 insertions(+), 151 deletions(-)

diff --git a/Watcher/Watcher/common/core.py b/Watcher/Watcher/common/core.py
index 4aacc5f..61fe71c 100644
--- a/Watcher/Watcher/common/core.py
+++ b/Watcher/Watcher/common/core.py
@@ -10,16 +10,17 @@
 from secrets import token_hex  
 from .mail_template.threats_watcher_template import get_threats_watcher_template
 from .mail_template.data_leak_template import get_data_leak_template
+from .mail_template.data_leak_group_template import get_data_leak_group_template
 from .mail_template.site_monitoring_template import get_site_monitoring_template
 from .mail_template.dns_finder_template import get_dns_finder_template
 from .mail_template.dns_finder_cert_transparency import get_dns_finder_cert_transparency_template
+from .mail_template.dns_finder_group_template import get_dns_finder_group_template
+from .utils.send_thehive_alerts import send_thehive_alert
 
 
 def generate_ref():
     """
-    Generates a unique 'sourceRef' identifier for an alert.
-    
-    :return: Unique identifier as a string.
+    Generate unique 'sourceRef' for an alert.
     """
     ref = datetime.now().strftime("%y%m%d") + "-" + str(token_hex(3))[:5]
     return ref
@@ -50,13 +51,21 @@ def generate_ref():
         'channel': settings.SLACK_CHANNEL,
         'url_suffix': '#data_leak',
     },
+    'data_leak_group': {
+        'content_template': (
+            "*[{alerts_number} ALERTS] 🚨 Data Leak 🚨*\n\n"
+            "Dear team,\n\n"
+            "*{alerts_number}* new data leakage alerts have been detected for the keyword *{keyword}*\n\n"
+            "Please, find more details <{details_url}|here>."
+        ),
+        'channel': settings.SLACK_CHANNEL,
+        'url_suffix': '#data_leak',
+    },
     'website_monitoring': {
         'content_template': (
-            "*[SITE MONITORING - INCIDENT] 🔔 {alert_type} on {domain_name} 🔔*\n\n"
+            "*[SITE MONITORING - INCIDENT #{ticket_id}] 🔔 {alert_type} on {domain_name} 🔔*\n\n"
             "Dear team,\n\n"
             "Please find the new incident detected below:\n\n"
-            "*• Type of alert:* {alert_type}\n"
-            "*• Domain name:* {domain_name}\n"
             "*• Difference Score:* {difference_score}\n"
             "*• New Ip:* {new_ip}\n"
             "*• Old Ip:* {old_ip}\n"
@@ -85,16 +94,27 @@ def generate_ref():
         'channel': settings.SLACK_CHANNEL,
         'url_suffix': '#/dns_finder/',
     },
+    'dns_finder_group': {
+        'content_template': (
+            "*[{alerts_number} ALERTS] 🚨 DNS Finder 🚨*\n\n"
+            "Dear team,\n\n"
+            "*{alerts_number}* New DNS Twisted Alerts for *{dns_monitored.domain_name}* asset.\n\n"
+            "Please, find more details <{details_url}|here>."
+        ),
+        'channel': settings.SLACK_CHANNEL,
+        'url_suffix': '#/dns_finder/',
+    },
 }
 
+
 # Configuration for Citadel
 APP_CONFIG_CITADEL = {
     'threats_watcher': {
         'content_template': (
-            "<p><strong>[THREATS WATCHER - WARNING] 🔥 Trendy Threats Detected 🔥</strong></p>"
+            "<p><strong><h4>[THREATS WATCHER - WARNING] 🔥 Trendy Threats Detected 🔥</h4></strong></p>"
             "<p>Dear team,</p>"
-            "<p>Please find the new trendy word(s) detected below:\n</p>"
-            "<ul><strong>{words_list}</strong></ul>\n"
+            "<p>Please find the new trendy word(s) detected below:</p>"
+            "<ul><strong>{words_list}</strong></ul>"
             "<p>Please, find more details <a href='{details_url}'>here</a>.</p>"
         ),
         'citadel_room_id': settings.CITADEL_ROOM_ID,
@@ -102,26 +122,34 @@ def generate_ref():
     },
     'data_leak': {
         'content_template': (
-            "<p><strong>[DATA LEAK - ALERT #{alert_pk}] 🔔 Data Leak Detected: {keyword_name} 🔔</strong></p>"
+            "<p><strong><h4>[DATA LEAK - ALERT #{alert_pk}] 🔔 Data Leak Detected: {keyword_name} 🔔</h4></strong></p>"
             "<p>Dear team,</p>"
-            "<p>New Data Leakage Alert for {keyword_name} keyword:</p>\n"
+            "<p>New Data Leakage Alert for {keyword_name} keyword:</p>"
             "<ul>"
             "<li><strong>Keyword:</strong> {keyword_name}</li>"
-            "<li><strong>Source:</strong> {url}</li>\n"
+            "<li><strong>Source:</strong> {url}</li>"
             "</ul>"
             "<p>Please, find more details <a href='{details_url}'>here</a>.</p>"
         ),
         'citadel_room_id': settings.CITADEL_ROOM_ID,
         'url_suffix': '#data_leak',
     },
+    'data_leak_group': {
+        'content_template': (
+            "<p><strong><h4>[{alerts_number} ALERTS] 🚨 Data Leak 🚨</h4></strong></p>"
+            "<p>Dear team,</p>"
+            "<p><strong>{alerts_number}</strong> new data leakage alerts have been detected for the keyword <strong>{keyword}</strong>.</p>"
+            "<p>Please, find more details <a href='{details_url}'>here</a>.</p>"
+        ),
+        'citadel_room_id': settings.CITADEL_ROOM_ID,
+        'url_suffix': '#data_leak',
+    },
     'website_monitoring': {
         'content_template': (
-            "<p><strong>[SITE MONITORING - INCIDENT] 🔔 {alert_type} on {domain_name} 🔔</strong></p>"
+            "<p><strong><h4>[SITE MONITORING - INCIDENT #{ticket_id}] 🔔 {alert_type} on {domain_name} 🔔</h4></strong></p>"
             "<p>Dear team,</p>"
-            "<p>Please find the new incident detected below:</p>\n"
+            "<p>Please find the new incident detected below:</p>"
             "<ul>"
-            "<li><strong>Type of alert:</strong> {alert_type}</li>"
-            "<li><strong>Domain name:</strong> {domain_name}</li>"
             "<li><strong>Difference Score:</strong> {difference_score}</li>"
             "<li><strong>New Ip:</strong> {new_ip}</li>"
             "<li><strong>Old Ip:</strong> {old_ip}</li>"
@@ -130,7 +158,7 @@ def generate_ref():
             "<li><strong>New MX Records:</strong> {new_mx_records}</li>"
             "<li><strong>Old MX Records:</strong> {old_mx_records}</li>"            
             "<li><strong>New Mail Server:</strong> {new_mail_A_record_ip}</li>"
-            "<li><strong>Old Mail Server:</strong> {old_mail_A_record_ip}</li>\n"
+            "<li><strong>Old Mail Server:</strong> {old_mail_A_record_ip}</li>"
             "</ul>"
             "<p>Please, find more details <a href='{details_url}'>here</a>.</p>"
         ),
@@ -139,9 +167,9 @@ def generate_ref():
     },
     'dns_finder': {
         'content_template': (
-            "<p><strong>[DNS FINDER - ALERT #{alert.pk}] 🚨 Suspicious DNS Detected: {alert.dns_twisted.domain_name} 🚨</strong></p>"
+            "<p><strong><h4>[DNS FINDER - ALERT #{alert.pk}] 🚨 Suspicious DNS Detected: {alert.dns_twisted.domain_name} 🚨</h4></strong></p>"
             "<p>Dear team,</p>"
-            "<p>New Twisted DNS found:</p>\n"
+            "<p>New Twisted DNS found:</p>"
             "<ul>"
             "<li><strong>Twisted DNS:</strong> {alert.dns_twisted.domain_name}</li>"
             "<li><strong>Corporate Keyword:</strong> {alert.dns_twisted.keyword_monitored}</li>"
@@ -153,8 +181,19 @@ def generate_ref():
         'citadel_room_id': settings.CITADEL_ROOM_ID,
         'url_suffix': '#/dns_finder/',
     },
+    'dns_finder_group': {
+        'content_template': (
+            "<p><strong><h4>[{alerts_number} ALERTS] 🚨 DNS Finder 🚨</h4></strong></p>"
+            "<p>Dear team,</p>"
+            "<p><strong>{alerts_number}</strong> New DNS Twisted Alerts for <strong>{dns_monitored.domain_name}</strong> asset.</p>"
+            "<p>Please, find more details <a href='{details_url}'>here</a>.</p>"
+        ),
+        'citadel_room_id': settings.CITADEL_ROOM_ID,
+        'url_suffix': '#/dns_finder/',
+    },
 }
 
+
 # Configuration for TheHive
 APP_CONFIG_THEHIVE = {
     'threats_watcher': {
@@ -191,7 +230,7 @@ def generate_ref():
             "*• New Ip Second:* {new_ip_second}\n"
             "*• Old IP Second:* {old_ip_second}\n"
             "*• New MX Records:* {new_mx_records}\n"
-            "*• Old MX Records:* {old_mx_records}\n"            
+            "*• Old MX Records:* {old_mx_records}\n"
             "*• New Mail Server:* {new_mail_A_record_ip}\n"
             "*• Old Mail Server:* {old_mail_A_record_ip}\n"
         ),
@@ -221,28 +260,35 @@ def generate_ref():
         'template_func': get_threats_watcher_template,
     },
     'data_leak': {
-        'subject': "[ALERT] Data Leak Detected",
+        'subject': "[ALERT #{alert_pk}] Data Leak",
         'template_func': get_data_leak_template,
     },
+    'data_leak_group': {
+        'subject': "[{alerts_number} ALERTS] Data Leak",
+        'template_func': get_data_leak_group_template,
+    },
     'website_monitoring': {
-        'subject': "[ALERT] Website Monitoring Detected",
+        'subject': '[' + settings.EMAIL_SUBJECT_TAG_SITE_MONITORING + ' #{ticket_id}] Website Monitoring Detected',
         'template_func': get_site_monitoring_template,
     },
     'dns_finder': {
-        'subject': "[ALERT] DNS Finder",
+        'subject': "[ALERT #{alert.pk}] DNS Finder",
         'template_func': get_dns_finder_template,
     },
     'dns_finder_cert_transparency': {
-        'subject': "[ALERT] DNS Finder",
+        'subject': "[ALERT #{alert.pk}] DNS Finder",
         'template_func': get_dns_finder_cert_transparency_template,
     },
+    'dns_finder_group': {
+        'subject': "[{alerts_number} ALERTS] DNS Finder",
+        'template_func': get_dns_finder_group_template,
+    },
 }
 
 
-
 def collect_observables(app_name, context_data):
     """
-    Collect observables specific to each app based on the context data provided.
+    Collect observables based on app and context data.
     """
     observables = []
 
@@ -266,12 +312,10 @@ def collect_observables(app_name, context_data):
                 observables.append({"dataType": "ip", "data": alert_data['new_ip_second']})
             if alert_data.get('old_ip_second'):
                 observables.append({"dataType": "ip", "data": alert_data['old_ip_second']})     
-            if alert_data.get('new_mx_records'):
-                for mx_record in alert_data['new_mx_records']:
-                    observables.append({"dataType": "domain", "data": mx_record})
-            if alert_data.get('old_mx_records'):
-                for mx_record in alert_data['old_mx_records']:
-                    observables.append({"dataType": "domain", "data": mx_record})
+            if alert_data.get('new_MX_records'):
+                observables.append({"dataType": "other", "data": alert_data['new_MX_records']})
+            if alert_data.get('old_MX_records'):
+                observables.append({"dataType": "other", "data": alert_data['old_MX_records']})
             if alert_data.get('new_mail_A_record_ip'):
                 observables.append({"dataType": "ip", "data": alert_data['new_mail_A_record_ip']})
             if alert_data.get('old_mail_A_record_ip'):
@@ -294,21 +338,23 @@ def collect_observables(app_name, context_data):
             if alert.dns_twisted.fuzzer:
                 observables.append({"dataType": "other", "data": alert.dns_twisted.fuzzer})
 
+    observables = [observable for observable in observables if observable['data'] is not None and observable['data'] != 'None']
+
     return observables
 
 
 def remove_html_tags(text):
-    """Remove HTML tags from a text."""
+    """
+    Remove HTML tags from a string.
+    """
     clean = re.compile('<.*?>')
     return re.sub(clean, '', text)
 
 
 def send_app_specific_notifications(app_name, context_data, subscribers):
-    from .utils.send_thehive_alerts import send_thehive_alert
-
     """
-    Send notifications based on the application type (Slack, Citadel, TheHive cases & alerts, Email).
-    Collect observables, format the notification content, and send them to respective channels.
+    Send notifications based on app type (Slack, Citadel, TheHive, Email).
+    Collect observables, format content, and send to respective channels.
     """
     app_config_slack = APP_CONFIG_SLACK.get(app_name)
     app_config_citadel = APP_CONFIG_CITADEL.get(app_name)
@@ -347,26 +393,24 @@ def send_notification(channel, content_template, subscribers_filter, send_func,
             email_words = context_data.get('email_words', [])
             email_body = get_threats_watcher_template(settings.WORDS_OCCURRENCE, email_words)
 
-
         elif app_name == 'website_monitoring':
             site = context_data.get('site')
             alert_data = context_data.get('alert_data', {})
             if not site:
                 return
             common_data = {
-                'alert_type': alert_data.get('type', 'None'),
+                'ticket_id': site.ticket_id,
+                'alert_type': alert_data.get('type', None),
                 'domain_name': site.domain_name,
-                'difference_score': alert_data.get('difference_score', 'None'),
-                'new_ip': alert_data.get('new_ip', 'None'),
-                'old_ip': alert_data.get('old_ip', 'None'),
-                'new_ip_second': alert_data.get('new_ip_second', 'None'),
-                'old_ip_second': alert_data.get('old_ip_second', 'None'),
-                'new_mx_records': alert_data.get('new_MX_records', 'None'),
-                'old_mx_records': alert_data.get('old_MX_records', 'None'),
-                'new_mail_A_record_ip': alert_data.get('new_mail_A_record_ip', 'None'),
-                'old_mail_A_record_ip': alert_data.get('old_mail_A_record_ip', 'None'),
-                'web_status': alert_data.get('web_status', 'N/A'),
-                'timestamp': timezone.now().isoformat(),
+                'difference_score': alert_data.get('difference_score', None),
+                'new_ip': alert_data.get('new_ip', None),
+                'old_ip': alert_data.get('old_ip', None),
+                'new_ip_second': alert_data.get('new_ip_second', None),
+                'old_ip_second': alert_data.get('old_ip_second', None),
+                'new_mx_records': alert_data.get('new_MX_records', None),
+                'old_mx_records': alert_data.get('old_MX_records', None),
+                'new_mail_A_record_ip': alert_data.get('new_mail_A_record_ip', None),
+                'old_mail_A_record_ip': alert_data.get('old_mail_A_record_ip', None),
                 'details_url': settings.WATCHER_URL + app_config_slack['url_suffix'],
                 'app_name': 'website_monitoring'
             }
@@ -376,34 +420,27 @@ def send_notification(channel, content_template, subscribers_filter, send_func,
             alert_id = alert_data.get('id', '-')
             email_body = get_site_monitoring_template(website_url, alert_id, alert_data)
 
-
         elif app_name == 'data_leak':
             alert = context_data.get('alert')
+
             if not alert:
                 return
+            
             common_data = {
                 'alert_pk': alert.pk,
                 'keyword_name': alert.keyword.name,
                 'url': alert.url,
                 'content': alert.content[:200],
-                'timestamp': alert.created_at.isoformat(),
                 'details_url': settings.WATCHER_URL + app_config_slack['url_suffix'],
                 'app_name': 'data_leak'
             }
             email_words = context_data.get('alert', [])
             email_body = get_data_leak_template(alert)
 
-
         elif app_name == 'dns_finder':
             alert = context_data.get('alert')
-            if not alert:
-                print("Error: Alert object is None in context_data")
-                return
-            if not alert.dns_twisted:
-                print(f"Error: dns_twisted is missing in alert {alert.pk if alert.pk else 'Unknown'}")
-                return
-            if not alert.dns_twisted.domain_name:
-                print(f"Error: domain_name is missing in dns_twisted for alert {alert.pk if alert.pk else 'Unknown'}")
+            
+            if not alert or not alert.dns_twisted or not alert.dns_twisted.domain_name:
                 return
 
             source = context_data.get('source')
@@ -421,6 +458,7 @@ def send_notification(channel, content_template, subscribers_filter, send_func,
                 'app_name': 'dns_finder'
             }
 
+
         send_notification(
             channel="slack",
             content_template=app_config_slack['content_template'],
@@ -501,8 +539,217 @@ def send_notification(channel, content_template, subscribers_filter, send_func,
             else:
                 pass
 
+    except Exception as e:
+        print(f"{datetime.now()} - Error sending notifications for {app_name}: {str(e)}")
+
+
+def send_app_specific_notifications_group(app_name, context_data, subscribers):
+    """
+    Send group notifications based on app type (Slack, Citadel, Email).
+    """
+    app_config_slack = APP_CONFIG_SLACK.get(app_name)
+    app_config_citadel = APP_CONFIG_CITADEL.get(app_name)
+    app_config_email = APP_CONFIG_EMAIL.get(app_name)
+
+    if not (app_config_slack or app_config_citadel or app_config_email):
+        return
+
+    if not subscribers.exists():
+        return
+
+    def send_notification(channel, content_template, subscribers_filter, send_func, **kwargs):
+        """Helper to format and send notification based on the channel."""
+        if subscribers.filter(**subscribers_filter).exists():
+            content = content_template.format(**kwargs)
+            send_func(content)
+
+    try:
+        common_data = {}
+
+        if app_name == 'data_leak_group':
+            alerts_number = context_data.get('alerts_number')
+            keyword = context_data.get('keyword')
+
+            if not keyword:
+                return
+            
+            common_data = {
+                'alerts_number': alerts_number,
+                'keyword': keyword,
+                'details_url': settings.WATCHER_URL + app_config_slack['url_suffix'],
+                'app_name': 'data_leak_group'
+            }
+            email_words = [keyword, alerts_number]
+            email_body = get_data_leak_group_template
+
+        elif app_name == 'dns_finder_group':
+            dns_monitored = context_data.get('dns_monitored')
+            alerts_number = context_data.get('alerts_number')
+            
+            if not dns_monitored or not alerts_number or not dns_monitored.domain_name:
+                return
+
+            common_data = {
+                'alerts_number': alerts_number,
+                'dns_monitored': dns_monitored,
+                'details_url': settings.WATCHER_URL + app_config_slack['url_suffix'],
+                'app_name': 'dns_finder_group',
+            }
+            email_words = [dns_monitored, alerts_number]
+            email_body = get_dns_finder_group_template
+
+        # Sending Slack notifications
+        send_notification(
+            channel="slack",
+            content_template=app_config_slack['content_template'],
+            subscribers_filter={'slack': True},
+            send_func=lambda content: send_slack_message(content, app_config_slack['channel'], app_name),
+            **common_data
+        )
+
+        # Sending Citadel notifications
+        citadel_title = app_config_citadel.get('title', f"[{app_name.upper()}] Incident Alert")
+        send_notification(
+            channel="citadel",
+            content_template=app_config_citadel['content_template'],
+            subscribers_filter={'citadel': True},
+            send_func=lambda content: send_citadel_message(
+                content={
+                    "msgtype": "m.text",
+                    "format": "org.matrix.custom.html",
+                    "body": citadel_title + " - New Incident Alert",
+                    "formatted_body": content.replace('\n', '<br>')
+                },
+                room_id=app_config_citadel['citadel_room_id'],
+                app_name=common_data.get('app_name')
+            ),
+            title=citadel_title,
+            **common_data
+        )
+
         if app_config_email:
             email_list = [subscriber.user_rec.email for subscriber in subscribers.filter(email=True)]
 
+            if email_list:
+                try:
+                    email_subject = app_config_email['subject'].format(**common_data)
+
+                    if app_name == 'data_leak_group':
+                        email_body = get_data_leak_group_template(keyword, alerts_number)  
+                    elif app_name == 'dns_finder_group':
+                        email_body = get_dns_finder_group_template(dns_monitored, alerts_number)
+                    else:
+                        print(f"Unsupported app_name: {app_name}")
+                        return
+
+                    if not isinstance(email_body, str):
+                        return
+
+                    send_email_notifications(email_subject, email_body, email_list, app_name)
+
+                except Exception as e:
+                    print(f"Error sending email: {e}")
+                    return
+
+    except Exception as e:
+        print(f"{datetime.now()} - Error sending notifications for {app_name}: {str(e)}")
+
+
+def send_only_thehive_notifications(app_name, context_data, subscribers):
+    """
+    Send notifications only to TheHive based on app type.
+    Collect observables, format the notification content, and send them to respective channels.
+    """
+    app_config_thehive = APP_CONFIG_THEHIVE.get(app_name)
+
+    if not app_config_thehive:
+        return
+
+    if not subscribers.exists():
+        return
+    
+    observables = collect_observables(app_name, context_data)
+
+    thehive_url = settings.THE_HIVE_URL
+    api_key = settings.THE_HIVE_KEY
+
+    def send_notification(channel, content_template, subscribers_filter, send_func, **kwargs):
+        if subscribers.filter(**subscribers_filter).exists():
+            content = content_template.format(**kwargs)
+            send_func(content)
+
+    try:
+        common_data = {}
+        if app_name == 'data_leak':
+            alert = context_data.get('alert')
+
+            if not alert:
+                return
+            
+            common_data = {
+                'alert_pk': alert.pk,
+                'keyword_name': alert.keyword.name,
+                'url': alert.url,
+                'content': alert.content[:200],
+                'details_url': settings.WATCHER_URL,
+                'app_name': 'data_leak'
+            }
+
+        elif app_name == 'dns_finder':
+            alert = context_data.get('alert')
+
+            if not alert or not alert.dns_twisted or not alert.dns_twisted.domain_name:
+                return
+
+            common_data = {
+                'alert': alert,
+                'details_url': settings.WATCHER_URL,
+                'app_name': 'dns_finder'
+            }
+
+        if app_config_thehive:
+            formatted_title = app_config_thehive['title'].format(**common_data)
+
+            domain_name = common_data.get('domain_name')
+            if domain_name:
+                try:
+                    site = Site.objects.get(domain_name=domain_name)
+                except Site.DoesNotExist:
+                    print(f"{timezone.now()} - Site with domain_name {domain_name} not found.")
+                    return
+
+                ticket_id = site.ticket_id
+
+                send_notification(
+                    channel="thehive",
+                    content_template=app_config_thehive['description_template'],
+                    subscribers_filter={'thehive': True},
+                    send_func=lambda content: send_thehive_alert(
+                        title=formatted_title,
+                        description=content,
+                        severity=app_config_thehive['severity'],
+                        tags=app_config_thehive['tags'],
+                        customFields=app_config_thehive.get('customFields'),
+                        app_name=app_name,
+                        domain_name=site.domain_name,
+                        observables=observables
+                    ),
+                    **common_data
+                )
+            else:
+                if subscribers.filter(thehive=True).exists():
+                    send_thehive_alert(
+                        title=formatted_title,
+                        description=app_config_thehive['description_template'].format(**common_data),
+                        severity=app_config_thehive['severity'],
+                        tags=app_config_thehive['tags'],
+                        app_name=app_name,
+                        domain_name=None,
+                        observables=observables,
+                        customFields=app_config_thehive.get('customFields'),
+                        thehive_url=thehive_url,
+                        api_key=api_key
+                    )
+
     except Exception as e:
         print(f"{datetime.now()} - Error sending notifications for {app_name}: {str(e)}")
\ No newline at end of file
diff --git a/Watcher/Watcher/common/mail_template/data_leak_group_template.py b/Watcher/Watcher/common/mail_template/data_leak_group_template.py
index 37b7d8b..669173f 100644
--- a/Watcher/Watcher/common/mail_template/data_leak_group_template.py
+++ b/Watcher/Watcher/common/mail_template/data_leak_group_template.py
@@ -67,7 +67,7 @@ def get_data_leak_group_template(keyword, alerts_number):
 
                 .word-list {
                     background: #f3f4f6;
-                    border-left: 10px solid #00267F;
+                    border-left: 4px solid #00267F;
                     padding: 15px 10px 15px 10px; 
                     margin: 20px 0;
                     border-radius: 0 4px 4px 0;
diff --git a/Watcher/Watcher/common/mail_template/data_leak_template.py b/Watcher/Watcher/common/mail_template/data_leak_template.py
index cfb5d14..04c450f 100644
--- a/Watcher/Watcher/common/mail_template/data_leak_template.py
+++ b/Watcher/Watcher/common/mail_template/data_leak_template.py
@@ -68,7 +68,7 @@ def get_data_leak_template(alert):
                 
                 .details {
                     background: #f3f4f6;
-                    border-left: 10px solid #00267F;
+                    border-left: 4px solid #00267F;
                     padding: 15px 10px 15px 10px; 
                     margin: 20px 0;
                     border-radius: 0 4px 4px 0;
diff --git a/Watcher/Watcher/common/mail_template/dns_finder_cert_transparency.py b/Watcher/Watcher/common/mail_template/dns_finder_cert_transparency.py
index 3529353..1aea115 100644
--- a/Watcher/Watcher/common/mail_template/dns_finder_cert_transparency.py
+++ b/Watcher/Watcher/common/mail_template/dns_finder_cert_transparency.py
@@ -67,7 +67,7 @@ def get_dns_finder_cert_transparency_template(alert):
                 
                 .word-list {
                     background: #f3f4f6;
-                    border-left: 10px solid #00267F;
+                    border-left: 4px solid #00267F;
                     padding: 15px 10px 15px 10px;
                     margin: 20px 0;
                     border-radius: 0 4px 4px 0;
diff --git a/Watcher/Watcher/common/mail_template/dns_finder_group_template.py b/Watcher/Watcher/common/mail_template/dns_finder_group_template.py
index 05c3eb9..e24df6f 100644
--- a/Watcher/Watcher/common/mail_template/dns_finder_group_template.py
+++ b/Watcher/Watcher/common/mail_template/dns_finder_group_template.py
@@ -76,7 +76,7 @@ def get_dns_finder_group_template(dns_monitored, alerts_number):
                 
                 .details {{
                     background: #f3f4f6;
-                    border-left: 10px solid #00267F;
+                    border-left: 4px solid #00267F;
                     padding: 15px 10px 15px 10px; 
                     margin: 20px 0;
                     border-radius: 0 4px 4px 0;
diff --git a/Watcher/Watcher/common/mail_template/dns_finder_template.py b/Watcher/Watcher/common/mail_template/dns_finder_template.py
index bed238b..db710f3 100644
--- a/Watcher/Watcher/common/mail_template/dns_finder_template.py
+++ b/Watcher/Watcher/common/mail_template/dns_finder_template.py
@@ -73,7 +73,7 @@ def get_dns_finder_template(alert):
                 
                 .details {{
                     background: #f3f4f6;
-                    border-left: 10px solid #00267F;
+                    border-left: 4px solid #00267F;
                     padding: 15px 10px 15px 10px;
                     margin: 20px 0;
                     border-radius: 0 4px 4px 0;
diff --git a/Watcher/Watcher/common/mail_template/site_monitoring_template.py b/Watcher/Watcher/common/mail_template/site_monitoring_template.py
index 2cf2258..987ec7c 100644
--- a/Watcher/Watcher/common/mail_template/site_monitoring_template.py
+++ b/Watcher/Watcher/common/mail_template/site_monitoring_template.py
@@ -83,7 +83,7 @@ def get_site_monitoring_template(website_status, website_url, alert_id):
 
                 .details {
                     background: #f3f4f6;
-                    border-left: 10px solid #00267F;
+                    border-left: 4px solid #00267F;
                     padding: 15px 10px 15px 10px;
                     margin: 20px 0;
                     border-radius: 0 4px 4px 0;
@@ -131,7 +131,7 @@ def get_site_monitoring_template(website_status, website_url, alert_id):
                     <!-- Header -->
                     <td class="header" colspan="2">
                         <img src=\"""" + str(settings.WATCHER_LOGO_BASE64) + """ " alt="Watcher Logo">
-                        <h1>Website Monitoring Alert</h1>
+                        <h1>Website Monitoring</h1>
                     </td>
                 </tr>
                 <!-- Content -->
diff --git a/Watcher/Watcher/common/mail_template/threats_watcher_template.py b/Watcher/Watcher/common/mail_template/threats_watcher_template.py
index 9bb3746..16eee89 100644
--- a/Watcher/Watcher/common/mail_template/threats_watcher_template.py
+++ b/Watcher/Watcher/common/mail_template/threats_watcher_template.py
@@ -67,7 +67,7 @@ def get_threats_watcher_template(words_occurrence, email_words):
                 
                 .word-list {
                     background: #f3f4f6;
-                    border-left: 10px solid #00267F;
+                    border-left: 4px solid #00267F;
                     padding: 15px 10px 15px 10px; 
                     margin: 20px 0;
                     border-radius: 0 4px 4px 0;
diff --git a/Watcher/Watcher/common/utils/send_thehive_alerts.py b/Watcher/Watcher/common/utils/send_thehive_alerts.py
index 4bc57dd..e71fadd 100644
--- a/Watcher/Watcher/common/utils/send_thehive_alerts.py
+++ b/Watcher/Watcher/common/utils/send_thehive_alerts.py
@@ -6,7 +6,6 @@
     create_new_alert
 )
 from site_monitoring.models import Site
-from common.core import generate_ref
 
 
 def get_ticket_id_for_domain(domain_name):
@@ -48,6 +47,7 @@ def post_to_thehive(url, data, headers, proxies):
 
 
 def send_thehive_alert(title, description, severity, tags, app_name, domain_name, observables=None, customFields=None, thehive_url=None, api_key=None):
+    from common.core import generate_ref
     """
     Send or update an alert in TheHive based on the application and ticket_id.
 
@@ -82,6 +82,9 @@ def send_thehive_alert(title, description, severity, tags, app_name, domain_name
 
     if app_name == 'website_monitoring' and not ticket_id:
         return
+    
+    current_time = timezone.now().strftime("%H:%M:%S")
+    current_date = timezone.now().strftime("%d/%m/%y")
 
     # Handle the alert for 'website_monitoring' if ticket_id is found
     if app_name == 'website_monitoring':
@@ -94,7 +97,10 @@ def send_thehive_alert(title, description, severity, tags, app_name, domain_name
             app_name=app_name,
             observables=observables,
             customFields=customFields,
-            comment=f"New alert created by {app_name} on {timezone.now()}: New information reported and initial context added.",
+            comment=(
+                f"A change was processed by {app_name} application at {current_time} on {current_date}.\n"
+                "The associated observables have been handled in the dedicated section."
+            ),
             thehive_url=thehive_url,
             api_key=api_key
         )
@@ -110,7 +116,11 @@ def send_thehive_alert(title, description, severity, tags, app_name, domain_name
             app_name=app_name,
             observables=observables,
             customFields=customFields,
-            comment=f"New alert created by {app_name} on {timezone.now()}: New information reported and initial context added.",
+            comment=(
+                f"An alert was processed by {app_name} application at {current_time} on {current_date}.\n"
+                "The associated observables have been handled in the dedicated section."
+            ),
             thehive_url=thehive_url,
             api_key=api_key
         )
+        
\ No newline at end of file
diff --git a/Watcher/Watcher/common/utils/update_thehive.py b/Watcher/Watcher/common/utils/update_thehive.py
index 3e1ef87..3d4ffff 100644
--- a/Watcher/Watcher/common/utils/update_thehive.py
+++ b/Watcher/Watcher/common/utils/update_thehive.py
@@ -1,6 +1,5 @@
 import requests
 from django.utils import timezone
-from common.core import generate_ref
 from django.conf import settings
 
 
@@ -65,7 +64,7 @@ def add_observables_to_item(item_type, item_id, observables_data, thehive_url, a
             # Send a POST request to add each observable to the item
             response = requests.post(url, headers=headers, json=observable, verify=False, proxies=proxies)
             response.raise_for_status()
-            added_observables.append(observable['data'])  # Add the observable data to the success list
+            added_observables.append(observable['data'])
         except requests.exceptions.RequestException as e:
             print(f"{timezone.now()} - Error while adding observable {observable['data']}: {e}")
 
@@ -135,11 +134,11 @@ def update_existing_alert_case(item_type, existing_item, observables, comment, t
         add_observables_to_item(item_type, item_id, observables_data, thehive_url, api_key)
 
     if comment:
-        print(f"{timezone.now()} - Adding comment to {item_type} with ID {item_id}...")
         add_comment_to_item(item_type, item_id, comment, thehive_url, api_key)
 
 
 def create_new_alert(ticket_id, title, description, severity, tags, app_name, observables, customFields, comment, thehive_url, api_key):
+    from common.core import generate_ref
     """
     Create a new alert in TheHive with the provided details.
 
@@ -183,7 +182,7 @@ def create_new_alert(ticket_id, title, description, severity, tags, app_name, ob
         response.raise_for_status()
         alert = response.json()
         alert_id = alert.get('_id')
-        print(f"{timezone.now()} - Alert created successfully with ID: {alert_id}")
+        print(f"{timezone.now()} - Alert successfully created on TheHive for {app_name}.")
 
         if observables:
             observables_data = create_observables(observables)
diff --git a/Watcher/Watcher/data_leak/core.py b/Watcher/Watcher/data_leak/core.py
index 9c131cc..a1bdf7d 100644
--- a/Watcher/Watcher/data_leak/core.py
+++ b/Watcher/Watcher/data_leak/core.py
@@ -10,9 +10,9 @@
 from django.db.models.functions import Length
 from json.decoder import JSONDecodeError
 from common.core import send_app_specific_notifications
+from common.core import send_app_specific_notifications_group
+from common.core import send_only_thehive_notifications
 from django.db.models import Q
-from django.core.mail import EmailMessage
-from common.mail_template.data_leak_group_template import get_data_leak_group_template
 
 
 def start_scheduler():
@@ -236,7 +236,7 @@ def check_keywords(keywords):
                     send_data_leak_notifications(alert)
             # if there is too many alerts, we send a group email
             if len(results) >= 6:
-                send_group_email(keyword, len(results))
+                send_data_leak_notifications_group(keyword, len(results), results)
 
     # now we check Pastebin for new pastes
     result = check_pastebin(keywords)
@@ -251,7 +251,7 @@ def check_keywords(keywords):
 
 def send_data_leak_notifications(alert):
     """
-    Sends notifications to Slack, Citadel, or TheHive based on data_leak.
+    Sends notifications to Slack, Citadel, TheHive or Email based on Data Leak.
     
     :param alert: Alert Object.
     """
@@ -270,34 +270,35 @@ def send_data_leak_notifications(alert):
     send_app_specific_notifications('data_leak', context_data, subscribers)
 
 
-def send_group_email(keyword, alerts_number):
+def send_data_leak_notifications_group(keyword, alerts_number, alerts):
     """
-    Send group e-mail for a specific keyword.
+    Sends grouped notifications to Slack, Citadel, TheHive or Email based on data_leak_group.
+    If the application is TheHive, individual notifications are sent for each alert.
 
-    :param keyword: Matched Keyword.
-    :param alerts_number: Number of alerts.
+    :param keyword: The keyword or term associated with the data leak.
+    :param alerts_number: The total number of alerts in the group.
+    :param alerts: The list of individual alerts to be processed and sent to TheHive.
     """
-    emails_to = [subscriber.user_rec.email for subscriber in Subscriber.objects.all()]
-
-    if emails_to: 
-        try:
-            # Construire l'email
-            subject = f"[{alerts_number} ALERTS] Data Leak"
-            body = get_data_leak_group_template(keyword, alerts_number)
-
-            email = EmailMessage(
-                subject=subject,
-                body=body,
-                from_email=settings.EMAIL_FROM,
-                to=emails_to,
-            )
-            email.content_subtype = "html"  
-
-            email.send(fail_silently=False)
-
-            for email_address in emails_to:
-                print(f"{timezone.now()} - Email sent to {email_address}")
-        except Exception as e:
-            print(f"{timezone.now()} - Email Error: {e}")
-    else:
-        print(f"{timezone.now()} - No subscriber, no email sent.")
\ No newline at end of file
+    subscribers = Subscriber.objects.filter(
+        Q(slack=True) | Q(citadel=True) | Q(thehive=True) | Q(email=True)
+    )
+
+
+    if not subscribers.exists():
+        print(f"{timezone.now()} - No subscribers for Data Leak group, no message sent.")
+        return
+
+    context_data_group = {
+        'keyword': keyword,
+        'alerts_number': alerts_number, 
+    }
+
+    send_app_specific_notifications_group('data_leak_group', context_data_group, subscribers)
+
+    for index, alert in enumerate(alerts):
+
+        context_data_thehive = {
+            'alert': alert,  
+        }
+
+        send_only_thehive_notifications('data_leak', context_data_thehive, subscribers)
\ No newline at end of file
diff --git a/Watcher/Watcher/dns_finder/core.py b/Watcher/Watcher/dns_finder/core.py
index 0fc6537..4e16eda 100644
--- a/Watcher/Watcher/dns_finder/core.py
+++ b/Watcher/Watcher/dns_finder/core.py
@@ -10,9 +10,9 @@
 from .models import Alert, DnsMonitored, DnsTwisted, Subscriber, KeywordMonitored
 import certstream
 from common.core import send_app_specific_notifications
+from common.core import send_app_specific_notifications_group
+from common.core import send_only_thehive_notifications
 from django.db.models import Q
-from django.core.mail import EmailMessage
-from common.mail_template.dns_finder_group_template import get_dns_finder_group_template
 
 
 def start_scheduler():
@@ -145,7 +145,7 @@ def check_dnstwist(dns_monitored):
                 for alert in alerts_list:
                     send_dns_finder_notifications(alert)
             if len(alerts_list) >= 6:
-                send_group_email(dns_monitored, len(alerts_list))
+                send_dns_finder_notifications_group(dns_monitored, len(alerts_list), alerts_list)
         except ValueError:
             print('Decoding JSON has failed')
 
@@ -154,7 +154,7 @@ def check_dnstwist(dns_monitored):
 
 def send_dns_finder_notifications(alert):
     """
-    Sends notifications to Slack, Citadel, or TheHive based on dns_finder.
+    Sends notifications to Slack, Citadel, TheHive or Email based on DNS Finder.
     
     :param alert: Alert Object.
     """
@@ -182,37 +182,34 @@ def send_dns_finder_notifications(alert):
     send_app_specific_notifications('dns_finder', context_data, subscribers)
 
 
-def send_group_email(dns_monitored, alerts_number):
+def send_dns_finder_notifications_group(dns_monitored, alerts_number, alerts):
     """
-    Send group e-mail for a specific dns_monitored.
+    Sends grouped notifications to Slack, Citadel, TheHive or Email based on dns_finder_group.
+    If the application is TheHive, individual notifications are sent for each alert.
 
-    :param dns_monitored: DnsMonitored Object.
-    :param alerts_number: Number of alerts.
+    :param keyword: The keyword or term associated with the dns finder.
+    :param alerts_number: The total number of alerts in the group.
+    :param alerts: The list of individual alerts to be processed and sent to TheHive.
     """
-    # Collecter les emails des abonnés
-    emails_to = [subscriber.user_rec.email for subscriber in Subscriber.objects.all()]
+    subscribers = Subscriber.objects.filter(
+        Q(slack=True) | Q(citadel=True) | Q(thehive=True) | Q(email=True)
+    )
 
-    if emails_to:  # S'il y a au moins un abonné
-        try:
-            # Construire l'email
-            subject = f"[{alerts_number} ALERTS] DNS Finder"
-            body = get_dns_finder_group_template(dns_monitored, alerts_number)
-
-            email = EmailMessage(
-                subject=subject,
-                body=body,
-                from_email=settings.EMAIL_FROM,
-                to=emails_to,
-            )
-            email.content_subtype = "html"  
-
-            # Envoyer l'email
-            email.send(fail_silently=False)
-
-            # Confirmation des emails envoyés
-            for email_address in emails_to:
-                print(f"{timezone.now()} - Email sent to {email_address}")
-        except Exception as e:
-            print(f"{timezone.now()} - Email Error: {e}")
-    else:
-        print(f"{timezone.now()} - No subscriber, no email sent.")
\ No newline at end of file
+    if not subscribers.exists():
+        print(f"{timezone.now()} - No subscribers for DNS Finder group, no message sent.")
+        return
+
+    context_data_group = {
+        'dns_monitored': dns_monitored,
+        'alerts_number': alerts_number,
+    }
+
+    send_app_specific_notifications_group('dns_finder_group', context_data_group, subscribers)
+
+    for alert in alerts:
+
+        context_data_thehive = {
+            'alert': alert,  
+        }
+
+        send_only_thehive_notifications('dns_finder', context_data_thehive, subscribers)
\ No newline at end of file
diff --git a/Watcher/Watcher/site_monitoring/core.py b/Watcher/Watcher/site_monitoring/core.py
index 5a3f247..5ba67fc 100644
--- a/Watcher/Watcher/site_monitoring/core.py
+++ b/Watcher/Watcher/site_monitoring/core.py
@@ -20,6 +20,8 @@
 import shadow_useragent
 from common.core import send_app_specific_notifications
 from django.db.models import Q
+import time
+import random
 
 try:
     shadow_useragent = shadow_useragent.ShadowUserAgent()
@@ -367,19 +369,15 @@ def create_alert(alert, site, new_ip, new_ip_second, score):
             'old_ip': site.ip if site.ip else None,
             'new_ip_second': new_ip_second if new_ip_second else None,
             'old_ip_second': site.ip_second if site.ip_second else None,
-            'new_MX_records': site.MX_records if site.MX_records else None,
             'old_MX_records': site.MX_records if site.MX_records else None,
-            'new_mail_A_record_ip': site.mail_A_record_ip if site.mail_A_record_ip else None,
             'old_mail_A_record_ip': site.mail_A_record_ip if site.mail_A_record_ip else None,
             'difference_score': score if score else None,
         })
 
-
         with transaction.atomic():
             new_alert = Alert.objects.create(site=site, **alert_data)
 
-        # Envoyer les notifications avec les données actualisées
-        send_website_monitoring_notifications(site, alert_data)
+        time.sleep(random.uniform(1, 3))
 
         # Manage MX records for mail changes
         if 'Mail' in alert_data['type']:
@@ -401,11 +399,13 @@ def create_alert(alert, site, new_ip, new_ip_second, score):
                 if site.monitored and alert != 8:
                     Site.objects.filter(pk=site.pk).update(MX_records=site.MX_records,
                                                             mail_A_record_ip=site.mail_A_record_ip)
+                    
+        send_website_monitoring_notifications(site, alert_data)
 
 
 def send_website_monitoring_notifications(site, alert_data):
     """
-    Sends notifications to Slack, Citadel, or TheHive based on Site Monitoring.
+    Sends notifications to Slack, Citadel, TheHive or Email based on Site Monitoring.
     
     Args:
         site (Site): The object representing the site to monitor.
@@ -425,7 +425,6 @@ def send_website_monitoring_notifications(site, alert_data):
     mx_changes = f"MX Records: {', '.join(alert_data.get('new_mx_records', []))}" 
     content_score_info = f"TLSH Score: {alert_data.get('difference_score', 'N/A')}"
     alert_type_info = f"Alert Type: {alert_data.get('type', 'N/A')}"
-    timestamp_info = f"Date and Time: {timezone.now().isoformat()}"
 
 
     required_keys = ['new_ip', 'old_ip', 'new_ip_second', 'old_ip_second', 'new_MX_records', 'old_MX_records', 'new_mail_A_record_ip', 'old_mail_A_record_ip']
@@ -453,7 +452,6 @@ def send_website_monitoring_notifications(site, alert_data):
         'mx_changes': mx_changes,
         'content_score_info': content_score_info,
         'alert_type_info': alert_type_info,
-        'timestamp_info': timestamp_info
     }
 
     send_app_specific_notifications('website_monitoring', context_data, subscribers)
\ No newline at end of file
diff --git a/Watcher/Watcher/threats_watcher/core.py b/Watcher/Watcher/threats_watcher/core.py
index 44aee36..8936cd0 100644
--- a/Watcher/Watcher/threats_watcher/core.py
+++ b/Watcher/Watcher/threats_watcher/core.py
@@ -291,7 +291,7 @@ def focus_on_top(words_occurrence):
 
 def send_threats_watcher_notifications(email_words):
     """
-    Sends notifications to Slack, Citadel, or TheHive based on Threats Watcher.
+    Sends notifications to Slack, Citadel, TheHive or Email based on Threats Watcher.
     """
     subscribers = Subscriber.objects.filter(
         (Q(slack=True) | Q(citadel=True) | Q(thehive=True) | Q(email=True))