Project: a ChatOps bot for network checks

Goal and what you will build

ChatOps means running operational tasks from a team chat platform. When an engineer types /netcheck ping 192.168.10.20 and the bot replies in the channel, the whole team sees the question, the evidence and the answer, which speeds up incident response and helps new staff learn. In this project you will build a bot that offers three read-only checks: ping, DNS lookup and interface status from a lab switch.

The example uses Slack’s Bolt for Python in Socket Mode, which connects outwards to Slack so you do not need to expose a web server to the internet. Microsoft Teams and other platforms follow the same ideas with their own SDKs (Software Development Kits). Build it in your own workspace and lab.

Design and security

A bot that can reach your network is a powerful tool and an attractive target. Design it as you would any privileged service:

• Read-only by default: the bot can look, not change. Change actions, if ever added, need a separate approval step.
• Allow-list of commands: map a few command names to fixed Python functions. Never pass user text to a shell.
• Strict validation: targets must be valid IP addresses inside approved ranges, or hostnames in your own domain.
• Authorisation: only listed user IDs, in listed channels, may run checks.
• Secrets: bot tokens and device credentials come from environment variables or a vault.
• Audit: log every request with user, command, target and result.

Build it step by step

1. Create a chat app in your own workspace, enable Socket Mode, add a slash command /netcheck and install the app. Note the bot token and app-level token.
2. Store both tokens as environment variables: SLACK_BOT_TOKEN and SLACK_APP_TOKEN.
3. Install the library: pip install slack_bolt.
4. Write the bot below, run it on a lab host that can reach your devices, and test each command, including invalid input.
5. Run it as a service under a dedicated, unprivileged user account.

#!/usr/bin/env python3
import ipaddress, logging, os, socket, subprocess
from slack_bolt import App
from slack_bolt.adapter.socket_mode import SocketModeHandler

logging.basicConfig(filename="netcheck-audit.log", level=logging.INFO,
                    format="%(asctime)s %(message)s")
app = App(token=os.environ["SLACK_BOT_TOKEN"])

ALLOWED_USERS = set(os.environ.get("NETCHECK_USERS", "").split(","))
ALLOWED_NETS = [ipaddress.ip_network(n) for n in ("192.168.10.0/24", "10.10.0.0/16")]

def safe_ip(text):
    ip = ipaddress.ip_address(text)                 # raises ValueError if invalid
    if not any(ip in n for n in ALLOWED_NETS):
        raise ValueError("address outside approved ranges")
    return str(ip)

def do_ping(arg):
    ip = safe_ip(arg)
    r = subprocess.run(["ping", "-c", "3", "-W", "2", ip],   # list: no shell
                       capture_output=True, text=True, timeout=15)
    return r.stdout.strip().splitlines()[-1] if r.returncode == 0 else f"{ip} not responding"

def do_dns(arg):
    if not arg.endswith(".example.com"):
        raise ValueError("only example.com names allowed")
    return ", ".join(sorted({a[4][0] for a in socket.getaddrinfo(arg, None)}))

CHECKS = {"ping": do_ping, "dns": do_dns}

@app.command("/netcheck")
def netcheck(ack, respond, command):
    ack()                                           # reply within 3 seconds
    user, text = command["user_id"], command.get("text", "").split()
    if user not in ALLOWED_USERS:
        logging.info("DENIED user=%s text=%s", user, text)
        return respond("You are not authorised to run network checks.")
    if len(text) != 2 or text[0] not in CHECKS:
        return respond("Usage: /netcheck ping <ip> | /netcheck dns <name>")
    try:
        result = CHECKS[text[0]](text[1])
    except (ValueError, subprocess.TimeoutExpired, OSError) as e:
        result = f"Check refused or failed: {e}"
    logging.info("user=%s check=%s target=%s", user, text[0], text[1])
    respond(response_type="in_channel", text=f"`{text[0]} {text[1]}`: {result}")

if __name__ == "__main__":
    SocketModeHandler(app, os.environ["SLACK_APP_TOKEN"]).start()

Tip: the call to subprocess.run uses a list of arguments and no shell, and the target has already been parsed as an IP address. Together these block command injection, where input such as 8.8.8.8; rm -rf / would otherwise run a second command.

How to extend it and show it

• Add an intf check that uses Netmiko or NAPALM with a read-only account to show one interface’s status and errors.
• Let monitoring alerts arrive in the channel through webhooks, with buttons that run the relevant check.
• Add rate limiting per user and move the allow-lists into a configuration file under version control.
• For any future change action, require a second engineer to approve in the chat before it runs.

For your portfolio, record a short demo of the bot answering valid commands and refusing invalid or unauthorised ones; the refusals are as impressive as the successes. Document the security design in the README, including the threat of command injection and how you prevented it, and show a few lines of the audit log with fictional user IDs.