A Python script which posts login alerts to Slack webhook. (Requires 'who' command)

login-alert.py

import socket
import commands
import urllib
import urllib2 as urlrequest
import json
from datetime import datetime

SLACK_POST_URL = "https://hooks.slack.com/services/[TOKEN]"

def build_attachment():
    post_json = {
        "attachments": [
            {
                "fallback": "Shell Login Detected",
                "color": "warning",
                "pretext": "ALERT - Shell Access on %s" % datetime.now().isoformat(),
                "fields": [
                    {
                        "title": "Hostname",
                        "value": socket.gethostname(),
                        "short": "false"
                    },
                    {
                        "title": "Users logged in",
                        "value": commands.getoutput('who'),
                        "short": "false"
                    }
                ]
            }
        ]
    }
    return post_json

def post(payload):
    payload_json = json.dumps(payload)
    data = urllib.urlencode({"payload": payload_json})
    req = urlrequest.Request(SLACK_POST_URL)
    response = urlrequest.build_opener(urlrequest.HTTPHandler()).open(req, data.encode('utf-8')).read()
    return response.decode('utf-8')

post(build_attachment())

login-alert.sh

# Put this script in /etc/profile.d/
/usr/bin/python /path/to/script.py