Sends an alert on webhook if an unprivileged user uses sudo on a machine

sudo_notifier.sh

#!/bin/bash
while inotifywait -e modify /var/log/auth.log;
do
word=`tail -n1 /var/log/auth.log | grep 'user NOT in sudoers'`
if [[ $word ]]; then
echo '{"text":"'$word'"}' > sendtoslack
curl -X POST \
-H 'Content-type: application/json' \
--data @sendtoslack \
<webhook url>
rm sendtoslack
fi
done