Discord Operations - Notification Monitor Model

Discord Operations - Notification Monitor Model

TOS-compliant approach to Discord security intelligence gathering.

The Key Insight

OLD (Broken): Try to search external servers where you're not admin → TOS violation, impossible

NEW (Works): Monitor YOUR OWN server for content forwarded by researchers → 100% compliant

Architecture

┌───────────────────────────────────────────────────────────────────────────────┐
│                   TOS-Compliant Discord Pipeline + Memory                      │
├───────────────────────────────────────────────────────────────────────────────┤
│                                                                                │
│  External Sources              Your Server (Admin)            Consumers        │
│  ────────────────              ────────────────────            ─────────        │
│                                                                                │
│  ┌─────────────┐               ┌──────────────────┐                           │
│  │ Researchers │──DM/​forward──▶│ #security-intel  │                           │
│  │ share       │               │                  │                           │
│  │ insights    │               │  Your Bot        │──webhook──▶ paper-writer  │
│  └─────────────┘               │  (keyword watch) │                           │
│                                │                  │──webhook──▶ dogpile       │
│  ┌─────────────┐               │  Keywords:       │                           │
│  │ Telegram    │──bridge──▶    │  CVE, DARPA,     │                           │
│  │ bridges     │  (social-     │  HTB, 0-day...   │                           │
│  └─────────────┘   bridge)     └────────┬─────────┘                           │
│                                         │                                      │
│                           ┌─────────────┼─────────────┐                       │
│                           ▼             ▼             ▼                        │
│                    ┌──────────┐  ┌──────────────┐  ┌────────────┐             │
│                    │ matches  │  │ graph-memory │  │  dogpile   │             │
│                    │ .jsonl   │  │  (ArangoDB)  │  │  search    │             │
│                    │ (local)  │  │   lessons    │  │            │             │
│                    └──────────┘  └──────┬───────┘  └─────┬──────┘             │
│                                         │                │                     │
│                                         └────────────────┘                     │
│                                         (semantic recall)                      │
│                                                                                │
└───────────────────────────────────────────────────────────────────────────────┘

Quick Start

# 1. Check setup
./​run.sh setup

# 2. Add your Discord server to monitor
./​run.sh guild add "Security Intel" 1234567890123456789

# 3. Add webhook for forwarding matches
./​run.sh webhook add alerts "https://discord.com/​api/​webhooks/​..."

# 4. Start monitoring
./​run.sh monitor start --webhook alerts

Commands

setup - Check Configuration

./​run.sh setup

Shows status of:

• Bot token (from env or clawdbot)
• discord.py library
• httpx for webhooks
• Current configuration

keywords - Manage Watch Patterns

# List all keywords (regex patterns)
./​run.sh keywords list

# Add a keyword pattern
./​run.sh keywords add "CVE-2025-\d+"
./​run.sh keywords add "supply.?chain"

# Remove a pattern
./​run.sh keywords remove "HTB"

# Reset to defaults
./​run.sh keywords reset

Default Keywords:

• Vulnerabilities: CVE-\d{4}-\d+, 0-?day, exploit, RCE, LPE, privesc
• Programs: DARPA, IARPA, BAA, grants?\.gov
• Platforms: HTB, TryHackMe, CTF
• Threat Intel: APT\d+, malware, ransomware, C2, cobalt.?strike
• Techniques: MITRE, ATT&CK, T\d{4}

guild - Manage Monitored Servers

# List monitored guilds
./​run.sh guild list

# Add a guild to monitor
./​run.sh guild add "My Server" 1234567890123456789

# Remove a guild
./​run.sh guild remove "My Server"

webhook - Manage Output Webhooks

# List webhooks
./​run.sh webhook list

# Add a webhook
./​run.sh webhook add alerts "https://discord.com/​api/​webhooks/​..."
./​run.sh webhook add paper-writer "http://localhost:8000/​paperwriter/​discord"

# Remove a webhook
./​run.sh webhook remove alerts

# Test a webhook
./​run.sh webhook test alerts

monitor - Run the Monitor

# Check status
./​run.sh monitor status

# Start monitoring (foreground)
./​run.sh monitor start --webhook alerts

# Start in dry-run mode (log only, don't forward)
./​run.sh monitor start --dry-run

# Stop the monitor
./​run.sh monitor stop

matches - View Logged Matches

# Show recent matches
./​run.sh matches

# Show more matches
./​run.sh matches --limit 50

# Filter by keyword
./​run.sh matches --keyword CVE

# Output as JSON
./​run.sh matches --json

memory - Knowledge Graph Integration

# Check memory integration status
./​run.sh memory status

# Search stored matches in memory
./​run.sh memory search "CVE-2024"

# Search with JSON output
./​run.sh memory search "ransomware" --json --k 20

# Ingest existing matches from log file to memory
./​run.sh memory ingest --limit 100

Auto-Persistence: The monitor automatically persists matches to memory by default:

# Start with memory persistence (default)
./​run.sh monitor start --webhook alerts

# Start without memory persistence
./​run.sh monitor start --webhook alerts --no-persist

Webhook Payload Formats

Discord Webhook (auto-detected by URL)

{
  "embeds": [{
    "title": "Keyword Match: CVE-2024-1234, exploit",
    "description": "New RCE exploit for CVE-2024-1234...",
    "url": "https://discord.com/​channels/​...",
    "color": 5793266,
    "author": {"name": "researcher#1234"},
    "footer": {"text": "Security Intel #cve-alerts"},
    "timestamp": "2026-01-28T12:00:00Z"
  }]
}

Generic Webhook (paper-writer/​dogpile)

{
  "source": "discord",
  "content": "New RCE exploit for CVE-2024-1234...",
  "author": "researcher#1234",
  "channel": "Security Intel/#cve-alerts",
  "url": "https://discord.com/​channels/​...",
  "keywords": ["CVE-2024-1234", "exploit"],
  "timestamp": "2026-01-28T12:00:00Z"
}

Setup Your Security Intel Server

Step 1: Create Server

Create a Discord server for aggregating security intel:

• #cve-alerts - CVE announcements
• #research-feed - General security research
• #threat-intel - APT/​malware news
• #darpa-baa - Funding opportunities

Step 2: Add Your Bot

1. Use the bot from clawdbot or create a new one
2. Required permissions: Read Messages, Read Message History, View Channels
3. Get guild ID: Server Settings → Widget → Server ID

Step 3: Invite Researchers

• Researchers can forward content from other servers to your channels
• Or set up Telegram bridges (see social-bridge skill)
• Bot watches for keywords in YOUR server only

Step 4: Configure Webhooks

Create webhooks in your destination channels or endpoints:

• Discord webhook for alerts channel
• HTTP webhook for paper-writer integration
• Generic webhook for ArangoDB logging

Integration with paper-writer

# paper-writer endpoint receives Discord matches
POST /​paperwriter/​discord
{
  "source": "discord",
  "content": "...",
  "keywords": ["CVE-...", "exploit"],
  ...
}

# Gets auto-indexed alongside arXiv/​SAM.gov pulls

Integration with social-bridge

The social-bridge skill can forward Telegram content to your Discord server:

Telegram Public Channels → social-bridge → Your Discord → discord-ops → paper-writer

Environment Variables

Files

.pi/​skills/​discord-ops/
├── discord_ops.py    # Main CLI
├── run.sh            # Runner script
├── config.json       # Guilds and webhooks config
├── keywords.json     # Watched keyword patterns
├── matches.jsonl     # Logged keyword matches
└── monitor.pid       # PID file when running

Why This Works

Comparison with Old Approach