Ops Discord

Discord Operations - Notification Monitor Model

TOS-compliant approach to Discord security intelligence gathering.

The Key Insight

OLD (Broken): Try to search external servers where you're not admin → TOS violation, impossible

NEW (Works): Monitor YOUR OWN server for content forwarded by researchers → 100% compliant

Architecture

┌───────────────────────────────────────────────────────────────────────────────┐
│                   TOS-Compliant Discord Pipeline + Memory                      │
├───────────────────────────────────────────────────────────────────────────────┤
│                                                                                │
│  External Sources              Your Server (Admin)            Consumers        │
│  ────────────────              ────────────────────            ─────────        │
│                                                                                │
│  ┌─────────────┐               ┌──────────────────┐                           │
│  │ Researchers │──DM/forward──▶│ #security-intel  │                           │
│  │ share       │               │                  │                           │
│  │ insights    │               │  Your Bot        │──webhook──▶ create-paper  │
│  └─────────────┘               │  (keyword watch) │                           │
│                                │                  │──webhook──▶ dogpile       │
│  ┌─────────────┐               │  Keywords:       │                           │
│  │ Telegram    │──bridge──▶    │  CVE, DARPA,     │                           │
│  │ bridges     │  (social-     │  HTB, 0-day...   │                           │
│  └─────────────┘   bridge)     └────────┬─────────┘                           │
│                                         │                                      │
│                           ┌─────────────┼─────────────┐                       │
│                           ▼             ▼             ▼                        │
│                    ┌──────────┐  ┌──────────────┐  ┌────────────┐             │
│                    │ matches  │  │ graph-memory │  │  dogpile   │             │
│                    │ .jsonl   │  │  (ArangoDB)  │  │  search    │             │
│                    │ (local)  │  │   lessons    │  │            │             │
│                    └──────────┘  └──────┬───────┘  └─────┬──────┘             │
│                                         │                │                     │
│                                         └────────────────┘                     │
│                                         (semantic recall)                      │
│                                                                                │
└───────────────────────────────────────────────────────────────────────────────┘

Quick Start

# 1. Check setup
./run.sh setup

# 2. Add your Discord server to monitor
./run.sh guild add "Security Intel" 1234567890123456789

# 3. Add webhook for forwarding matches
./run.sh webhook add alerts "https://discord.com/api/webhooks/..."

# 4. Start monitoring
./run.sh monitor start --webhook alerts

Commands

setup - Check Configuration

./run.sh setup

Shows status of:

• Bot token (from env or clawdbot)
• discord.py library
• httpx for webhooks
• Current configuration

keywords - Manage Watch Patterns

# List all keywords (regex patterns)
./run.sh keywords list

# Add a keyword pattern
./run.sh keywords add "CVE-2025-\d+"
./run.sh keywords add "supply.?chain"

# Remove a pattern
./run.sh keywords remove "HTB"

# Reset to defaults
./run.sh keywords reset

Default Keywords:

• Vulnerabilities: CVE-\d{4}-\d+, 0-?day, exploit, RCE, LPE, privesc
• Programs: DARPA, IARPA, BAA, grants?\.gov
• Platforms: HTB, TryHackMe, CTF
• Threat Intel: APT\d+, malware, ransomware, C2, cobalt.?strike
• Techniques: MITRE, ATT&CK, T\d{4}

guild - Manage Monitored Servers

# List monitored guilds
./run.sh guild list

# Add a guild to monitor
./run.sh guild add "My Server" 1234567890123456789

# Remove a guild
./run.sh guild remove "My Server"

webhook - Manage Output Webhooks

# List webhooks
./run.sh webhook list

# Add a webhook
./run.sh webhook add alerts "https://discord.com/api/webhooks/..."
./run.sh webhook add create-paper "http://localhost:8000/paperwriter/discord"

# Remove a webhook
./run.sh webhook remove alerts

# Test a webhook
./run.sh webhook test alerts

monitor - Run the Monitor

# Check status
./run.sh monitor status

# Start monitoring (foreground)
./run.sh monitor start --webhook alerts

# Start in dry-run mode (log only, don't forward)
./run.sh monitor start --dry-run

# Stop the monitor
./run.sh monitor stop

matches - View Logged Matches

# Show recent matches
./run.sh matches

# Show more matches
./run.sh matches --limit 50

# Filter by keyword
./run.sh matches --keyword CVE

# Output as JSON
./run.sh matches --json

memory - Knowledge Graph Integration

# Check memory integration status
./run.sh memory status

# Search stored matches in memory
./run.sh memory search "CVE-2024"

# Search with JSON output
./run.sh memory search "ransomware" --json --k 20

# Ingest existing matches from log file to memory
./run.sh memory ingest --limit 100

Auto-Persistence: The monitor automatically persists matches to memory by default:

# Start with memory persistence (default)
./run.sh monitor start --webhook alerts

# Start without memory persistence
./run.sh monitor start --webhook alerts --no-persist

Webhook Payload Formats

Discord Webhook (auto-detected by URL)

{
  "embeds": [{
    "title": "Keyword Match: CVE-2024-1234, exploit",
    "description": "New RCE exploit for CVE-2024-1234...",
    "url": "https://discord.com/channels/...",
    "color": 5793266,
    "author": {"name": "researcher#1234"},
    "footer": {"text": "Security Intel #cve-alerts"},
    "timestamp": "2026-01-28T12:00:00Z"
  }]
}

Generic Webhook (create-paper/dogpile)

{
  "source": "discord",
  "content": "New RCE exploit for CVE-2024-1234...",
  "author": "researcher#1234",
  "channel": "Security Intel/#cve-alerts",
  "url": "https://discord.com/channels/...",
  "keywords": ["CVE-2024-1234", "exploit"],
  "timestamp": "2026-01-28T12:00:00Z"
}

Setup Your Security Intel Server

Step 1: Create Server

Create a Discord server for aggregating security intel:

• #cve-alerts - CVE announcements
• #research-feed - General security research
• #threat-intel - APT/malware news
• #darpa-baa - Funding opportunities

Step 2: Add Your Bot

1. Use the bot from clawdbot or create a new one
2. Required permissions: Read Messages, Read Message History, View Channels
3. Get guild ID: Server Settings → Widget → Server ID

Step 3: Invite Researchers

• Researchers can forward content from other servers to your channels
• Or set up Telegram bridges (see social-bridge skill)
• Bot watches for keywords in YOUR server only

Step 4: Configure Webhooks

Create webhooks in your destination channels or endpoints:

• Discord webhook for alerts channel
• HTTP webhook for create-paper integration
• Generic webhook for ArangoDB logging

Integration with create-paper

# create-paper endpoint receives Discord matches
POST /paperwriter/discord
{
  "source": "discord",
  "content": "...",
  "keywords": ["CVE-...", "exploit"],
  ...
}

# Gets auto-indexed alongside arXiv/SAM.gov pulls

Integration with social-bridge

The social-bridge skill can forward Telegram content to your Discord server:

Telegram Public Channels → social-bridge → Your Discord → ops-discord → create-paper

Environment Variables

Files

.pi/skills/ops-discord/
├── discord_ops.py    # Main CLI
├── run.sh            # Runner script
├── config.json       # Guilds and webhooks config
├── keywords.json     # Watched keyword patterns
├── matches.jsonl     # Logged keyword matches
└── monitor.pid       # PID file when running

Why This Works

Comparison with Old Approach