Email notifications

[Nick]

Hi Team

I have setup a channel in notifications and received the test email. I have also setup a test alert and pointed it to this channel. When the alert is triggered i receive the email.

How do i set up alerts in general above a certain level, the default been 12, to send notifications via this channel?

regards

Nick

[Franco Giovanolli]

Hi Nick;

Glad to hear you already have your notification channel working. I can tell you two ways to do what you are asking.

Option 1 – Dashboard Monitor (OpenSearch Alerting)

You can create a Monitor in the Wazuh Dashboard that queries the alerts index by rule.level:

1. Go to OpenSearch Plugins → Alerting → Monitors and create a new monitor.
2. Set the monitor type to Per query monitor.
3. Choose Extraction query editor and set the index to wazuh-alerts-*.
4. Use a query like this to match alerts with level 12 or above:

{ "query": { "range": { "rule.level": { "gte": 12 } } } }

5. Set the schedule/frequency according to your needs (e.g., every 1–5 minutes).
6. Under Triggers, create a trigger with a condition like ctx.results[0].hits.total.value > 0.
7. In the trigger's Actions, select the notification channel you already configured.

Option 2 – Native Wazuh email alerts (recommended)

Wazuh also has a built-in email alerting mechanism configured directly in the manager's ossec.conf. This is generally more reliable and straightforward for level-based alerting since it doesn't depend on the indexer pipeline. You can set it up by adding/editing the following in your /var/ossec/etc/ossec.conf:

<global> <email_notification>yes</email_notification> <smtp_server>your_smtp_server</smtp_server> <email_from>wa...@yourdomain.com</email_from> <email_to>ni...@yourdomain.com</email_to> <email_alert_level>12</email_alert_level> </global>

After saving, restart the manager with systemctl restart wazuh-manager. From that point on, any alert at level 12 or above will automatically trigger an email — no monitors or additional configuration needed.

You can also use <email_maxperhour> to control the volume of emails and <granular_email_options> if you want to fine-tune which alerts go to which recipients.

More details in the documentation: https://documentation.wazuh.com/current/user-manual/manager/manual-email-report/index.html

Hope that helps!

Regards,
Franco.