Wazuh email alerts vs Postfix

[Shreya Chakrabarty]

Hey! I am very new to wazuh and I am trying to set email alerts via wazuh. However I need some guidance on whether or not it is necessary to configure both wazuh email alerts (set up using notification channels) and Postfix. Thank you!

[hasitha.u...@wazuh.com]

Hi Shreya,

If you want to send alerts by email directly from the Wazuh Manager, you do not need to configure notification channels.

Please note that Wazuh email alerts do not support authenticated SMTP servers like Gmail directly. For that, you need to use a mail relay such as Postfix.

Here are the steps to configure email alerting on the Wazuh Manager side:

1. Install Postfix and the required mail packages.
2. Configure Postfix to use Gmail as a relay.
3. Create the Gmail credentials file using an App Password.
4. Generate the Postfix database file (postmap).
5. Secure the credentials files with the correct permissions.
6. Restart the Postfix service.
7. Send a test email to make sure Postfix is working.
8. If needed, fix the TLS issue by switching to SHA-256.
9. Update the Wazuh ossec.conf file to enable email notifications using localhost.
10. Restart the Wazuh Manager to apply the changes.
    
    You can follow this guide to configure email alerting from the manager side with simple steps.

Notification channels are used for Indexer-based email alerting. You can check the related documentation for more details.
Ref: https://docs.opensearch.org/2.19/observing-your-data/notifications/index/

Please let me know if you want to send alerts through the indexer-based notifications instead, and I can guide you on that as well.

[Shreya Chakrabarty]

Thank you so much for replying so quickly! 

What would you suggest? Should I go for Indexer-based email alerting as someone who is starting out or should I just configure postfix from the get go? 

[hasitha.u...@wazuh.com]

Hi Shreya,

I suggest you follow the steps I shared from the Wazuh manager side with Postfix. Later, you can check the Notification channel usage from the indexer side. 

Let me know if you need further assistance on this. Thanks!