Trouble configuring email alerts

[Kris Deugau]

I have basic email alerting up and running.

What I'm having trouble with is sending alerts for various subsets of
alerts to the appropriate contacts.

I want to:

1) Send all alerts of level <n> or higher (and ONLY level <n> or higher
- lower level alerts MUST NOT be sent to this contact) to contact A

2) Send multiple different sets of selected alerts based on group, rule
ID, and/or "equal to" level <m> to contacts B, C, etc.

"level equal to <m>" doesn't seem to be an option, but I can work around
that as most of the subdivisions will be on rule IDs anyway.

However, on a test platform I'm getting extra alerts that I *don't* want
in the emails for #1 above.

I've gotten this far:

===
<ossec_config>
[...]
<alerts>
<log_alert_level>3</log_alert_level>
<email_alert_level>4</email_alert_level>
</alerts>

<email_alerts>
<level>7</level>
<email_to>[contact A]</email_to>
</email_alerts>

===

But the emails that get sent include level 5 alerts. According to
https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/email-alerts.html,
the <level> directive should limit these to *ONLY* level 7 or higher alerts.

If I raise the <email_alert_level>, then yes, I only get those sent...
but I then can't send any email at all for lower-level alerts, as
documented.

Is it possible to do what I want here?

-kgd

[Natalia Castillo]

Hi!

Thank you for using Wazuh.

It looks like what you are doing is correct and it should have the desired result. Can you please share all the configuration that you have? to check that the filters are correctly applied.

[Gk Krishinamurthy]

[Kris Deugau]

My test instance is nearly completely out of the box from the .deb
packages, the targeted email alerting is the only thing I've changed.
The manager, dashboard, and other components are on a VM set up for
this, and there's only one agent.

The first section of ossec.conf is as below:

====

<ossec_config>
<global>
<jsonout_output>yes</jsonout_output>
<alerts_log>yes</alerts_log>
<logall>no</logall>
<logall_json>no</logall_json>
<email_notification>yes</email_notification>
<smtp_server>127.0.0.1</smtp_server>
<email_from>[default contact]</email_from>
<email_maxperhour>12</email_maxperhour>
<email_log_source>alerts.log</email_log_source>
<agents_disconnection_time>10m</agents_disconnection_time>
<agents_disconnection_alert_time>0</agents_disconnection_alert_time>
</global>

<alerts>
<log_alert_level>3</log_alert_level>
<email_alert_level>4</email_alert_level>
</alerts>

<email_alerts>
<level>7</level>

<email_to>[targeted contact A]</email_to>
</email_alerts>

====

Everything else further down is unchanged.

I've had an ongoing run of level 5 events (SSH probes), which seem to be
accumulated until there's a level 7 event that generates an email. In
some cases this has been several hundred level 5 events, with one level
7 buried somewhere in the message.

-kgd

> --
> You received this message because you are subscribed to the Google
> Groups "Wazuh | Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to wazuh+un...@googlegroups.com
> <mailto:wazuh+un...@googlegroups.com>.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/wazuh/4ae203da-b06f-45ac-b69c-d80aab2d81b6n%40googlegroups.com
> <https://groups.google.com/d/msgid/wazuh/4ae203da-b06f-45ac-b69c-d80aab2d81b6n%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Natalia Castillo]

Hi!

Thank you for your patience. I'm doing some testing to see what might be causing the issue that you are presenting. I'll come back to you as soon as i have a definitive answer and solution.

[Kris Deugau]

After further local testing and reading up on possibly sending mail by
script triggered from the "integrator" subsystem
(https://wazuh.com/blog/how-to-integrate-external-software-using-integrator/)
we've decided, for production use, to disable the basic alerting as
unsuited to our requirements.

Instead, we wrote a script to tail the alerts.json log and extract
multiple configurable slices of events for multiple contacts/contact
groups, as should theoretically be possible with an expansion of
ossec.conf based on below.

I also noticed a bug in the email processing - if you do not specify a
global <email_to>, the code will continue to attempt sending ALL
emailable alerts based on the <alert><email_alert_level> threshold, but
just skips the "RCPT TO:" SMTP command, leaving an ongoing stream of
errors in the mail log.

> https://groups.google.com/d/msgid/wazuh/c4f4d914-70f9-43b8-8820-1d667da36a69n%40googlegroups.com
> <https://groups.google.com/d/msgid/wazuh/c4f4d914-70f9-43b8-8820-1d667da36a69n%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Natalia Castillo]

Hi!

It's great to hear that you've found a solution that better fits your requirements by tailing the alerts.json log and processing it with a custom script. This approach allows you to have more fine-grained control over the alerts and distribute them to multiple contacts or contact groups as needed.

Regarding the bug you've identified in the email processing when a global <email_to> is not specified, it's essential to bring attention to such issues. You can report the bug on the Wazuh GitHub repository. Providing details about the bug and steps to reproduce it will help the developers address the issue more effectively.

Sorry for the inconvenience and thanks for using wazuh!