Scheduling Reporting Send To Email

[Robby Hunters]

Hi Wazuh Team,

Hope you're all doing well.

I want to ask if there is any documentation or guide on how to configure Wazuh to generate reports and send them automatically to email on a daily basis.

Currently:

• I have already configured the SMTP settings in ossec.conf

• I have tested alert notifications and I am successfully receiving alert emails

What I’m trying to achieve now is:

• Wazuh generates a report (alerts summary / security report / etc.)

• The report is sent automatically to my email every day (not only per-alert notifications)

Thanks a lot in advance

Best,

Robby

[Md. Nazmur Sakib]

Hi Robby,

You can configure <report> from the ossec.conf to get a daily summary report of your alerts.
Check this document for reference:
https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/reports.html


You can also create custom dashboards/visualizations and send them as a PDF report via mail using the opensearch-reporting-cli.

And you can automate this process with cornjob

It will give you more flexibility in making the report.

You have mentioned you have already configured the SMTP server. In this case, if you have a distributed deployment, specifically if the dashboard service is hosted on a different server than the other component, you need to install SMTP on the dashboard server node.

You can follow this document for step-by-step instructions
https://github.com/wazuh/integrations/tree/main/integrations/custom_dashboard_pdf_email_report


Let me know if you need any further assistance on this.

[Robby Hunters]

Hi Nazmur,

Thank you for the information.

I have a few questions regarding the reporting features:

1. For the dashboard reporting — is it possible to create reports for multiple dashboards, or is it limited to only one dashboard per configuration?

2. About the reporting feature under Discovery → Reporting — what is the main purpose of this feature?
   Is it meant for exporting raw data, generating summary reports, or something else?

Just want to understand the intended use and best practice for these features.

Regards,
Robby

[Md. Nazmur Sakib]

You can make changes to the script to send pdf report from multiple dashboards.

The reporting feature under Discovery → Reporting is used to Export data from
Dashboard, Visualization, Saved searches.

Check this document to learn more:
https://docs.opensearch.org/latest/reporting/report-dashboard-index/

Let me know if you need any further information on this.

[Robby Hunters]

Hi Nazmur,

Can i scheduling report using prebuild dashboard ? like threat hunting dashboard or office365 dashboard 

thanks,

Regards,

Robby

[Md. Nazmur Sakib]

If you are referring to the previously created custom dashboard. Yes, you can use them.

For the script to work, you will need the short link of the custom dashboard.

Let me know if you need any further information on this.

[Robby Hunters]

Hi Nazmur,

Thank you, I already managed to create a scheduled dashboard report and send it to email using the documentation you shared before and it works.

I just want to ask, is it also possible to create a scheduled report for Threat Hunting or FIM in PDF format?
Something similar to the dashboard report, but based on Threat Hunting or FIM Generating Report (like in the image I attached).

[Md. Nazmur Sakib]

It is not possible to make the same report. But you can make a similar custom dashboard for Threat Hunting or FIM and make a pdf report.

You can check this document for creating a custom dashboard:

Creating custom dashboards

Check the screenshot for reference:


I am also sharing an ndjson file of this dashboard so that you can explore how I have configured it and make the additional adjustments by yourself.

To import this dashboard, you need to go to

Stack Management / Dashboard Management  → Saved Object, click on Import, and import the ndjson files there that I have attached.

Let me know if you need any further information.