Group rules into one mail

[Unai]

Good morning,

I am making decoders and rules for Veeam Decoy. I want to group two rules from two different logs to send as one mail.

I get these two logs:

2026-07-10T14:19:01.920388+02:00 localhost python3 9068 - - <20>1 2026-07-10T14:19:01 localhost.localdomain ssh_honeypot - - - 2026-07-10T14:19:01.919360 SSH_CONNECTION source=1.1.1.1:61591 destination=2.2.2.2:22

2026-07-15T14:23:00.236235+02:00 localhost python3 9068 - - <20>1 2026-07-15T14:23:00 localhost.localdomain ssh_honeypot - - - Auth attempt - Username: testuser, Password: test

These are my decoders and rules:

<decoder name="ssh_honeypot">
  <prematch>ssh_honeypot</prematch>
</decoder>

<decoder name="ssh_honeypot">
  <parent>ssh_honeypot</parent>
  <regex>source=(\S+):(\S+)</regex>
  <order>sourceIP,sourcePORT</order>
</decoder>

<decoder name="ssh_honeypot">
  <parent>ssh_honeypot</parent>
  <regex>destination=(\S+):(\S+)</regex>
  <order>destinationIP,destinationPORT</order>
</decoder>

<decoder name="ssh_honeypot">
  <parent>ssh_honeypot</parent>
  <regex>Password:\s(\S+)</regex>
  <order>password</order>
</decoder>

<decoder name="ssh_honeypot">
  <parent>ssh_honeypot</parent>
  <regex>Username:\s(\S+)</regex>
  <order>username</order>
</decoder>

<rule id="101300" level="2" noalert="1">
                <decoded_as>ssh_honeypot</decoded_as>
                <description>Logs Honeypot SSH</description>
        </rule>                            
                               
       
        <rule id="101302" level="5">
                <if_sid>101300</if_sid>
                <regex>SSH_CONNECTION</regex>
                <description>Conexión SSH desde "$(sourceIP):$(sourcePORT)" a "$(destinationIP):$(destinationPORT)"</description>
                <mitre>
                  <id>T1595.001</id>
                  <id>T1046</id>
                </mitre>
        </rule>
       
       
        <rule id="101304" level="10">
                <if_sid>101300</if_sid>
                <regex>Auth attempt</regex>
                <description>Intento de autenticación por SSH. Usuario: "$(username)". Contraseña: "$(password)".</description>
                <mitre>
                  <id>T1078</id>
                  <id>T1110</id>
                  <id>T1110.001</id>
                </mitre>
        </rule>

How can i group these two rules as one rule and send a mail with IP info and username info?

[Md. Nazmur Sakib]

Hi Unai,

You can achieve your use case by making a custom mail integration.

Custom integration

I will explain to you step by step what you need to do.

First, configure an SMTP mail server on the wazuh-server node.

Check this document to configure the SMTP server.

SMTP server with authentication

Next, create a file named /var/ossec/integrations/custom-email.py
And add this script to the Python file.


#!/usr/bin/env python3

import sys

import json

import requests

from requests.auth import HTTPBasicAuth

from requests.auth import HTTPBasicAuth

import smtplib

from email.mime.multipart import MIMEMultipart

from email.mime.text import MIMEText

from datetime import datetime

import urllib3

import logging

#configuration

SMTP_SERVER = '127.0.0.1'

SMTP_PORT = 25

SENDER_EMAIL = 'xx...@gmail.com'  #SENDER EMAIL ADDRESS

RECEIVER_EMAIL = 'xx...@gmail.com'  #RECEIVER EMAIL ADDRESS

logging.basicConfig(filename='/var/ossec/logs/custom-email_integration.log',

                    filemode='a',

                    format='%(asctime)s,%(msecs)d %(name)s %(levelname)s %(message)s',

                    datefmt='%Y-%m-%dT%H:%M:%S',

                    level=logging.DEBUG)

try:

    # Reading configuration parameters

    logging.info("Reading config parameters")

    alert_file = open(sys.argv[1])

except Exception as e:

    logging.error("Failed to read config parameters: %s", str(e))

try:

    # Read the alert file

    logging.info("Reading the alert file")

    alert_json = json.loads(alert_file.read())

    alert_file.close()

except Exception as e:

    logging.error("Failed to read the alert file: %s", str(e)) 

try:

    #Extract issue fields

    logging.info("Extracting the issue fields")

    timestamp = alert_json['timestamp']

    location = alert_json['location']

    alert_level = alert_json['rule']['level']

    rule_id = alert_json['rule']['id']

    description = alert_json['rule']['description']

    agent_id = alert_json['agent']['id']

    rule_level = alert_json['rule']['level']

    agent_name = alert_json['agent']['name']

    alert_data = alert_json.get('data', {})

    source_ip = alert_data.get('sourceIP')

    destination_ip = alert_data.get('destinationIP')

    username = alert_data.get('username')

    password = alert_data.get('password')

except Exception as e:

    logging.error("Failed extracting the issue fields: %s", str(e))

# Generate request

try:

    logging.info("Creating the email message")

    data = f"""Wazuh Notification.

{timestamp}

Received From: {location}

Rule: {rule_id}(level {rule_level}) -> {description}

Agent: {agent_name}({agent_id})

"""

    if source_ip:

        data += f"Source IP: {source_ip}\n"

    if destination_ip:

        data += f"Destination IP: {destination_ip}\n"

    if username:

        data += f"Username: {username}\n"

    if password:

        data += f"Password: {password}\n"

    data += "\nEND OF NOTIFICATION"

    message = MIMEMultipart()

    message['From'] = SENDER_EMAIL

    message['To'] = RECEIVER_EMAIL

    message['Subject'] = 'Alert Notification'

    message.attach(MIMEText(data, 'plain'))

    with smtplib.SMTP(SMTP_SERVER, SMTP_PORT) as server:

        server.send_message(message)

    logging.info("Email sent successfully!")

except Exception as e:

    logging.error("Failed to send email: %s", str(e))

sys.exit(0)

In the script, update the
SENDER_EMAIL = 'xx...@gmail.com'  #SENDER EMAIL ADDRESS

RECEIVER_EMAIL = 'xx...@gmail.com'  #RECEIVER EMAIL ADDRESS

Set the correct permissions and ownership to the integration script:

Use the following commands:

chown root:wazuh /var/ossec/integrations/custom-email.py 

chmod 750 /var/ossec/integrations/custom-email.py

Adding the integration configuration

Add the following block in your manager’s configuration inside the 

<ossec_config> block:

<integration>

 <name>custom-email.py</name>

 <rule_id>101304,101302</rule_id>

 <alert_format>json</alert_format>

 <options>JSON</options>

</integration>

Restart the Wazuh manager service:

systemctl restart wazuh-manager

Now you should get the fields you are looking for in your mail. You can review the script to have a better understand who these fields are forwarded form alerts.json.

Screenshot of test results:


Let me know if this works for you.