Email Configuration

Some applications rely on having a mail server in the OS itself and other applications (like Wazuh) have their own mail configuration and so they don’t rely on a mail server in the OS itself.

Operating System

You can install and configure your favorite mail server. Depending on your needs, this could be something simple like nullmailer or something more complex like exim4.

Wazuh

If you want Wazuh to send email, you can modify /opt/so/conf/wazuh/ossec.conf as follows:

<global>
<email_notification>yes</email_notification>
<email_to>YourUsername@YourDomain.com</email_to>
<smtp_server>YourMailRelay.YourDomain.com</smtp_server>
<email_from>ossec@YourDomain.com</email_from>
<email_maxperhour>100</email_maxperhour>
</global>

Then restart Wazuh:

sudo so-wazuh-restart

You can specify the severity of an event for which Wazuh will send email alerts by specifying an appropriate value for email_alert_level in /opt/so/conf/wazuh/ossec.conf. If you notice email_alert_level is not being respected for a certain rule, it may be that the option is overridden by <options>alert_by_email</options> being set for a rule. You can modify this behavior in /opt/so/conf/wazuh/rules/local_rules.xml.

You can also find an explanation of the alert levels at https://www.ossec.net/docs/manual/rules-decoders/rule-levels.html.

Zeek

Edit /opt/so/conf/zeek/zeekctl.cfg and set the following:

MailTo = YourUsername@YourDomain.com
sendmail = /usr/sbin/sendmail

Then update and restart Zeek:

sudo so-zeek-restart

You should then start receiving hourly connection summary emails. If you don’t want the connection summary emails, you can add the following to zeekctl.cfg and update and restart Zeek as shown above:

tracesummary=

You may want to receive emails for Zeek notices. To do that, add the following to /opt/so/conf/zeek/local.zeek and then update/restart Zeek as shown above:

hook Notice::policy(n: Notice::Info)
{
add n$actions[Notice::ACTION\_ALARM];
}

Also see http://mailman.icsi.berkeley.edu/pipermail/bro/2013-December/006418.html.

Elastalert

Follow the steps on the Elastalert page.

Lack of network traffic

If you configured Zeek as shown above, they should automatically email you if your network sensors stop seeing traffic.