ossec.conf: Granular Email options¶

Overview¶

Supported types¶

Global options are available in the the following installation types:

server
local

Notes¶

Global email configuration is necessary to use the granular email options.

Location¶

All global options must be configured in the /var/ossec/etc/ossec.conf and used within the <ossec_config> tag.

XML excerpt to show location:

<ossec_config>
    <email_alerts>
        <!--
        Email_alerts options here
        -->
    </email_alerts>
</ossec_config>

Options¶

email_alerts¶

email_to¶

E-Mail recipients of alerts

Allowed: Any valid e-mail address

level¶

Minimum alerting level to forward the e-mails.

Allowed: Any alert level 0 to 16

Note

level should be set at or above the email_alert_level in the <alerts> section of the configuration.

group¶

The alert that must match this group to be forwarded. Multiple groups can be separated with a pipe character (“|”).

Allowed: One or more groups or categories.

event_location¶

The alert must match this event location to be forwarded. If multiple <event_location> options are specified, the last will be used.

Allowed: Any single agent name, hostname, ip address, or log file

format¶

Specifies the format of the e-mail

full: for normal e-mails
sms: for reduced size suitable for SMS

Default: full

Allowed: full/sms

rule_id¶

Option to send granular emails based on rule id.

Allowed: One or more rule IDs can be used here, separated by a comma and space (``, ``).

Example:

<rule_id>5701, 5702</rule_id>

do_not_delay¶

Option to send the e-mail right away (no delay).

Example:

<do_not_delay />

do_not_group¶

Option to do not group alerts for this e-mail.

Example:

<do_not_group />

Examples¶

Example email alerts configurations:¶

Global Configuration:¶

<global>
  <email_notification>yes</email_notification>
  <email_to>admin@example.com</email_to>
  <smtp_server>127.0.0.1</smtp_server>
  <email_from>ossecm@example.com</email_from>
</global>

Global Configuration with a larger maximum emails per hour:¶

<global>
  <email_notification>yes</email_notification>
  <email_to>admin@example.com</email_to>
  <smtp_server>127.0.0.1</smtp_server>
  <email_from>ossecm@example.com</email_from>
  <email_maxperhour>100</email_maxperhour>
</global>

Granular Email alert: Level 12 and above:¶

<email_alerts>
  <email_to>other_admin@example.com</email_to>
  <level>12</level>
</email_alerts>

Syscheck alerts to syscheck admin address:¶

<email_alerts>
  <email_to>syscheck-admin@example.com</email_to>
  <group>syscheck</group>
</email_alerts>

Level 15 alerts from agent007 without delay or grouping:¶

<email_alerts>
  <email_to>bond@example.com</email_to>
  <event_location>agent007</event_location>
  <level>15</level>
  <do_not_delay />
  <do_not_group />
</email_alerts>