Elastalert Will not send Email Alerts to multiple Email Addresses

[BackLog96]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

18

RAM

32GB

Storage for /

500GiB

Storage for /nsm

4.5TiB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,

During setup of our IDH nodes, we imported playbooks and modified the YAML files (/opt/so/rules/elastalert/playbook) for each Elastalert configuration surrounding the events. When I enter a single email address, it works great! I get the emails for each of the events within a few minutes of the event happening, and so-elastalert-test completes successfully.

However, I notice that although it appears to be supported in the Elastalert 2 documentation on their website https://elastalert2.readthedocs.io/en/latest/alerts.html#email it does not appear possible to have the alert send to more than one email address in the SecurityOnion version.

These are internal emails and we are sending them using the following in the YAML files:

smtp_host: "my_company_smtp_server"
smtp_port: 25
from_addr: "[email protected]"

I tried the following. No matter how I write it out, the first email in the list will get the email, and none of the others will.

alert:
- "email"
email:
- "[email protected]"
- "[email protected]"
- "[email protected]"

alert:
- "email"
email:
- "[email protected]"
email:
- "[email protected]"
email:
- "[email protected]"

alert:
- "email"
email:
- "[email protected]"
cc:
- "[email protected]"
- "[email protected]"

alert:
- "email"
email:
  - "[email protected]"
  - "[email protected]"
  - "[email protected]"

Is this just not supported, or is there a different way to format this in the SecurityOnion version of these alerts?

Thanks in advance!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[InfosecGoon]

Are there any errors or failures in the elastalert log (/opt/so/log/elastalert/elastalert,log)?

[jaypfe]

Is it possible to build a distribution group and email to the group?
I have deployed that successfully at my org.

Also also, not sure if this would help or not. But, in my instance, I built just one custom elastalert rule, that monitors the IDH alerts index and sends emails whenever one drops in there. I found it was easier upkeep, but you lose some of the granularity that way as well. Just thought I'd share what works for us!