Send emails with ElastAlert

[mohasmr]

Version

2.4.80

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

300GB

Storage for /nsm

204 GB

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

i tried to work with ElastAlert to send alerts on mail with following this discussions #12474
i prepared the script in the command /usr/local/bin/so-email-alerts.sh as you can see

the script work properly with manual excution and i receive email

but when i tried this playbook i didn't receive any email??

i dont think i have a problem in this log and the rule run correctly but the rule dosen't run the command

Please to guide me if i did something wrong

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[thall29349]

I ran into a similar issue. After the detections update I had to move my custom rules to the following directory to get them to trigger.

/opt/so/rules/elastalert/rules/custom

Hope this helps

[mohasmr]

[root@manager log]# cat /opt/so/rules/elastalert/rules/custom/email-test-alert2.yml
type: frequency
es_host: 172.16.135.42
es_port: 9200
index: ".ds-logs-*"

num_events: 1
timeframe:
minutes: 1

filter:

• term:
  rule.name: "Renamed ZOHO Dctask64 Execution"

realert:
minutes: 0

alert:

• command
  command: "/usr/local/bin/so-email-alerts.sh"

pipe_alert_text: true

[root@manager elastalert]# tail -f * | grep --binary-files=text email-test-alert2.yml
2024-07-24 09:39:01,404 INFO elastalert Ran /opt/elastalert/rules/rules/custom/email-test-alert2 from 2024-07-24 09:26 UTC to 2024-07-24 09:36 UTC: 7362 query hits (2853 already seen), 4509 matches, 4509 alerts sent
2024-07-24 09:39:01,404 INFO elastalert /opt/elastalert/rules/rules/custom/email-test-alert2 range 600
2024-07-24 09:39:01,419 INFO apscheduler.executors.default Job "Rule: /opt/elastalert/rules/rules/custom/email-test-alert2 (trigger: interval[0:03:00], next run at: 2024-07-24 09:39:39 UTC)" executed successfully
2024-07-24 09:39:39,939 INFO apscheduler.executors.default Running job "Rule: /opt/elastalert/rules/rules/custom/email-test-alert2 (trigger: interval[0:03:00], next run at: 2024-07-24 09:42:43 UTC)" (scheduled at 2024-07-24 09:39:39.939457+00:00)

the command still not executed and i didnt receive mail any suggest please

[thall29349]

Here is the rule I use to send emails and it works fine. I do use the built in email function and not a command. Also I use "query" instead of "term" for the filter. If you still wanna use the script you will also need to move it to /opt/so/conf/elastalert/custom so it gets included in the docker container. The path inside the container will be /opt/elastalert/custom so adjust your rule accordingly.

type: any
query_key: [rule.name, event_data.agent.name]
filter:
- query:
    query_string:
      query: sigma_level:(high OR critical)
alert:
 - email:
     from_addr: "[email protected]"
     email: "[email protected]"
     smtp_host: "SMTP_SERVER"
     smtp_port: 25
alert_subject: "{0} triggered on {1}"
alert_subject_args:
- rule.name
- event_data.agent.name```

[mohasmr]

first i want to say thank you ,so i tried your rule with some customization to match my logs and it works but the mail still not sent.
the question here is the external email need security onion pro as the documentation say ,how the rule will send the email without mail sender?

as you mentioned for the script i put it in this path /usr/local/bin/so-email-alerts.sh but i add also this line :

• /usr/local/bin/so-email-alerts.sh:/usr/local/bin/so-email-alerts.sh:ro
  in /opt/so/saltstack/default/salt/elastalert/enabled.sls

but sadly still no results 👎