Email alert Error

[cherryCokeBack]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

24

RAM

64

Storage for /

500go

Storage for /nsm

2to

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello All,

after several upgrades i don't care but i don't receive the alert mails via elastalert anymore

so I added my alert rule in the following folder: /opt/so/rules/elastalert/rules/custom/
file name: high.yaml
the file name is unique

Here are the contents of the file :

name: Alerte.High.Suricata
index: "logs-suricata-so-*" 

type: any

filter:
- query:
    query_string:
        query: "event.severity: >2"

alert_text_type: alert_text_only

alert:
- "email"

alert_text: "
*Number of hits*:       {11}\n
\n
*RULE*:\n
*Category*:     {5}\n
*Rulename*:     {6}\n
*Reference*:    {7}\n
\n
*SOURCE - DESTINATION*:\n
*Source*:       {0}:{1}\n
*Destination*:  {2}:{3}\n
*Protocole*:    {12}\n
*Timestamp*:    {4}\n
\n
*EVENT*\n
*Category*:     {8}\n
*Severity*:     {9}\n
*Sensor*:       {13}\n"

alert_text_args: ["source.ip", "source.port", "destination.ip", "destination.port", "@timestamp", "rule.category", "rule.name", "rule.reference", "event.category", "event.severity_label", "host.name", num_hits,"network.transport","observer.name"]

email:
- "receiver@xxxxxxxxx"
smtp_host: "xxxxxmail.protection.outlook.com"
smtp_port: 25
smtp_ssl: false
from_addr: "alerterting@xxxxxxxxxx"

with the so-elastalert-test command I get the following errors:

Traceback (most recent call):
  File “/usr/local/bin/elastalert-test-rule”, line 8, in <module>
    sys.exit(main())
             ~~~~^^
  File “ /usr/local/lib/python3.13/site-packages/elastalert/test_rule.py ”, line 511, in main
    test_instance.run_rule_test()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File “ /usr/local/lib/python3.13/site-packages/elastalert/test_rule.py ”, line 457, in run_rule_test
    rule_yaml = conf['rules_loader'].load_yaml(self.args.file)
  File “ /usr/local/lib/python3.13/site-packages/elastalert/loaders.py ”, line 269, in load_yaml
    loaded = self.get_yaml(current_path)
  File “ /usr/local/lib/python3.13/site-packages/elastalert/loaders.py ”, line 605, in get_yaml
    return read_yaml(filename)
  File “ /usr/local/lib/python3.13/site-packages/elastalert/yaml.py ”, line 6, in read_yaml
    with open(path) as f :
FileNotFoundError: [Errno 2] No such file or directory: '/opt/elastalert/rules/high.yaml'

Localisation smtp_auth_file.txt : /opt/so/rules/elastalert/

have you ever had the problem

Many thanks for your help

best regards

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.