SOC Dashboard Alerts to Email

[od-john]

Is it possible to configure the alerts on the dashboard to be sent to email? I can't find any information on how to go about setting this up.

[GuardianCosmos]

Have you tried the following from the docs yet?
https://docs.securityonion.net/en/2.3/elastalert.html#email---internal

[od-john]

To be clear I understand the smtp settings portion, I just don't understand how I am telling it what to send (i.e. the main dashboard alerts).

[od-john]

To further clarify, these are the alerts I am referring to: https://docs.securityonion.net/en/2.3/alerts.html#alerts

[GuardianCosmos]

You follow the steps and instructions posted, if that doesn't make sense to you, and I mean absolutely no ill will by this, you may want to reconsider whether or not this is the right solution for you, or whether you want to engage the security onion support and consulting team (I am not a member, I'm just another end user) , or revisit the manual in full, the Alerts in the tab you are referencing is Elastalert, as described in the Getting Started section of the documentation

If you are having issues understanding the documentation, you may be better served by engaging in professional support which would handhold you through the process, as setting up the alert notification is among the easier tasks associated with maintaining and using this distribution.

[od-john]

So I need to create a separate rule for every possible type of alert that might pop up on the dashboard? This is the part that's confusing me, there is no way to set a global rule that blanket covers any possible alert?

[GuardianCosmos]

As mentioned in my first comment on this thread, by default, it will send all alerts that are configured in Elastalert, which is the section to which you are referring, if you want to customize that you would need to do so by customizing the Elastalert configs following the separate standard Elastalert docs https://elastalert.readthedocs.io/en/latest/elastalert.html#overview

All of this is detailed on the linked page and explained, so please ensure you are reading the full page which explains that by default it will alert on all stored queries, the reference to the Elastalert documentation, and the location in security onion configuration file if you wish to further customize the alerts which notify and are forwarded.

Please also note the "Defaults" section on that page which contains the edit to the master rule required if you would like the alerts to include more than just the offense count

[Git-Me-Some-Hub]

@GuardianCosmos I am still a little confused on the specific files I either need to create or need to modify. Maybe, like you said, I am not smart enough to put this together, but I would like to think I have the capability to read through this and I am just not seeing it mesh.

1. Do I put the a new file with the ext-smtp configuration in root /opt/so/rules/elastalert/ - Because nothing is there now.
2. Do I put the a new file with the ext-smtp configuration in root /opt/so/rules/elastalert/playbook with the other 3 default templates?
3. Do I modify one of the other default template files in /opt/so/rules/elastalert/playbook because those are what it is looking for?
4. For the smtp auth file, doe it matter where it lives, I currently do not see that folder there? /etc/elastalert/rules/
5. Do I need to restart ElasticAlert for it to read the new alert configurations?

[GuardianCosmos]

1 - Yes you would need to create the file there if you have not already done so,
If you aren't sure how to write the rule, there is a helper script if you run so-elastalert-create which should walk you through making the file and give you an output based on the questions as you answer them (this will only work for more basic alerts but is a good start)
You would then put the different configurations in either the same file or separate files in that directory pending how you prefer to organize, when loading it looks to load any .yaml file in that directory which matches expected format
The rules in the playbook folder are specific to rules you might have configured for alert via playbook, and if you wish to tune those you may do so as well
4 - for smtp auth file you will want to create the file in the same directory with a .txt extension

None of these files will exist by default unless you had previously created or enabled them
Restarting Elastalert will ensure the changes are loaded yes and also provide you with any errors in the logs if something in your config files is wrong

[Git-Me-Some-Hub]

Cheers, I will get right on that. Thank you very much.

[corycandia]

All,

I guess I'm trying to get a grip on how this works also.

I am right where the OP was wanting emails.

Do I understand correctly that there is not really a mechanism to configure the manager in such a way that anything that would pop up in the 'Alerts' section generates an email?

1. Do you have to modify or generate a custom file for every alert you want an email from?

This is a relatively new install that I am still tuning:

Would I need to configure something for each of these alerts to trigger an email being sent, or does following the instructions for running 'so-elastalert-create' implement something that sends emails for all or entire categories of alerts?

[dougburks]

Perhaps the first question to ask is: do you really want 5,763 emails (the total number of alerts based on your screenshot)?

[corycandia]

@dougburks,

If memory serves, did you guys do script for sguil to do unique + a snooze period (in previous 16)?

I know this is Elastalert vs sguil, but I wonder if the same thing can be accomplished?

I guess a direct answer would be 'no, probably not 5K emails, maybe just six emails at the time of detection, snoozed for some period of time, like an hour in case more detection occur?'

I'm really not familiar with Elastalert enough yet to know if this is easily do-able. Is there an alert action (email) that could be setup for when ever this view pulls results that could be refined to the above rather than creating an alert for individual findings?

[dougburks]

ElastAlert is fairly flexible. I'd encourage you to try it out.

This discussion has been marked as answered. If you have other questions or problems, please start a new discussion.