A few gaps on tuning / email alerts

[wilmerism]

Hi all, apologies in advance - im 20+ years windows so not too hot on linux. Im really trying to follow the manuals etec. I am considering looking if i can buy 1 - 2 hours support time for this.

Ive followed the videos & read manuals
The video "" Security Onion Essentials - Alert Triage & Case Creation" on youtube says is more information on tuning. but im struggling to find this - I see the tuning section > https://docs.securityonion.net/en/2.3/managing-alerts.html but not clear to me.

Im looking to tune it to filter out some alerts and setup email alerting for high category.
Can someone point me to more specific video's documents please?

Specific questions >
Where do i go to stop a specific alert from a IP address? (is if BPF filter? ) - if so (or if not) is there some dedicated video somewhere on the subject (im struggling with https://docs.securityonion.net/en/2.3/bpf.html#bpf)

I want to setup email alerts when a high severity alert comes in. following this https://docs.securityonion.net/en/2.3/email.html#email do i setup "elastialert" or wasuh

Then following https://docs.securityonion.net/en/2.3/elastalert.html#email---internal
how do i edit the contents of ElastAlert rules are stored in /opt/so/rules/elastalert/.

[dougburks]

Im looking to tune it to filter out some alerts

From https://docs.securityonion.net/en/2.3/tuning.html:
To get the best performance out of Security Onion, you’ll want to tune it for your environment. Start by creating Berkeley Packet Filters (BPFs) to ignore any traffic that you don’t want your network sensors to process. Then tune your IDS rulesets. There may be entire categories of rules that you want to disable first and then look at the remaining enabled rules to see if there are individual rules that can be disabled.

Can someone point me to more specific video's documents please?
Specific questions >
Where do i go to stop a specific alert from a IP address? (is if BPF filter? ) - if so (or if not) is there some dedicated video somewhere on the subject (im struggling with https://docs.securityonion.net/en/2.3/bpf.html#bpf)

Here's our BPF video:
https://youtu.be/uamNOjtUi4Y

I want to setup email alerts when a high severity alert comes in. following this https://docs.securityonion.net/en/2.3/email.html#email do i setup "elastialert" or wasuh

Depends on your goal. Wazuh is primarily for endpoint logs. ElastAlert can be used for either endpoint logs or network traffic. Also take a look at Playbook:
https://docs.securityonion.net/en/2.3/playbook.html

[wilmerism]

many thanks