How to Send Email Notifications with Wazuh#

1
<ossec_config>
2
  <global>
3
    <email_notification>yes</email_notification>
4
    <smtp_server>localhost</smtp_server>
5
    <email_from>wazuhtest@testserver.com</email_from>
6
    <email_to>destinationMail@testserver1.com</email_to>
7
    <email_maxperhour>12</email_maxperhour>
8
  </global>
9

10
  <alerts>
11
    <email_alert_level>9</email_alert_level>
12
  </alerts>
13
</ossec_config>

1
<ossec_config>
2
  <!-- Apache-specific alerts -->
3
  <email_alerts>
4
    <email_to>security-team@company.com</email_to>
5
    <email_to>apache-admin@company.com</email_to>
6
    <rule_id>30309, 30310</rule_id>
7
    <do_not_delay />
8
  </email_alerts>
9

10
  <!-- Critical security alerts -->
11
  <email_alerts>
12
    <email_to>soc@company.com</email_to>
13
    <level>12</level>
14
    <do_not_delay />
15
    <do_not_group />
16
  </email_alerts>
17

18
  <!-- Specific agent alerts -->
19
  <email_alerts>
20
    <email_to>server-admin@company.com</email_to>
21
    <group>authentication_failed</group>
22
    <agent_id>005</agent_id>
23
  </email_alerts>
24
</ossec_config>

1
<ossec_config>
2
  <alerts>
3
    <email_alert_level>7</email_alert_level>
4
    <email_alert_group>authentication_failures,web_scan</email_alert_group>
5
    <email_delay>300</email_delay>
6
    <email_delay_level>10</email_delay_level>
7
  </alerts>
8
</ossec_config>

1
<ossec_config>
2
  <localfile>
3
    <log_format>apache</log_format>
4
    <location>/var/log/apache2/access.log</location>
5
  </localfile>
6

7
  <localfile>
8
    <log_format>apache</log_format>
9
    <location>/var/log/apache2/error.log</location>
10
  </localfile>
11
</ossec_config>

1
<!-- Override existing rule to add email alerts -->
2
<rule id="30309" level="7" overwrite="yes">
3
  <if_sid>30301</if_sid>
4
  <id>AH01618|AH01808|AH01790</id>
5
  <options>alert_by_email</options>
6
  <description>Apache: Attempt to login using a non-existent user.</description>
7
  <group>invalid_login,pci_dss_11.4,pci_dss_10.2.4,pci_dss_10.2.5,gpg13_7.1,gdpr_IV_35.7.d,gdpr_IV_32.2,</group>
8
</rule>
9

10
<!-- Custom rule for multiple failures -->
11
<rule id="100001" level="12" frequency="8" timeframe="120">
12
  <if_matched_sid>30310</if_matched_sid>
13
  <description>Multiple user authentication failures</description>
14
  <group>authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,gpg13_7.1,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.3.1,nist_800_53_IA.10,</group>
15
</rule>

1
<email_alerts>
2
  <email_to>webmaster@company.com</email_to>
3
  <email_to>security@company.com</email_to>
4
  <rule_id>30309, 100001</rule_id>
5
  <do_not_delay />
6
</email_alerts>

1
<ossec_config>
2
  <global>
3
    <smtp_server>smtp1.company.com</smtp_server>
4
    <smtp_server>smtp2.company.com</smtp_server>
5
    <email_from>wazuh@company.com</email_from>
6
    <email_idsname>Wazuh Security Platform</email_idsname>
7
  </global>
8
</ossec_config>

1
<!-- Time-based alerts -->
2
<email_alerts>
3
  <email_to>oncall@company.com</email_to>
4
  <level>10</level>
5
  <time>6:00 pm - 8:00 am</time>
6
  <do_not_delay />
7
</email_alerts>
8

9
<!-- Weekday-specific alerts -->
10
<email_alerts>
11
  <email_to>weekend-team@company.com</email_to>
12
  <level>7</level>
13
  <weekday>saturday,sunday</weekday>
14
</email_alerts>
15

16
<!-- Location-based alerts -->
17
<email_alerts>
18
  <email_to>dmz-team@company.com</email_to>
19
  <group>dmz_hosts</group>
20
  <location>dmz-*</location>
21
</email_alerts>

1
<!-- Aggregate similar alerts -->
2
<email_alerts>
3
  <email_to>security@company.com</email_to>
4
  <rule_id>5503</rule_id> <!-- Failed SSH login -->
5
  <format>full</format>
6
  <email_delay>600</email_delay> <!-- 10 minutes -->
7
  <email_delay_level>7</email_delay_level>
8
</email_alerts>
9

10
<!-- Summary reports for low-priority events -->
11
<email_alerts>
12
  <email_to>reports@company.com</email_to>
13
  <level>3</level>
14
  <format>sms</format> <!-- Compact format -->
15
  <email_delay>3600</email_delay> <!-- Hourly -->
16
</email_alerts>

1
<!-- Immediate critical alerts -->
2
<email_alerts>
3
  <email_to>incident-response@company.com</email_to>
4
  <email_to>ciso@company.com</email_to>
5
  <rule_id>100200</rule_id> <!-- Data exfiltration -->
6
  <do_not_delay />
7
  <do_not_group />
8
  <format>full</format>
9
</email_alerts>
10

11
<!-- Active response triggered -->
12
<email_alerts>
13
  <email_to>security-ops@company.com</email_to>
14
  <group>active_response</group>
15
  <do_not_delay />
16
</email_alerts>

1
<ossec_config>
2
  <global>
3
    <!-- Global rate limit -->
4
    <email_maxperhour>100</email_maxperhour>
5

6
    <!-- Per-recipient limits -->
7
    <email_maxperhour>
8
      <email_to>user1@company.com</email_to>
9
      <maxperhour>20</maxperhour>
10
    </email_maxperhour>
11

12
    <email_maxperhour>
13
      <email_to>critical-alerts@company.com</email_to>
14
      <maxperhour>200</maxperhour>
15
    </email_maxperhour>
16
  </global>
17
</ossec_config>

1
#!/usr/bin/env python3
2
# email_to_ticket.py - Convert Wazuh emails to tickets
3

4
import email
5
import imaplib
6
import json
7
import requests
8

9
def process_wazuh_emails():
10
    """Process Wazuh alert emails and create tickets"""
11

12
    # Connect to email
13
    mail = imaplib.IMAP4_SSL('imap.gmail.com')
14
    mail.login('wazuh-alerts@company.com', 'password')
15
    mail.select('inbox')
16

17
    # Search for Wazuh alerts
18
    _, search_data = mail.search(None, 'UNSEEN', 'FROM', 'wazuh@company.com')
19

20
    for num in search_data[0].split():
21
        _, data = mail.fetch(num, '(RFC822)')
22
        email_body = data[0][1]
23
        email_message = email.message_from_bytes(email_body)
24

25
        # Parse alert details
26
        alert_data = parse_wazuh_alert(email_message)
27

28
        # Create ticket
29
        create_ticket(alert_data)
30

31
        # Mark as read
32
        mail.store(num, '+FLAGS', '\\Seen')
33

34
def parse_wazuh_alert(email_message):
35
    """Extract alert information from email"""
36

37
    body = email_message.get_payload()
38

39
    # Extract key fields (customize based on your email format)
40
    alert = {
41
        'subject': email_message['Subject'],
42
        'timestamp': email_message['Date'],
43
        'body': body,
44
        'severity': extract_severity(body),
45
        'agent': extract_agent(body),
46
        'rule': extract_rule(body)
47
    }
48

49
    return alert
50

51
def create_ticket(alert_data):
52
    """Create ticket in ticketing system"""
53

54
    ticket = {
55
        'title': f"Wazuh Alert: {alert_data['subject']}",
56
        'description': alert_data['body'],
57
        'priority': map_severity_to_priority(alert_data['severity']),
58
        'tags': ['wazuh', 'security', alert_data['agent']],
59
        'custom_fields': {
60
            'alert_timestamp': alert_data['timestamp'],
61
            'wazuh_rule': alert_data['rule']
62
        }
63
    }
64

65
    # API call to ticketing system
66
    response = requests.post(
67
        'https://ticketing.company.com/api/tickets',
68
        json=ticket,
69
        headers={'Authorization': 'Bearer YOUR_API_TOKEN'}
70
    )
71

72
    return response.json()

1
#!/usr/bin/env python3
2
# enhanced_email.py - Add context to Wazuh email alerts
3

4
import json
5
import smtplib
6
from email.mime.multipart import MIMEMultipart
7
from email.mime.text import MIMEText
8
from email.mime.image import MIMEImage
9
import matplotlib.pyplot as plt
10
import requests
11

12
def send_enhanced_alert(alert_file):
13
    """Send enhanced email with additional context"""
14

15
    with open(alert_file) as f:
16
        alert = json.load(f)
17

18
    # Get additional context
19
    context = gather_alert_context(alert)
20

21
    # Create enhanced email
22
    msg = MIMEMultipart('related')
23
    msg['Subject'] = f"[{alert['rule']['level']}] {alert['rule']['description']}"
24
    msg['From'] = 'wazuh-enhanced@company.com'
25
    msg['To'] = get_recipients(alert)
26

27
    # Create HTML body
28
    html = create_enhanced_html(alert, context)
29
    msg.attach(MIMEText(html, 'html'))
30

31
    # Add trend chart
32
    chart_data = generate_trend_chart(alert)
33
    msg.attach(MIMEImage(chart_data, 'png'))
34

35
    # Send email
36
    smtp = smtplib.SMTP('localhost')
37
    smtp.send_message(msg)
38
    smtp.quit()
39

40
def gather_alert_context(alert):
41
    """Gather additional context for the alert"""
42

43
    context = {}
44

45
    # Get agent details
46
    agent_id = alert['agent']['id']
47
    response = requests.get(
48
        f"https://localhost:55000/agents/{agent_id}",
49
        auth=('wazuh', 'wazuh'),
50
        verify=False
51
    )
52
    context['agent_details'] = response.json()['data']
53

54
    # Get similar recent alerts
55
    response = requests.get(
56
        f"https://localhost:55000/alerts",
57
        params={
58
            'rule.id': alert['rule']['id'],
59
            'agent.id': agent_id,
60
            'limit': 10
61
        },
62
        auth=('wazuh', 'wazuh'),
63
        verify=False
64
    )
65
    context['recent_alerts'] = response.json()['data']['items']
66

67
    return context
68

69
def create_enhanced_html(alert, context):
70
    """Create enhanced HTML email body"""
71

72
    html = f"""
73
    <html>
74
    <head>
75
        <style>
76
            body {{ font-family: Arial, sans-serif; }}
77
            .header {{ background-color: #f8f9fa; padding: 20px; }}
78
            .alert-critical {{ color: #dc3545; }}
79
            .alert-high {{ color: #fd7e14; }}
80
            .alert-medium {{ color: #ffc107; }}
81
            .alert-low {{ color: #28a745; }}
82
            .details {{ margin: 20px 0; }}
83
            table {{ border-collapse: collapse; width: 100%; }}
84
            th, td {{ border: 1px solid #ddd; padding: 8px; text-align: left; }}
85
            th {{ background-color: #f2f2f2; }}
86
        </style>
87
    </head>
88
    <body>
89
        <div class="header">
90
            <h2 class="alert-{get_level_class(alert['rule']['level'])}">
91
                Wazuh Security Alert - Level {alert['rule']['level']}
92
            </h2>
93
        </div>
94

95
        <div class="details">
96
            <h3>Alert Details</h3>
97
            <table>
98
                <tr>
99
                    <th>Timestamp</th>
100
                    <td>{alert['timestamp']}</td>
101
                </tr>
102
                <tr>
103
                    <th>Agent</th>
104
                    <td>{alert['agent']['name']} ({alert['agent']['id']})</td>
105
                </tr>
106
                <tr>
107
                    <th>IP Address</th>
108
                    <td>{context['agent_details'].get('ip', 'N/A')}</td>
109
                </tr>
110
                <tr>
111
                    <th>Rule</th>
112
                    <td>{alert['rule']['id']} - {alert['rule']['description']}</td>
113
                </tr>
114
                <tr>
115
                    <th>Groups</th>
116
                    <td>{', '.join(alert['rule'].get('groups', []))}</td>
117
                </tr>
118
                <tr>
119
                    <th>Full Log</th>
120
                    <td><pre>{alert.get('full_log', 'N/A')}</pre></td>
121
                </tr>
122
            </table>
123
        </div>
124

125
        <div class="details">
126
            <h3>Recent Similar Alerts (Last 24 Hours)</h3>
127
            <p>Found {len(context['recent_alerts'])} similar alerts</p>
128
            <img src="cid:trend_chart" alt="Alert Trend">
129
        </div>
130

131
        <div class="details">
132
            <h3>Recommended Actions</h3>
133
            <ul>
134
                {generate_recommendations(alert)}
135
            </ul>
136
        </div>
137

138
        <hr>
139
        <p><small>This is an automated message from Wazuh Security Platform</small></p>
140
    </body>
141
    </html>
142
    """
143

144
    return html

1
#!/usr/bin/env python3
2
# email_metrics.py - Track email alert metrics
3

4
import sqlite3
5
import json
6
from datetime import datetime, timedelta
7
from collections import defaultdict
8

9
class EmailAlertMetrics:
10
    def __init__(self, db_path='/var/ossec/logs/email_metrics.db'):
11
        self.conn = sqlite3.connect(db_path)
12
        self.create_tables()
13

14
    def create_tables(self):
15
        """Create metrics tracking tables"""
16

17
        self.conn.execute('''
18
            CREATE TABLE IF NOT EXISTS email_alerts (
19
                id INTEGER PRIMARY KEY,
20
                timestamp DATETIME,
21
                recipient TEXT,
22
                rule_id INTEGER,
23
                level INTEGER,
24
                agent_id TEXT,
25
                delivered BOOLEAN,
26
                grouped BOOLEAN
27
            )
28
        ''')
29

30
        self.conn.execute('''
31
            CREATE TABLE IF NOT EXISTS email_stats (
32
                date DATE PRIMARY KEY,
33
                total_sent INTEGER,
34
                total_grouped INTEGER,
35
                total_delayed INTEGER,
36
                avg_level REAL
37
            )
38
        ''')
39

40
    def log_email_sent(self, alert_data):
41
        """Log email alert sent"""
42

43
        self.conn.execute('''
44
            INSERT INTO email_alerts
45
            (timestamp, recipient, rule_id, level, agent_id, delivered, grouped)
46
            VALUES (?, ?, ?, ?, ?, ?, ?)
47
        ''', (
48
            datetime.now(),
49
            alert_data['recipient'],
50
            alert_data['rule_id'],
51
            alert_data['level'],
52
            alert_data['agent_id'],
53
            True,
54
            alert_data.get('grouped', False)
55
        ))
56
        self.conn.commit()
57

58
    def generate_daily_report(self):
59
        """Generate daily email metrics report"""
60

61
        yesterday = datetime.now() - timedelta(days=1)
62

63
        # Get metrics
64
        cursor = self.conn.execute('''
65
            SELECT
66
                COUNT(*) as total,
67
                AVG(level) as avg_level,
68
                COUNT(DISTINCT recipient) as unique_recipients,
69
                COUNT(DISTINCT rule_id) as unique_rules
70
            FROM email_alerts
71
            WHERE DATE(timestamp) = DATE(?)
72
        ''', (yesterday,))
73

74
        metrics = cursor.fetchone()
75

76
        # Get top alerts
77
        cursor = self.conn.execute('''
78
            SELECT rule_id, COUNT(*) as count
79
            FROM email_alerts
80
            WHERE DATE(timestamp) = DATE(?)
81
            GROUP BY rule_id
82
            ORDER BY count DESC
83
            LIMIT 10
84
        ''', (yesterday,))
85

86
        top_alerts = cursor.fetchall()
87

88
        # Generate report
89
        report = {
90
            'date': yesterday.strftime('%Y-%m-%d'),
91
            'total_alerts': metrics[0],
92
            'average_level': round(metrics[1], 2),
93
            'unique_recipients': metrics[2],
94
            'unique_rules': metrics[3],
95
            'top_alerts': [
96
                {'rule_id': rule_id, 'count': count}
97
                for rule_id, count in top_alerts
98
            ]
99
        }
100

101
        return report

1
<!-- Optimize for high-volume environments -->
2
<ossec_config>
3
  <global>
4
    <!-- Increase rate limit for critical systems -->
5
    <email_maxperhour>500</email_maxperhour>
6

7
    <!-- Separate queues for different priorities -->
8
    <email_queue>
9
      <priority>high</priority>
10
      <maxperhour>100</maxperhour>
11
      <delay>0</delay>
12
    </email_queue>
13

14
    <email_queue>
15
      <priority>medium</priority>
16
      <maxperhour>200</maxperhour>
17
      <delay>300</delay>
18
    </email_queue>
19

20
    <email_queue>
21
      <priority>low</priority>
22
      <maxperhour>200</maxperhour>
23
      <delay>3600</delay>
24
    </email_queue>
25
  </global>
26
</ossec_config>

1
#!/usr/bin/env python3
2
# smart_grouping.py - Intelligent alert grouping
3

4
def group_similar_alerts(alerts):
5
    """Group similar alerts to reduce email volume"""
6

7
    groups = defaultdict(list)
8

9
    for alert in alerts:
10
        # Create grouping key
11
        key = (
12
            alert['rule']['id'],
13
            alert['agent']['id'],
14
            alert['rule']['level'],
15
            # Group by hour
16
            datetime.fromisoformat(alert['timestamp']).strftime('%Y-%m-%d %H:00')
17
        )
18
        groups[key].append(alert)
19

20
    # Generate summary emails
21
    summaries = []
22
    for key, group_alerts in groups.items():
23
        if len(group_alerts) > 5:  # Only group if more than 5 similar alerts
24
            summary = {
25
                'rule_id': key[0],
26
                'agent_id': key[1],
27
                'level': key[2],
28
                'time_window': key[3],
29
                'count': len(group_alerts),
30
                'first_seen': min(a['timestamp'] for a in group_alerts),
31
                'last_seen': max(a['timestamp'] for a in group_alerts),
32
                'sample_logs': [a['full_log'] for a in group_alerts[:3]]
33
            }
34
            summaries.append(summary)
35

36
    return summaries

1
<!-- Sanitize email content -->
2
<ossec_config>
3
  <global>
4
    <!-- Remove sensitive data from emails -->
5
    <email_log_source>no</email_log_source>
6
    <email_full_log>no</email_full_log>
7

8
    <!-- Use email allowlist -->
9
    <email_to_allowlist>/var/ossec/etc/email_allowlist.txt</email_to_allowlist>
10
  </global>
11
</ossec_config>

1
#!/usr/bin/env python3
2
# monitor_email_security.py - Monitor for email security issues
3

4
def check_email_security():
5
    """Monitor for potential email security issues"""
6

7
    issues = []
8

9
    # Check for plaintext passwords
10
    if os.path.exists('/etc/postfix/sasl_passwd'):
11
        if not os.path.exists('/etc/postfix/sasl_passwd.enc'):
12
            issues.append("Plaintext password file detected")
13

14
    # Check for unauthorized recipients
15
    with open('/var/ossec/logs/ossec.log') as f:
16
        for line in f:
17
            if 'Sending email to' in line:
18
                recipient = extract_recipient(line)
19
                if not is_authorized_recipient(recipient):
20
                    issues.append(f"Unauthorized recipient: {recipient}")
21

22
    # Check for email loops
23
    email_counts = defaultdict(int)
24
    # ... analyze logs for loops
25

26
    return issues