Occasionally I see questions on the OSSEC mailing list on how to send a bunch of alerts only to a specific email address. An example for a typical use case would be different departments responsible for different groups of servers and having alerts only go to them. OSSEC has a few options for sending Alerts to specific email addresses, but it only adds those email addresses to the alert (meaning it always goes to the global email address). Sometimes this isn’t desirable.
A workaround is setting the global email recipient to a blackhole email address (something that is aliased to /dev/null on the mail server) and only using the granular settings for delivering mail.
1 2 3 4 5 6 7 8 9 10 11 12 13 | <ossec_config> <global> <email_notification>yes</email_notification> <smtp_server>127.0.0.1</smtp_server> <email_to>dev-null@email.domain</email_to> <email_from>ossec@ossec.server</email_from> </global> <email_alerts> <email_to>ossec-admins@email.domain</email_to> <level>7</level> </email_alerts> </ossec_config> |
You can then use attributes like the rule ID, group names, or event locations to split up alerts to different recipients. The downside is that by doing this, you will miss alerts with <options>alert_by_email</options> and a low level, unless you add a few granular email alerts. Rule 1002 (catch-all $BAD_WORDS) is a good candidate you will want to keep on receiving. Rules 501-504 (OSSEC agent/master status alerts) could also be interesting; either add an <email_alert> for each rule individually, or overwrite the rules adding <group>ossec,</group> to then, so you can add one <email_alert> for the group of rules.
We use this system pretty extensively assigning alerts to email groups by <event_location> and/or <group>
An example for the email block could look like this:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 | <ossec_config> <global> <email_notification>yes</email_notification> <smtp_server>127.0.0.1</smtp_server> <email_to>dev-null@email.domain</email_to> <email_from>ossec@ossec.server</email_from> </global> <alerts> <log_alert_level>1</log_alert_level> <email_alert_level>7</email_alert_level> </alerts> <email_alerts> <email_to>ossec-admins@email.domain</email_to> <level>7</level> </email_alerts> <email_alerts> <email_to>ossec-admins@email.domain</email_to> <rule_id>1002</rule_id> </email_alerts> <email_alerts> <email_to>ossec-admins@email.domain</email_to> <group>ossec</group> </email_alerts> <email_alerts> <email_to>serverA-admins@email.domain</email_to> <group>servergroupA</group> </email_alerts> <email_alerts> <email_to>serverB-admins@email.domain</email_to> <group>servergroupB</group> </email_alerts> </ossec_config> |