Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Setup now includes sosetup-email
As of securityonion-setup - 20120912-0ubuntu0securityonion222, the Setup package now includes a script called so-email, which will automatically configure automated server-side email for you as described below. Simply run the following command then follow the prompts:
To automate email setup, copy and modify the example file located at
/usr/share/securityonion/so-email.conf, then run
so-email with the
sudo so-email -f ~/so-email.conf
Please note that the Sguil client has its own email configuration (separate from the Sguil server) which can be modified in
This page describes how to configure email for alerting and reporting. Applications such as Sguil and OSSEC have their own mail configuration and don't rely on a mail server in the OS itself. However, you may still want to install a mail server in the OS so that you can get daily emails from the sostat script and from Bro.
How do I configure the OS itself to send emails?
Install and configure your favorite mail server. Depending on your needs, this could be something simple like
nullmailer (recommended) or something more complex like
Here are some
nullmailer instructions provided by Michael Iverson:
sudo apt-get install nullmailer
# edit /etc/mailname to hold your "from" domain name. (If you were google, you'd use "gmail.com".)
# edit /etc/nullmailer/adminaddr to contain the address you want mail to root to be routed to.
# edit /etc/nullmailer/remotes to contain the mail server to forward email to.
Alternatively, here are some instructions for the more complex
sudo apt-get -y install mailutils
sudo dpkg-reconfigure exim4-config
Once you've configured your mail server and verified that it can send email properly, you might want to create a daily cronjob to execute
/usr/sbin/sostat and email you the output:
# crontab entry to run sostat and email its output
01 12 * * * root HOSTNAME=`hostname`; /usr/sbin/sostat 2>&1 | mail -s "$HOSTNAME stats" $EMAIL
If you don't already have the
sudo apt-get install mailutils
How do I configure Sguil to send alerts via email?
/etc/nsm/securityonion/sguild.email (on the master server) as needed and restart sguild:
You can then verify the email configuration by looking at the top of sguild's log file:
head -20 /var/log/nsm/securityonion/sguild.log
For more information, please see:
You may want to install a local mail relay on your master server, configure it to relay mail to your corporate mail server, and then configure Sguil to send email to the local mail relay.
Please note: Sguil will only send email alerts for what is considers new events. Ensure you classify events within the Sguil console, or consider creating an Autocat rule to automatically classify them if you prefer to receive emails for all instances of an alert. Otherwise, you may not receive alerts as intended.
How do I configure OSSEC to send emails?
/var/ossec/etc/ossec.conf as follows:
Then restart OSSEC:
sudo service ossec-hids-server restart
You can specify the severity of an event for which OSSEC will send email alerts by specifying an appropriate value for
/var/ossec/etc/ossec.conf. If you notice
email_alert_level is not being respected for a certain rule, it may be that the option is overridden by
<options>alert_by_email</options> being set for a rule. You can modify this behavior in
You can also find an explanation of the alert levels, here:
How do I configure ELSA to send emails?
Please note: ELSA has been deprecated and replaced by the Elastic Stack.
Add your email address to the user_info table of the securityonion_db database (replacing FIRSTLAST@YOURDOMAIN.COM with your actual email address and FIRSTLAST with your Sguil/ELSA username):
sudo mysql --defaults-file=/etc/mysql/debian.cnf -Dsecurityonion_db -e "update user_info set email='FIRSTLAST@YOURDOMAIN.COM' where username='FIRSTLAST';"
Change the following in the "email" section of /etc/elsa_web.conf (replacing YOUR.SECURITY.ONION.BOX with the actual hostname or IP address of your Security Onion master server and replacing MAIL.EXAMPLE.COM with the actual hostname or IP address of your internal mail relay):
"base_url" : "https://YOUR.SECURITY.ONION.BOX/elsa-query", "smtp_server": "MAIL.EXAMPLE.COM",
sudo service apache2 restart
You can then have ELSA send an email alert by doing the following:
- run a query
- click "Result Options"
- click "Alert or Schedule"
- choose your parameters and click the Submit button
How do I configure Bro to send emails?
/opt/bro/etc/broctl.cfg and set the following:
MailTo = YourUsername@YourDomain.com
sendmail = /usr/sbin/sendmail
Then update and restart Bro:
sudo nsm_sensor_ps-restart --only-bro
You should then start receiving hourly connection summary emails. If you don't want the connection summary emails, you can add the following to
broctl.cfg and update and restart Bro as shown above:
You may want to receive emails for Bro notices. To do that, add the following to
/opt/bro/share/bro/site/local.bro and update/restart Bro as shown above:
hook Notice::policy(n: Notice::Info)
How do I configure Elastalert to send emails?
Follow the steps on the Elastalert wiki page.
How can I get an email alert when my sensor stops seeing traffic?
If you configured OSSEC or Bro as shown above, they should automatically do this for you. Another option can be found on the SensorStopsSeeingTraffic page.