Requesting a guide - Alerts from detections (even if it's a paid license)

[solarplex]

Hello,

I'm wondering if anyone has setup alerts/actions to receive emails from tpot? I really appreciate all the work that has gone into the project but would love to see if there's a way to get email alerts setup.

I see in the settings there's somthing for kibana actions which looks like you need an elastic Gold license. Is that all that would be needed to get emailing to work?

[Ganesh-403]

@solarplex
Yes, it's possible to receive email alerts from T-Pot, but how you do it depends on whether you're using Elastic's built-in alerting or an external alerting tool.

Option 1: Kibana Alerting (Paid License)

If you're referring to Kibana Rules & Connectors, then yes—you'll need a license that supports email connectors.

With Kibana Alerting you would:

1. Configure an SMTP Email connector.
2. Create a rule (Elasticsearch query, threshold, etc.).
3. Attach the Email connector as an action.

In addition to the appropriate license, Kibana alerting requires some configuration, such as an encryption key (xpack.encryptedSavedObjects.encryptionKey) and the alerting/actions settings documented by Elastic. :contentReference[oaicite:0]{index=0}

---

Option 2: ElastAlert / ElastAlert2 (Free & Open Source)

If you don't have a paid Elastic license, ElastAlert (or ElastAlert2) is a very popular alternative.

It periodically queries Elasticsearch and can send alerts via:

• Email
• Slack
• Microsoft Teams
• Discord
• Telegram
• Webhooks
• PagerDuty
• and many other destinations. :contentReference[oaicite:1]{index=1}

This works well with T-Pot because all honeypot events are already indexed into Elasticsearch.

A simplified rule might look like:

name: Cowrie Login Alert

type: frequency

index: logstash-*

num_events: 1

timeframe:
  minutes: 1

filter:
  - query:
      query_string:
        query: 'eventid:cowrie.login.success'

alert:
  - email

email:
  - admin@example.com

---

Option 3: Custom Logstash Output

Another option is to extend T-Pot's Logstash pipeline with an additional email output plugin. Several community members have used this approach by adding a conditional output in logstash.conf, for example:

output {
  if "shouldmail" in [tags] {
    email {
      ...
    }
  }
}

This works without relying on Kibana's alerting framework, although you'll need to maintain the Logstash configuration yourself.

---

Which approach would I recommend?

• If you already have an Elastic Gold/Platinum (or equivalent) license: use Kibana Rules + Email connectors. It's the most integrated solution. :contentReference[oaicite:2]{index=2}
• If you're using the free/basic version of Elastic: I'd recommend ElastAlert2. It's mature, well supported, and specifically designed for alerting from Elasticsearch without requiring a commercial Elastic license. :contentReference[oaicite:3]{index=3}

Could you clarify one thing?

• Are you using the Elastic Basic (free) license that ships with T-Pot, or do you already have a Gold/Platinum/Enterprise subscription? That determines whether the built-in email connectors are available or whether an external tool like ElastAlert2 is the better choice.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.