Open Source Security Blogs

Configure Emails in Wazuh Docker (Docker compose + Outlook SMTP)

Prerequisites:

Docker Compose Configuration:

To allow Wazuh to have the capability to authenticate to the outlook SMTP, I will leverage the use of a Postfix image from https://github.com/juanluisbaptiste/docker-postfix.

  • The environment variables SMTP_USERNAME & SMTP_PASSWORD needs to be configured with your Outlook account credentials within the docker-compose.yml which would look like the below:
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
version: '3.7'

services:
  smtp-relay:
    image: juanluisbaptiste/postfix
    environment:
      SMTP_SERVER: smtp-mail.outlook.com
      SMTP_USERNAME: MYEMAIL@outlook.com
      SMTP_PASSWORD: MYPASSWORD
      SERVER_HOSTNAME: wazuh.com
    ports:
      - 25:25/tcp
  wazuh.manager:
    image: wazuh/wazuh-manager:4.3.4
    hostname: wazuh.manager
    restart: always
    ports:
      - "1514:1514"
      - "1515:1515"
      - "514:514/udp"
      - "55000:55000"
    environment:
      - INDEXER_URL=https://wazuh.indexer:9200
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - FILEBEAT_SSL_VERIFICATION_MODE=full
      - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
      - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
      - SSL_KEY=/etc/ssl/filebeat.key
      - API_USERNAME=wazuh-wui
      - API_PASSWORD=Mypassword
    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
      - wazuh_etc:/var/ossec/etc
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
      - wazuh_var_multigroups:/var/ossec/var/multigroups
      - wazuh_integrations:/var/ossec/integrations
      - wazuh_active_response:/var/ossec/active-response/bin
      - wazuh_agentless:/var/ossec/agentless
      - wazuh_wodles:/var/ossec/wodles
      - filebeat_etc:/etc/filebeat
      - filebeat_var:/var/lib/filebeat
      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

  wazuh.indexer:
    image: wazuh/wazuh-indexer:4.3.4
    hostname: wazuh.indexer
    restart: always
    ports:
      - "9200:9200"
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms2048m -Xmx2048m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - wazuh-indexer-data:/var/lib/wazuh-indexer
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
      - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml

  wazuh.dashboard:
    image: wazuh/wazuh-dashboard:4.3.4
    hostname: wazuh.dashboard
    restart: always
    ports:
      - 443:5601
    environment:
      - "--max-old-space-size=4096"      
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - WAZUH_API_URL=https://wazuh.manager
      - API_USERNAME=wazuh-wui
      - API_PASSWORD=MyS3cr37P450r.*-
    volumes:
      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
      - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
      - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
    depends_on:
      - wazuh.indexer
    links:
      - wazuh.indexer:wazuh.indexer
      - wazuh.manager:wazuh.manager

volumes:
  wazuh_api_configuration:
  wazuh_etc:
  wazuh_logs:
  wazuh_queue:
  wazuh_var_multigroups:
  wazuh_integrations:
  wazuh_active_response:
  wazuh_agentless:
  wazuh_wodles:
  filebeat_etc:
  filebeat_var:
  wazuh-indexer-data:
  • Run docker-compose up -d
  • Retrieve the Postfix container IP to be used in Wazuh configuration: 
docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $(docker ps | grep -i smtp | awk '{print $1}')

Wazuh configuration:

  • Navigate to the Wazuh UI, Management then configuration :
  • Edit the configuration specifying the SMTP server (IP retrieved previously) and enabling the email notification:
  • After restarting the Wazuh manager and having an alert triggered (In my case I’ve configured it to email all alerts starting from level 3), you should receive an email similar to below (Check the spam):

Note that, you have generic and granular options to configure the emails https://documentation.wazuh.com/current/user-manual/manager/manual-email-report/index.html?highlight=email#configuring-email-alerts .

Hope you find it useful 🙂

EL WALI KARKOUB

, , , ,

444 responses to “Configure Emails in Wazuh Docker (Docker compose + Outlook SMTP)”

  8. … [Trackback]

    […] Read More here: opensourcesecurityblogs.com/configure-emails-in-wazuh-docker-docker-compose-outlook-smtp/ […]

  10. 846772 716876It is genuinely a cool and beneficial piece of information. Im glad which you basically shared this beneficial data with us. Please stay us informed like this. Thank you for sharing. 687733

  112. … [Trackback]

    […] Read More to that Topic: opensourcesecurityblogs.com/configure-emails-in-wazuh-docker-docker-compose-outlook-smtp/ […]

  186. Rattling good information can be found on web blog. “The fundamental defect of fathers is that they want their children to be a credit to them.” by Bertrand Russell.

  217. Hiya, I’m really glad I have found this info. Today bloggers publish just about gossips and internet and this is really annoying. A good blog with exciting content, that is what I need. Thanks for keeping this site, I will be visiting it. Do you do newsletters? Cant find it.

  225. Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  436. Зарабатывай реальные деньги в онлайн казино! Обзоры слотов, бонусы, стратегии для победы! Присоединяйся
    Казино онлайн: секреты, тактики, промокоды! Поднимись с нами! Реальные обзоры.
    https://t.me/s/official_izzi/1145

  437. Выигрывай реальные деньги в онлайн казино! Топ слотов, бонусы, стратегии для победы! Присоединяйся
    Игровые автоматы: секреты, стратегии, бонусы! Заработай с нами! Только честные обзоры.
    https://t.me/s/official_starda/529

  442. Зарабатывай реальные деньги в лучших казино! Обзоры слотов, акции, советы для победы! Присоединяйся
    Казино онлайн: секреты, тактики, промокоды! Поднимись с нами! Только честные обзоры.
    https://t.me/Official_1win_1win/1216

Leave a Reply

Your email address will not be published. Required fields are marked *