How to configure Suricata to send alerts via email

Answered 2 years ago (May 22, 2023) by Eldernode Staff

To configure Suricata to send email alerts, you can follow these steps:

– Open the Suricata configuration file with /etc/suricata/suricata.yaml or /etc/suricata/suricata.yml and find the outputs section.

– To enable email alerts, remove or add the following lines:

outputs:   - fast:       enabled: yes       filename: fast.log   - smtp:       enabled: yes       recipient: [email protected]       from: [email protected]       smtp-server: smtp.example.com       smtp-port: 587       smtp-username: your_username       smtp-password: your_password

Replace the location variable values with your email address (recipient), the email address you want to appear as the sender (from), SMTP server address, port, username and password.
– Save the configuration file after making the necessary changes and restart Suricata.