[sentinix-list] ACID email alert configuration
"M. Morgan" <[email protected]> Thu, 19 Feb 2004 16:37:27 -0500 (EST)
| Newsgroups | gmane.linux.sentinix |
|---|---|
| Message-ID | <4098441.1077226648354.JavaMail.root@wamui09.slb.atl.earthlink.net> |
Hello all, In SnortCenter/ACID you can select certain alerts and manually email them. From a default standpoint this wont work because "there is no email address specified" (<<error message). I've been studying the docs for ACID and Ive found the following: ~~~~~~~~~~~~~~~~ /* Email Alert action * * - action_email_from : email address to use in the FROM field of the mail message * - action_email_subject : subject to use for the mail message * - action_email_msg : additional text to include in the body of the mail message * - action_email_mode : specifies how the alert information should be enclosed * 0 : alerts should be in the body of the message * 1 : alerts should be enclosed in an attachment */ $action_email_from = "ACID Alert <acid>"; $action_email_subject = "ACID Incident Report"; $action_email_msg = ""; $action_email_mode = 0; ~~~~~~~~~~~~~~~~ However, I dont see anywhere to put in an address to send mail TO... and I assume I would need to set up Postfix to be able to send it or is there an MTA already installed somewhere? Ive been referencing this: http://acidlab.sourceforge.net/acid_params.html Does anyone know offhand which where you specify the email addresses in snortcenter/acid? Thanks, Michael