OSSIM-新建邮件提醒

2016-07-27

修改OSSIM ossim_setup.conf文件

相关操作见 https://www.alienvault.com/forums/discussion/925/ossim-4-email-notification

1 - Edit the file /etc/ossim/ossim_setup.conf the editor they like.
2 - Change the following parameters:
email_notify=user@company.com
mailserver_relay=xxx.xxx.xxx.xxx
3 - Save the changes and exit the editor.
4 - run ossim-reconfig
5 - Send a test mail:
echo "text" | mail -s "Subject" user@domain.com
6 - Check the mail delivery system is functioning properly:
tail -f /var/log/mail.log

临时申请了个邮箱把信息填写如下：

OSSIM Web端相关设置

创建发生邮件的操作

相关设置见 https://www.alienvault.com/documentation/usm-v5/policy-management/create-action-send-email.htm

1
2
3

From Configuration > Threat Intelligence, click the ACTIONS tab.
Click New.

设置好名称、描述、发件邮箱、收件人、邮件主题和邮件内容，TYPE必须选择为Send an email message
如下图所示

创建触发发送邮件的条件
操作步骤 https://www.alienvault.com/documentation/usm-v5/policy-management/create-ext-pol-trigger-email.htm

效果图