Skip to main content
The OSSEC server (ossec-maild) can send alerts by email to the recipients you configure. The Flashduty Email integration receives these emails, so no separate OSSEC integration is needed: create an Email integration in Flashduty, put its address in OSSEC as the recipient, and choose the push mode described below.

​
In Flashduty On-call

You can get the integration email address in either of the two ways below. Choose Email as the integration type in both cases, not OSSEC.

​
Dedicated integration

  1. Go to the Flashduty console, select Channels, and open a channel
  2. Go to Settings → Integrations → Dedicated integrations and click Add an integration
  3. Select Email and click Save
  4. Open the generated integration card, copy the Email address, then set the push mode as described below

​
Shared integration

  1. Go to the Flashduty console and select Integration Center → Alert events
  2. Select Email, enter an integration name, and copy the Email address
  3. Set the push mode as described below
  4. Configure the default route, select a channel, and click Save

​
Configure the push mode in Flashduty

OSSEC sends one email when an alert is generated and never sends a recovery email, so no “close alert” rule is needed. Set Push Mode to Trigger or Update Alert Based on Email Subject: emails with the same title (same host, same log source, same level, same rule description) are merged into the one open alert, and emails with different titles each create a separate alert. The title format is described in Email subject format. OSSEC does not send recovery notifications. Enable auto-resolve timeout on the channel that receives this integration, with a suggested window of 24 hours, or close alerts manually once handled.

​
Configure OSSEC

All configuration below is done in /var/ossec/etc/ossec.conf on the OSSEC server. Agents need no configuration because alerts are generated only on the server.
1

Configure email delivery

In <global>, set the recipient, SMTP server, and sender. Set the recipient to the address of the Flashduty Email integration:
Consumer and hosted providers such as Gmail and Outlook.com generally do not accept unauthenticated relay. If your SMTP server requires authentication or TLS, follow the SMTP-authenticated email section of the OSSEC documentation.
2

Set the minimum alert level for email

Only alerts whose rule level is greater than or equal to this value are emailed. Choose a value that matches what your SOC can handle so low-level alerts do not bury on-call responders.
3

Avoid merging several alerts into one email (optional)

By default OSSEC batches alerts that arrive close together into a single email, and the subject reflects only one of them, so Flashduty cannot create one alert per OSSEC alert. To send each alert as its own email, add an <email_alerts> block for the same recipient with <do_not_group /> and <do_not_delay /> (the <global> section must already contain at least one <email_to>):
<email_alerts> also accepts <group>, <rule_id> (comma-separated), and <event_location> to narrow which alerts are forwarded.
4

Restart and verify

  1. Trigger an alert at or above the email level on a monitored host, for example by entering wrong passwords repeatedly against SSH
  2. Confirm in Flashduty that an alert arrives, titled with the OSSEC email subject
  3. If nothing arrives, check /var/ossec/logs/ossec.log on the OSSEC server for SMTP errors

​
Email subject format

OSSEC emails use the full subject by default (internal option maild.full_subject=0, the default value):
Example:
The location is “(agent name) agent IP”, or the server name for alerts from the server itself. The log file path after -> is not included in the subject. The subject is limited to 127 characters, so a long rule description is truncated. The email body starts with OSSEC HIDS Notification., followed by the alert time, Received From (the alert source), Rule: <rule ID> fired (level <level>) -> "<rule description>", the source IP / user when present, and the triggering log excerpt (Portion of the log(s)). In Flashduty, the alert title is the email subject and the description is the email body.

​
Limitations

  • No recovery: an OSSEC alert is a one-time event. Alerts in Flashduty do not resolve automatically; rely on auto-resolve timeout or close them manually.
  • Severity: the Email integration sets every alert to Warning. The subject carries the OSSEC level (Level N), so you can adjust severity by level with an Alert Pipeline.
  • No rule ID in the subject: the subject has the rule description only, so alerts from different rules that share the same description, location, and level are merged. The rule ID is in the email body.
  • Sensitive data: the body contains a raw log excerpt that may include usernames, IPs, and file paths. Filter with <email_alert_level> or the <group> and <rule_id> options of <email_alerts> and avoid forwarding raw authentication logs.
  • Merging: emails with the same subject merge into the same open alert; once that alert is closed, a new email creates a new alert.