search

CERN-CERT / pDNSSOC

Leveraging MISP indicators via a pDNS-based infrastructure as a poor man’s SOC.
MIT License
49 stars 5 forks source link

Implement Email notifications for alerts.log output #15

Closed 4quarks closed 11 months ago

4quarks commented 1 year ago

Problem

The current system relies on the alerts.log file to feed the SIEM, which is essential for monitoring and incident response. However, it's important to enhance our alerting capabilities to ensure that alerts are promptly communicated to the appropriate stakeholders.

Proposal

We propose implementing email notifications as an initial step to improve our alerting system. This feature will allow us to receive real-time alerts via email, providing an additional layer of visibility and enabling faster response to critical events.

Implementation Details

To implement email notifications for alerts, the primary focus will be on migrating the existing Ruby code to the new architecture. This migration will enable us to leverage the enhanced capabilities of the new architecture while maintaining the functionality of the old Ruby code.

arvchristos commented 11 months ago

This is functionality that belongs to pdnssoc-cli tool. Introduced in CERN-CERT/pdnssoc-cli#1