Send IPS alerts by e-mail

[opleksin]

I successfully set up and configured IPS in opnsense. If I try to open a TCP connection from inside my network to a host listed, e.g., in the ET botnet list, the connection is blocked and I get an alert. So far, so good.

The problem is: The alert shows up in the opnsense web UI. I don't want to regularly check the web UI for alerts. If an alert happens, I'd like to be notified (by e-mail), so that I can investigate whether this is a security incident or a false positive.

Is there some built-in functionality in opnsense to activate this kind of e-mail notification? I activated Monit, but none of the built-in service alerts seems to relate to the IPS.

Thanks and best regards

[mimugmail]

https://github.com/opnsense/docs/blob/master/source/manual/monit.rst

Example 3

[Julien]

This is really handy have you managed to configure it ?

[XeroX]

Yes, but I find this more annoying than helpful.

[chemlud]

...if you are not interested in what's going on in your network simply turn off suricata :-p

Carefully select your rulesets for your use case and turn off false positives ove time. IPS is not a feature you turn on and forget about it...

[XeroX]

I agree if running IDS, but I'm running IPS. I want to block malicous traffic to my exposed systems.

I don't need notifications for any DShield blocks so I check that manually from day to day.