Notifications module

Key capabilities

The Notifications module provides the following capabilities, enabling administrators and security teams to integrate the Wazuh indexer with a wide range of external notification services and platforms.

• Multi-channel delivery: Send notifications to Slack, Microsoft Teams, Amazon Chime, email (SMTP and AWS SES), AWS SNS, and custom HTTP webhooks.

• Unified REST API: Create, update, delete, and query notification channel configurations through a single API surface at /_plugins/_notifications/.

• Test notifications: Validate a channel configuration by sending a test message before relying on it for production alerts.

• Feature discovery: Other modules can dynamically query the supported notification features and allowed channel types.

• RBAC integration: Access to notification configurations is governed by the Wazuh indexer security module, with optional backend-role-based filtering.

• Default channels: Pre-configured channel templates for Slack, Jira, PagerDuty, and Shuffle SOAR are created automatically on first startup.

• Extensible architecture: The module uses a Service Provider Interface (SPI) pattern, making it straightforward to add new destination types.

Supported channel types

The Notifications module delivers messages to external services through the following channel types. Each channel type defines how a notification is delivered and requires its own set of configuration fields.

Default notification channels

The Notifications module creates a set of predefined notification channels when the Wazuh indexer starts for the first time. These channels are disabled by default and contain placeholder values that must be updated before use.

You can modify the channel configuration and enable it after providing the required credentials and connection details.

The following default channels are created:

Default channels behaviors

The following rules govern how the module creates and manages default channels.

• Default channels are created only on the cluster manager node during startup.

• If a default channel already exists, it is not recreated or overwritten on subsequent startups.

• All default channels are created with an empty access list, making them visible to all users.

• Each channel has a fixed, predictable ID (for example, default_slack_channel) so they can be referenced consistently.

• A sample alerting monitor is created alongside these channels. You can review it under Explore > Alerting > Monitors in the Wazuh Dashboard before enabling production alerts.

Activating a default channel

Default notification channels are created in a disabled state. Before a channel can be used, you must update its configuration with valid connection details and enable it.

For a detailed guide on configuring and activating default notification channels, see the Notifications and alerts section of the Wazuh dashboard documentation.

Configuration

The Notifications module supports both static and dynamic configuration settings. Static settings are defined in the /etc/wazuh-indexer/opensearch.yml file and are applied when the Wazuh indexer starts. Dynamic settings can be modified at runtime using the cluster settings API without restarting the Wazuh indexer.

The module also loads default values from bundled configuration files during startup. These defaults can be overridden through /etc/wazuh-indexer/opensearch.yml or by using the cluster settings API.

The following sections describe the configuration files, available settings, and secure credential storage options used by the Notifications module.

# Notification core settings
opensearch.notifications.core.email.size_limit: 10000000
opensearch.notifications.core.http.max_connections: 60
opensearch.notifications.core.http.connection_timeout: 5000
opensearch.notifications.core.http.socket_timeout: 50000
opensearch.notifications.core.http.host_deny_list:
  - "10.0.0.0/8"
  - "172.16.0.0/12"
# Allowed channel types
opensearch.notifications.core.allowed_config_types:
  - slack
  - chime
  - microsoft_teams
  - webhook
  - email
  - sns
  - ses_account
  - smtp_account
  - email_group
# Plugin settings
opensearch.notifications.general.operation_timeout_ms: 60000
opensearch.notifications.general.default_items_query_count: 100
opensearch.notifications.general.filter_by_backend_roles: false

curl -sk -u admin:admin -X PUT \
"https://localhost:9200/_cluster/settings" \
-H "Content-Type: application/json" \
-d '{
  "persistent": {
    "opensearch.notifications.core.http.max_connections": 100,
    "opensearch.notifications.general.filter_by_backend_roles": true
  }
}'

{
  "acknowledged": true,
  "persistent": {
    "opensearch": {
      "notifications": {
        "core": {
          "http": {
            "max_connections": "100"
          }
        },
        "general": {
          "filter_by_backend_roles": "true"
        }
      }
    }
  },
  "transient": {}
}

opensearch.notifications.core.email.<account_name>.username
opensearch.notifications.core.email.<account_name>.password