# wazuh-alert-notifications

Companion files for the lesson **Wazuh Notifications: Email, Slack, Telegram and Webhooks**.

Lesson: https://maheshtata.com/wazuh/wazuh-alert-notifications/

Tested against: Wazuh 5.0 (beta5 documentation, September 2026). `verified: false` until the lab pass.

## Files

| File | Purpose |
| --- | --- |
| `high-severity-monitor.json` | A query-level Alerting monitor that fires when high or critical findings land in `wazuh-findings-v5-security`, with throttling on the action. |
| `webhook-payload.mustache.json` | A Mustache message body for a custom webhook action, mapping Wazuh Common Schema fields into a stable JSON contract for an automation platform. |

## Using them

Create the notification channel first, under **Explore > Notifications > Channels**, and note its
config id. Then post the monitor:

```bash
curl -sk -u "<USER>:<PASSWORD>" -X POST \
  "https://<INDEXER>:9200/_plugins/_alerting/monitors" \
  -H "Content-Type: application/json" \
  --data-binary @high-severity-monitor.json
```

Remove the `_comment` key first if your tooling rejects unknown fields.

## Caveats and things to verify in your own cluster

- `destination_id` must be the config id of an existing Notifications channel. The placeholder
  in the file will be rejected.
- The `terms` query assumes `wazuh.rule.level` is mapped as a keyword. Check the mapping with
  `GET wazuh-findings-v5-security/_mapping` and switch to `match_phrase` if it is analysed text.
- The Wazuh documentation for the Alerting module notes a limit of 10 custom monitors per user,
  while the same page documents `plugins.alerting.monitor.max_monitors` with a default of 1000.
  Design for the lower figure: route by severity, not one monitor per team or per tenant.
- The message body must match what the receiving service expects. A Slack channel type renders
  plain text; a custom webhook sends whatever you write, so the JSON above suits a webhook and
  not a Slack channel type.

## Sources

- https://documentation.wazuh.com/5.0-beta/user-manual/wazuh-indexer/modules/alerting.html
- https://documentation.wazuh.com/5.0-beta/user-manual/wazuh-indexer/modules/notifications.html
- https://docs.opensearch.org/latest/observing-your-data/alerting/api/
- https://docs.opensearch.org/latest/observing-your-data/alerting/monitors/
- https://docs.opensearch.org/latest/observing-your-data/notifications/index/
- https://github.com/wazuh/wazuh/blob/main/docs/guide/migration/integratord-notifications.md