Alert notifications

The notification system sends relevant alerts to different channels when defined criteria are met (severity threshold). It is designed to operate asynchronously through Jobs and Laravel database queues.

Key concepts

• Supported severity levels: low, medium, high.
• Mapping from Suricata (eve.json):
  • alert.severity = 1 → high
  • alert.severity = 2 → medium
  • alert.severity = 3 → low
• Global threshold: you can define a minimum general severity to not be notified of lower severity alerts.

Supported channels

• Email (SMTP).
• Slack (Incoming Webhook).
• Telegram (SuricatavelBot must be added to a group to receive its messages)
• Web (push notifications in Suricatavel).