how i can send email when snort splunk catch a alert

[souflam89]

then i installed a splunk with splunk snort,i want send all alert or when a alert genrated to my boxemail gmail how i can do that

ps:i have a mta ssmtp configured with gmail

sorry for mu english 🙂

[Ayn]

Build your search for which events you want to receive an alert for. For instance if you just want anything that is generated by snort: use "sourcetype=snort". After that, schedule this search and create an alert from it and configure Splunk to send you an email when the alert triggers. This is excellently covered in the manual:

http://www.splunk.com/base/Documentation/latest/User/SchedulingSavedSearches