Skip to content

Commit ab08349

Browse files
authored
Add flow completion e-mail notification artifact (#1094)
From the artifact description: > Send an e-mail when a client flow (with artifacts of interest) has finished. > Cancelled collections and collections with artifacts that do not satisfy > preconditions do not create notifications when they are finished. > > Example use cases: > > - A collection is created for an offline client and you want to be notified > when it finishes. The DelayThreshold ensures that e-mails are not sent unless > flows complete some time later (i.e. not immediately). > - An e-mail is sent to an auditor for every collection with detailed results > - Send e-mails when flows (of interest) fail If HTML is enabled, the e-mails look something like this: <img width="604" height="1006" alt="image" src="https://github.com/user-attachments/assets/fc93e8e3-a4eb-4b72-ae55-90a0e82888a7" /> Rows containing empty information, like in this example "Urgent", "Hunt", "Uploaded files", "Uploaded bytes" and "Error", are left out. For consistency, these can be included even if falsy by setting KeepEmptyRows to true. In this example, a row called "Computer serial" is a custom line configured by adding the following to the ClientMetadata parameters: | Field | Alias | |---------|---------| | serial | Computer serial | where "serial" is a client metadata field for the client that completed the flow. The same result looks like this in plain text: <img width="1246" height="589" alt="image" src="https://github.com/user-attachments/assets/1291e342-6ac9-43a5-97dc-a6dbeec30ac4" /> If a flow fails, the output looks as follows: <img width="606" height="1078" alt="image" src="https://github.com/user-attachments/assets/05960cfc-385f-4d1b-9b8c-96441d08a952" />
1 parent 85912d6 commit ab08349

31 files changed

Lines changed: 8967 additions & 0 deletions

.wordlist.txt

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2134,3 +2134,32 @@ GetUserRoles
21342134

21352135
ConsumeUnit
21362136
orchestrator
2137+
2138+
<url-free> content/blog/2026/2026-04-19-alerts-and-email/_index.md
2139+
--------------------------------------------------------------------------------
2140+
CSVs
2141+
DiskSpace
2142+
IoC
2143+
IoCs
2144+
PagerDuty
2145+
Wazuh's
2146+
alls
2147+
parallelised
2148+
2149+
<url-free> content/knowledge_base/tips/email_alerts.md
2150+
--------------------------------------------------------------------------------
2151+
Mailpit
2152+
DiskSpace
2153+
ProcessName
2154+
RemoteAddr
2155+
2156+
<url-free> content/knowledge_base/tips/sending_email.md
2157+
--------------------------------------------------------------------------------
2158+
Mailpit
2159+
SendEmail
2160+
VelociraptorServer
2161+
2162+
<url-free> content/knowledge_base/tips/vql_error_catalogue.md
2163+
--------------------------------------------------------------------------------
2164+
alls
2165+
severities

content/blog/2026/2026-04-19-alerts-and-email/_index.md

Lines changed: 359 additions & 0 deletions
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)