{"id":30369472,"url":"https://github.com/adarwa/suricata-alerts","last_synced_at":"2026-04-20T13:32:17.908Z","repository":{"id":309082859,"uuid":"1033747434","full_name":"AdarWa/suricata-alerts","owner":"AdarWa","description":"Dockerized Python service that monitors Suricata eve.json and sends real-time email alerts.","archived":false,"fork":false,"pushed_at":"2025-08-09T17:17:27.000Z","size":3997,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-20T02:22:59.159Z","etag":null,"topics":["alert","docker","docker-compose","email","email-sender","ids","ips","monitoring","suricata"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AdarWa.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-07T09:32:08.000Z","updated_at":"2025-08-09T17:19:25.000Z","dependencies_parsed_at":"2025-08-09T19:14:30.225Z","dependency_job_id":"1ae25338-5678-4cf0-ad36-afacd28ba807","html_url":"https://github.com/AdarWa/suricata-alerts","commit_stats":null,"previous_names":["adarwa/suricata-alerts"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/AdarWa/suricata-alerts","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AdarWa%2Fsuricata-alerts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AdarWa%2Fsuricata-alerts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AdarWa%2Fsuricata-alerts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AdarWa%2Fsuricata-alerts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AdarWa","download_url":"https://codeload.github.com/AdarWa/suricata-alerts/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AdarWa%2Fsuricata-alerts/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279019345,"owners_count":26086711,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-14T02:00:06.444Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["alert","docker","docker-compose","email","email-sender","ids","ips","monitoring","suricata"],"created_at":"2025-08-20T02:17:00.111Z","updated_at":"2026-04-20T13:32:17.888Z","avatar_url":"https://github.com/AdarWa.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Suricata Email Alert Notifier (Docker)\n\nThis project is a lightweight, containerized Python service that monitors a Suricata `eve.json` log file and sends email notifications whenever new alerts are detected.\nIt is designed for easy deployment in a Docker environment and can be customized entirely through environment variables.\n\n### Features\n\n* **Real-time monitoring** of Suricata alerts from `eve.json`\n* **Email notifications** for new alerts, sent to one or more recipients\n* **Customizable SMTP settings** with authentication support\n* **Configurable polling interval**\n* Runs as a **persistent background service** in Docker\n\n### How it works\n\n1. The container continuously watches `/logs/eve.json` for new Suricata alerts.\n2. When new alerts are found, it formats them with relevant details:\n\n   * Alert signature\n   * Source and destination IPs/ports\n   * Protocol\n   * Timestamp\n3. Sends a formatted email notification to the specified recipients.\n\n### Environment Variables\n\n| Variable       | Description                                   | Example Value                       |\n| -------------- | --------------------------------------------- | ----------------------------------- |\n| `MAILER`       | Mailer type (e.g. SMTP)                       | `SMTP`                              |\n| `USERNAME`     | SMTP username                                 | `apikey`                            |\n| `PASSWORD`     | SMTP password or API key                      | `mypassword`                        |\n| `FROM`         | Sender email address                          | `alerts@example.com`                |\n| `TO`           | Comma-separated list of recipient emails      | `admin@example.com,ops@example.com` |\n| `SMTP_SERVER`  | SMTP server address                           | `smtp.mailserver.com`               |\n| `PORT`         | SMTP server port                              | `587`                               |\n| `POLLING_TIME` | Time in seconds between checks for new alerts | `10`                                |\n| `POLL_LIMIT`   | Maximum number of new alerts to send          | `20`                                |\n| `HOST`         | Name to identify your log source              | `myserver1`                         |\n| `DETAILS_URL`  | URL to see details on the new alerts          | `https://myserver1/evebox`          |\n| `SKIP_PATTERN` | Regex to match alert signatures not to send   | `(ET|GPL) (SCAN\\|HUNTING\\|DROP\\|CINS)` |\n\n### Docker Usage\n\n1. Clone the repository using `git clone https://github.com/AdarWa/suricata-alerts`\n2. Add the alert-emailer to your docker\n\n```yaml\n  alert-emailer:\n    build: ./suricata-alerts\n    container_name: alert-emailer\n    volumes:\n      - suricata_logs:/logs:ro\n    depends_on:\n      - suricata\n    environment:\n      - MAILER=SMTP\n      - USERNAME=emailapikey\n      - PASSWORD=VERY_SECRET_PASSWORD\n      - FROM=suricata-alert@example.com\n      - TO=subject1@example.com,subject2@example.com\n      - SMTP_SERVER=smtp.zeptomail.com\n      - PORT=587\n      - POLLING_TIME=60\n      - POLL_LIMIT=20\n      - HOST=myserver1\n      - DETAILS_URL=https://myserver1/evebox\n      - SKIP_PATTERN=(ET|GPL) (SCAN|HUNTING|DROP|CINS)\n```\n\n### Example Alert Email\n\n```\nSubject: [Suricata alert] 2 new alert(s)\n\nNew Suricata alert(s) detected:\n\n- ET SCAN Nmap Scripting Engine User-Agent\n  Source: 192.168.1.5:42312\n  Destination: 10.0.0.2:80\n  Protocol: TCP\n  Time: 2025-08-09T17:35:12Z\n\n- ET POLICY External IP Lookup\n  Source: 192.168.1.5:42314\n  Destination: 10.0.0.5:53\n  Protocol: UDP\n  Time: 2025-08-09T17:36:05Z\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadarwa%2Fsuricata-alerts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fadarwa%2Fsuricata-alerts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadarwa%2Fsuricata-alerts/lists"}