Hi,

I am looking to send an email to a user when a QRadar event rule fires for that user

I have looked at custom action scripts and I can see that I can run a script passing in the username variable for that event

However, I seem to be having problem using the sendmail command int he script with a command not found error, on testing

If I run the sendmail command from the command line at /opt/qradar/bin/ca_jail/ustom_action_scripts directory, the email sends fine. If I try to run the deployed script in that same location I get a command not found error for sendmail

I guess that the jail location is unable to access sendmail. Is there an alternative mail option I can use in a custom action script or is that an alternative way to email a variable user from a fired event?

You can do this with a Python script, something like this should get you started.

#!/usr/bin/python3

from smtplib import SMTP

smtp_server = '192.168.1.2'
smtp_port = 25
from_addr = "qradar@example.com"
to_addr = "analyst@example.com"
subject = "Mail from QRadar"

message_body_list = ['First Line of the email', '']
for x in range(6):
    message_body_list.append("Additional line {0}".format(x + 1))
message_body_list.append('')
message_body_list.append('Last line of the email')

smtp_data_list = [
    "From: {0}".format(from_addr),
    "To: {0}".format(to_addr),
    "Subject: {0}".format(subject)
]
smtp_data_list.append("")
smtp_data_list.extend(message_body_list)

smtp_data = "\n".join(smtp_data_list)

#
# Send the email :-)
#
my_smtp = SMTP()
my_smtp.connect(smtp_server, smtp_port)
my_smtp.sendmail(from_addr, to_addr, smtp_data)
my_smtp.quit()

Hi,

I am looking to send an email to a user when a QRadar event rule fires for that user

I have looked at custom action scripts and I can see that I can run a script passing in the username variable for that event

However, I seem to be having problem using the sendmail command int he script with a command not found error, on testing

If I run the sendmail command from the command line at /opt/qradar/bin/ca_jail/ustom_action_scripts directory, the email sends fine. If I try to run the deployed script in that same location I get a command not found error for sendmail

I guess that the jail location is unable to access sendmail. Is there an alternative mail option I can use in a custom action script or is that an alternative way to email a variable user from a fired event?

Hi,

I am looking to send an email to a user when a QRadar event rule fires for that user

I have looked at custom action scripts and I can see that I can run a script passing in the username variable for that event

However, I seem to be having problem using the sendmail command int he script with a command not found error, on testing

If I run the sendmail command from the command line at /opt/qradar/bin/ca_jail/ustom_action_scripts directory, the email sends fine. If I try to run the deployed script in that same location I get a command not found error for sendmail

I guess that the jail location is unable to access sendmail. Is there an alternative mail option I can use in a custom action script or is that an alternative way to email a variable user from a fired event?

In the rule itself one of the actions can be send email to a specific destination.  What you cannot do is to change the sender address.  It uses whatever the global setting it.  

Doesn't sound like to me you need a custom action. 

Hi,

I am looking to send an email to a user when a QRadar event rule fires for that user

I have looked at custom action scripts and I can see that I can run a script passing in the username variable for that event

However, I seem to be having problem using the sendmail command int he script with a command not found error, on testing

If I run the sendmail command from the command line at /opt/qradar/bin/ca_jail/ustom_action_scripts directory, the email sends fine. If I try to run the deployed script in that same location I get a command not found error for sendmail

I guess that the jail location is unable to access sendmail. Is there an alternative mail option I can use in a custom action script or is that an alternative way to email a variable user from a fired event?