Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 4.4.0

Custom Email and Webhook Routing by Application

Overview​

This guide covers routing specific Eyeglass alarms or notifications to a specific email address or group, most commonly used to send Easy Auditor or Ransomware Defender notifications to a dedicated recipient while keeping other system alarms out of that mailbox.

note

For the generic Notification Center Slack, Rocket.Chat, and Webhooks tab configuration (URL, headers, severity-level filtering), see Integrations with Slack, Rocket.Chat, and Webhook for Notifications. For the richer Ransomware Defender/Easy Auditor Zero Trust webhook integration (event-lifecycle filtering, full JSON payload for SIEM/SOAR/ITSM automation), see the link at the bottom of this page.

Custom Email Routing (Postfix)​

Limitations and Unsupported Configurations​

  • The first rule that matches a message wins — no further rules in the file are evaluated for that message.
  • Redirecting to multiple email addresses on a single rule, or multiple rows with different emails for the same match, is unsupported. Use a group email address for multiple recipients.
  • Requires an email address configured in Notification Center > Managed Recipients that receives all alerts (a dummy address is fine) for the mechanism to function correctly.
  • Configurations not documented in this guide are not supported.

Requirements​

openSUSE 15.3 or later is recommended.

Switch to Local Postfix SMTP Relay​

Most Eyeglass deployments enter SMTP server details directly in Notification Center. To apply custom routing rules, switch to a local Postfix relay instead.

note

This assumes anonymous, non-authenticated SMTP over port 25. See Authenticated SMTP with TLS below for authentication and TLS configuration.

  1. SSH to Eyeglass as admin, then elevate to root: 
    sudo -s
  2. Edit the Postfix relay setting: 
    nano /etc/postfix/main.cf
    Search for the last (uncommented — no # prefix) occurrence of relayhost with Ctrl+W, relayhost, Enter (repeat up to 8 times to reach the correct line).
  3. Set the relay host (keep the square brackets): 
    relayhost = [DNS or IP of your SMTP mail server]:25
  4. Set the outbound "from" address for all emails: 
    nano /etc/postfix/sender_canonical
    Add a line mapping the address configured in Eyeglass's Notification Center "from" field to the desired outbound address: 
    eyeglass@redacted.gz eyeglass@quazar.redacted
    Save with Ctrl+X, then Y, then Enter.
  5. Restart Postfix: 
    systemctl restart postfix
    systemctl status postfix
  6. In the Eyeglass UI, go to Notification Center > Configure SMTP > Outgoing Email Server Information:
    • Host Name: localhost
    • Port: 25
    • From email: any address, e.g. eyeglass@<your domain>
    • Enter a test recipient and click Test E-mail Setting — confirm the test email arrives before proceeding.

Adding Filtering and Forwarding Rules to Postfix​

  1. Log in as admin via SSH, then elevate to root: sudo -s

  2. Enable content filtering on both subject and body (mandatory, one-time step):

    touch /etc/postfix/body_checks
    touch /etc/postfix/header_checks
    postconf -e "body_checks = regexp:/etc/postfix/body_checks"
    postconf -e "header_checks = regexp:/etc/postfix/header_checks"

  3. Edit the appropriate file depending on what you're filtering:

    • nano /etc/postfix/header_checks — filter/forward by email subject line
    • nano /etc/postfix/body_checks — filter/forward by email body content

    Rules use regex syntax (see the Postfix header_checks man page). Each rule is on its own line; rules are evaluated in order and the first match wins.

Example 1: Route All Ransomware Alarms to One Address, Discard or Redirect Security Guard Test Emails​

Assumes the Security Guard service account is named igls-sg — substitute your configured name.

Discard Security Guard test emails and forward all other Ransomware Defender alarms to one address (body_checks, discard rule first):

/igls-sg/ DISCARD
/Ransomware Defender/ REDIRECT customer_email@domain.com

Or forward Security Guard emails to one address and other Ransomware Defender alarms to a different address:

/igls-sg/ REDIRECT customer_email_A@domain.com
/Ransomware Defender/ REDIRECT customer_email_B@domain.com

Example 2: Route Only Ransomware Defender Lockout Alarms​

header_checks:

/^Subject: .*Locked/ REDIRECT xxxx@domain.name

Example 3: Route Easy Auditor Reports to a Specific Recipient​

header_checks:

/^Subject: Easy Auditor Report/ REDIRECT xxxx@domain.name

Example 4: Discard All Easy Auditor Report Emails​

header_checks:

/^Subject: Easy Auditor Report/ DISCARD

Example 5: Route a Specific Trigger or Saved Report​

Trigger and saved-report names appear in the body of the alert email — name them consistently (e.g. prefix with "trigger") to make matching easier.

body_checks:

/trigger/ REDIRECT xxxx@domain.name
/trigger policy 1/ REDIRECT xxxx@domain.name
/departmentXReport/ REDIRECT xxxx@domain.name

Activate Filtering Rules (Mandatory After Any Change)​

postfix reload
systemctl restart postfix

Testing and Debugging Rules​

tail -f -n 100 /var/log/mail

or search for redirected mail:

grep orig_to /var/log/mail*

This shows the original and redirected recipient for each match. Easy Auditor and Ransomware Defender test scenarios can be triggered using Security Guard or the Robot Audit "run now" option.

Advanced: Filter Delivery to Multiple Recipients​

Unlike REDIRECT/DISCARD (which stop further rule processing), a FILTER rule can deliver to multiple recipients via a script.

  1. Edit /etc/postfix/master.cf and add:

    userFilter unix - n n - 10 pipe flags=Rq user=sca argv=/opt/superna/bin/email_filter.py ${sender} user_1@superna.net,user_2@superna.net

    127.0.0.1:10026 inet n - n - - smtpd
      -o content_filter=
      -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
      -o smtpd_helo_restrictions=
      -o smtpd_client_restrictions=
      -o smtpd_sender_restrictions=
      -o smtpd_recipient_restrictions=permit_mynetworks,reject
      -o mynetworks=127.0.0.0/8
      -o smtpd_authorized_xforward_hosts=127.0.0.0/8

    userFilter must match the service name referenced in body_checks/header_checks. The user must be sca. The script path (/opt/superna/bin/email_filter.py) is fixed. The first script argument must be ${sender}; the second is a comma-separated (no spaces) list of recipient addresses.

  2. In body_checks or header_checks, reference the filter service instead of REDIRECT/DISCARD:

    /igls-ra/ FILTER userFilter:127.0.0.1:10025
    /Ransomware Defender/ FILTER userFilter:127.0.0.1:10025
    /^Subject: .*Locked/ FILTER userFilter:127.0.0.1:10025

  3. Ensure main.cf has:

    body_checks = regexp:/etc/postfix/body_checks
    header_checks = regexp:/etc/postfix/header_checks

  4. Restart Postfix: postfix reload && systemctl restart postfix

note

FILTER rules send to all configured recipients (unlike REDIRECT, which sends to one address per match).

Migrating Postfix Configuration to a Newer OpenSUSE Release​

When restoring an Eyeglass backup from a 15.1/15.2 appliance onto a 15.3+ appliance that had Postfix configured:

  1. Unzip the Eyeglass backup on a Windows PC and locate the Postfix backup files (main.cf, body_checks, header_checks). Backups from release 2.5.8+ include these automatically; for older releases, retrieve them manually from the old appliance.
  2. On the new appliance, ssh admin, then sudo -s.
  3. Edit /etc/postfix/main.cf, locate the relayhost line (search 8 times as above), and copy over the relayhost value from the backup's main.cf.
  4. Re-create the filtering config: 
    touch /etc/postfix/body_checks
    touch /etc/postfix/header_checks
    postconf -e "body_checks = regexp:/etc/postfix/body_checks"
    postconf -e "header_checks = regexp:/etc/postfix/header_checks"
  5. Paste the contents of the backed-up body_checks/header_checks files into the new files on the appliance.
  6. Activate: postfix reload.
  7. Test email delivery and confirm the rules still match as expected.

Authenticated SMTP with TLS​

note

Authentication + TLS is the only supported configuration for authenticated relay. This assumes the basic relay configuration above is already in place.

  1. SSH as admin, then sudo -s.
  2. Add the appliance's FQDN to the localhost line in /etc/hosts: 
    127.0.0.1 localhost igls01 igls01.ad1.test
  3. Edit /etc/postfix/main.cf and update the relayhost line to use the TLS port (commonly 587): 
    relayhost = [x.x.x.x]:587
  4. Configure SASL authentication (search sasl in main.cf): 
    smtp_sasl_auth_enable = yes
    smtp_sasl_security_options = noanonymous
    smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
    smtpd_sasl_auth_enable = no
  5. Create the credentials file: 
    nano /etc/postfix/sasl_passwd
    [x.x.x.x]:587 user:password
  6. Convert to a format Postfix can read, then remove the plaintext file: 
    postmap lmdb:/etc/postfix/sasl_passwd
    rm /etc/postfix/sasl_passwd
  7. Secure the resulting database file: 
    chown root:root /etc/postfix/sasl_passwd.lmdb
    chmod 600 /etc/postfix/sasl_passwd.lmdb
  8. Restart Postfix: systemctl restart postfix
  9. Enable TLS (search tls in main.cf): 
    smtp_use_tls = yes
    smtp_tls_loglevel = 1

Debugging Postfix Relay Issues​

tail -f /var/log/mail

Send a test email from Eyeglass's Notification Center to confirm authentication and TLS succeed (look for a 250 OK response).

sudo mailq

Lists any queued mail that failed to send, with a reason code.

sudo postfix flush

Re-attempts delivery of queued mail.

postconf -n

Dumps the active Postfix configuration — useful when working with support.

Ransomware Defender & Easy Auditor Webhooks (Zero Trust)​

This feature integrates Ransomware Defender/Easy Auditor alerts with real-time webhooks, with customizable payload data for SIEM and security-automation consumption.

This is covered in detail, including configuration steps, payload inspection, and a ServiceNow integration example, in Ransomware Defender & Easy Auditor Webhooks (Zero Trust) under Data Security Reference.