Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Custom Email Routing by Alarm Subject or Application

Introduction​

By default, every email recipient configured in Notification Center (legacy) / Settings → Notifications (2.15.0) receives every alarm matching their configured filter. Some environments instead need specific alarms — for example, Ransomware Defender lockout events, or a specific Data Auditing (Easy Auditor) report — routed to a specific person or group mailbox, without also going to the general Eyeglass administrator distribution list.

This is an appliance-level capability, configured through the operating system's postfix mail transfer agent, and is separate from the in-GUI webhook mechanisms documented in Webhook Configuration:

  • This page — OS-level email routing, filtering, and redirection by alarm subject or body content, using postfix rules. Requires switching Eyeglass's outbound mail path to the appliance's local postfix service.
  • Data Security event webhooks — the in-GUI Integrations → Webhooks mechanism that pushes Ransomware Defender/Active Auditor threat events as JSON to a SIEM/SOAR endpoint.
  • Eyeglass alarm webhooks — the in-GUI Settings → Notifications → Webhooks mechanism for general Eyeglass/PowerScale alarms. As of this release, this webhook mechanism is not filterable by alarm subject or application — it delivers all configured alarms to a single endpoint. The postfix-based routing on this page is the supported way to split alarms by subject/application across multiple email destinations.

Limitations and Unsupported Configurations​

  • The first rule that matches an alarm exits the filter chain — later rules are not evaluated against that alarm.
  • Redirecting to multiple recipients on a single rule is not supported. Use a group/distribution email address if more than one person needs to receive a redirected alarm.
  • Notification Center → Manage Recipients (or Settings → Notifications → Alarm Recipients in 2.15.0) must still have at least one recipient configured to receive all alerts — this can be a dummy/unused mailbox — for the underlying alarm pipeline to function correctly.
  • Only the configurations documented below are supported.

Requirements​

  • openSUSE 15.3 or later is recommended.
  • SSH access to the Eyeglass appliance as admin.

Switch Eyeglass to Local Postfix Mail Relay​

By default, Eyeglass sends mail directly using the SMTP details configured in Notification Center. Postfix-based filtering requires first switching Eyeglass to route mail through the appliance's own postfix service, which then relays to your mail server.

note

This example assumes an anonymous, unauthenticated SMTP relay on port 25. For authenticated relay with TLS, see Advanced Postfix Configuration for SMTP Authentication and TLS below.

  1. SSH to Eyeglass as admin, then switch to root:

    sudo -s

  2. Edit the postfix relay configuration:

    nano /etc/postfix/main.cf

    Set the relayhost parameter to your mail server, keeping the square brackets:

    relayhost = [DNS or IP of your SMTP mail server]:25

  3. Set the outbound From address used on all emails sent through postfix:

    nano /etc/postfix/sender_canonical

    Add a line mapping the address configured in Eyeglass's Notification Center From field to the desired outbound address, for example:

    eyeglass@yourdomain.com eyeglass@yourdomain.com

  4. Save and restart postfix:

    systemctl restart postfix
    systemctl status postfix

  5. In the Eyeglass UI, open Notification Center → Configure SMTP (or Settings → Notifications → SMTP Server in 2.15.0) and set:

    • Host Name: localhost
    • Port: 25
    • From: any address, for example eyeglass@yourdomain.com

  6. Click Test Email Setting and confirm the test email is received before proceeding. Do not continue until this succeeds.

Add Filtering and Forwarding Rules​

  1. SSH to Eyeglass as admin, then switch to root:

    sudo -s

  2. Enable content filtering on both the email subject line and body:

    touch /etc/postfix/body_checks
    touch /etc/postfix/header_checks
    postconf -e "body_checks = regexp:/etc/postfix/body_checks"
    postconf -e "header_checks = regexp:/etc/postfix/header_checks"

  3. Edit the appropriate file for your rule:

    • header_checks — filters on the email subject line.
    • body_checks — filters on the email body content.
    nano /etc/postfix/header_checks
    # or
    nano /etc/postfix/body_checks

    Rules are evaluated in file order, one per line, using postfix's regex syntax. The available actions are REDIRECT <email>, DISCARD, and FILTER <service>:<host>:<port> (see Advanced: Route to Multiple Recipients below).

  4. After any change to body_checks or header_checks, reload and restart postfix:

    postfix reload
    systemctl restart postfix

Example: Route All Ransomware Defender Alarms to a Specific Mailbox​

Send all Ransomware Defender (Threat Detection) alarms to a specific mailbox, while discarding the daily Security Guard self-test email (adjust igls-sg to match your configured Security Guard service account name):

/igls-sg/ DISCARD
/Ransomware Defender/ REDIRECT customer_email@domain.com
note

Rule order matters — the Security Guard discard rule must come first, so self-test emails are discarded before the broader Ransomware Defender rule redirects everything else.

To route Security Guard emails to one mailbox and all other Ransomware Defender alarms to a different mailbox instead of discarding:

/igls-sg/ REDIRECT security_team@domain.com
/Ransomware Defender/ REDIRECT customer_email@domain.com

Example: Route Only Lockout Alarms​

Send only alarms where a user was locked out by Ransomware Defender to a specific mailbox, without also sending them to the general Eyeglass administrator recipient:

/^Subject: .*Locked/ REDIRECT xxxx@domain.com

Example: Route Data Auditing (Easy Auditor) Reports​

Send Easy Auditor report emails to a specific mailbox — only that recipient receives report emails:

/^Subject: Easy Auditor Report/ REDIRECT xxxx@domain.com

Or discard them entirely:

/^Subject: Easy Auditor Report/ DISCARD

Example: Route a Specific Trigger or Saved Report​

/trigger/ REDIRECT xxxx@domain.com
/trigger policy 1/ REDIRECT xxxx@domain.com
/departmentXReport/ REDIRECT xxxx@domain.com

The first line matches any trigger with "trigger" in its name; the second matches a specific trigger named "trigger policy 1"; the third matches a saved report named "departmentXReport", whether it was run manually or on a schedule.

Advanced: Route a Rule to Multiple Recipients​

To send a matched alarm to more than one mailbox, use the FILTER action with a small re-injection service defined in master.cf, instead of REDIRECT (which only supports a single recipient).

  1. Edit master.cf:

    nano /etc/postfix/master.cf

  2. Add the filter service and a re-injection listener, replacing the example addresses with your recipients:

    userFilter unix - n n - 10 pipe flags=Rq user=sca argv=/opt/superna/bin/email_filter.py ${sender} user_1@domain.com,user_2@domain.com

    127.0.0.1:10026 inet n - n - - smtpd
      -o content_filter=
      -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
      -o smtpd_helo_restrictions=
      -o smtpd_client_restrictions=
      -o smtpd_sender_restrictions=
      -o smtpd_recipient_restrictions=permit_mynetworks,reject
      -o mynetworks=127.0.0.0/8
      -o smtpd_authorized_xforward_hosts=127.0.0.0/8

    The userFilter service name must match what you reference in your body_checks/header_checks rule. The service must run as user sca, and the script path (/opt/superna/bin/email_filter.py) is fixed. The first script argument is always ${sender}; the second is a comma-separated (no spaces) list of recipient addresses.

  3. Reference the filter service from a rule in body_checks or header_checks, for example:

    /Ransomware Defender/ FILTER userFilter:127.0.0.1:10025

  4. Restart postfix:

    systemctl restart postfix
warning

All recipients listed in the userFilter line receive every alarm the rule matches — this is a broadcast to the full list, not a per-recipient filter.

Test a Filter or Forwarding Rule​

Trigger a matching alarm (for example, using Security Guard or Robo Audit's run-now option for Ransomware Defender/Data Auditing rules), then confirm the redirect took effect:

tail -f -n 100 /var/log/mail

Or search for previous matches:

grep orig_to /var/log/mail*

A matching line shows both the original recipient and the redirected recipient.

Advanced Postfix Configuration for SMTP Authentication and TLS​

If your mail relay requires authentication and TLS rather than anonymous SMTP:

  1. Add the Eyeglass hostname to /etc/hosts under the localhost entry, for example:

    127.0.0.1 localhost igls01 igls01.ad1.test

  2. Edit /etc/postfix/main.cf and set the relay to the TLS port (typically 587):

    relayhost = [x.x.x.x]:587

  3. Enable SASL authentication:

    smtp_sasl_auth_enable = yes
    smtp_sasl_security_options = noanonymous
    smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
    smtpd_sasl_auth_enable = no

  4. Create the credentials file and convert it to a lookup table, then remove the clear-text copy:

    nano /etc/postfix/sasl_passwd
    # [x.x.x.x]:587 user:password

    postmap lmdb:/etc/postfix/sasl_passwd
    rm /etc/postfix/sasl_passwd
    chown root:root /etc/postfix/sasl_passwd.lmdb
    chmod 600 /etc/postfix/sasl_passwd.lmdb

  5. Enable TLS:

    smtp_use_tls = yes
    smtp_tls_loglevel = 1

  6. Restart postfix and verify:

    systemctl restart postfix
    tail -f /var/log/mail

    Send a test email from Notification Center / Settings → Notifications and confirm a 250 OK response in the mail log.

Troubleshooting​

  • Check for queued mail that failed to send: sudo mailq
  • Retry delivery of queued mail: sudo postfix flush
  • Capture the current postfix configuration for a support case: postconf -n

See Also​

  • Disaster Recovery: Monitoring and Alerts — configure SMTP, Exchange relay, and syslog forwarding for DR alarms through the Eyeglass UI.
  • Webhook Configuration — the in-GUI webhook mechanisms for Data Security events and general Eyeglass alarms.
  • Alarm Codes Reference — full list of alarm code prefixes, including RSW (Ransomware Defender) and EAU (Easy Auditor), used when writing subject/body match rules.