Configure mail plugin for Velociraptor

[spza2929]

Hi Guys,
I am struggling with getting the mail plugin to work. I have a VQL query calling the mail plugin, but the log from the query states that no server is specified (mail: server not specified). From what I can tell the mail plugin is configured by adding the following to the server.config.yaml file:

server: "smtp.gmail.com"
auth_username: emailaddress here@gmail.com
auth_password: app password here

but doing this and restarting the service on the linux server shows the same error. I have found that in 6.2 it is possible to configure the mail plugin completely from VQL, but I am an extreme novice at VQL and dont begin to know how that would be done, and the plugin info from the doucmentation site just states what the arg fields are for the mail plugin, without any examples or info on where to put those args. This may sound like a really novice issue, but I am stuck, I have an artifact that successfully monitors USB writes, and then should theoretically email the event, and everything is working except the email. Below is the VQL for that monitor that is producing the error of no server specified:

The VQL query that is getting the server not specified error is:

name: Custom.Server.Alerts.ThumbDriveUse
description: |
Send an email if thumb drive use was detected on
any client. This is a server side artifact.

type: SERVER_EVENT

parameters:

• name: EmailAddress
  default: admin@example.com
• name: SkipVerify
  type: bool
  description: If set we skip TLS verification.
• name: MessageTemplate
  default: |
  Thumb drive used

sources:

• query: |
  SELECT * FROM foreach(
  row={
  SELECT * from watch_monitoring(
  artifact='Windows.Detection.Thumbdrives.List')
  },
  query={
  SELECT * FROM mail(
  to=EmailAddress,
  subject='thumb drive alert',
  period=60,
  skip_verify=SkipVerify,
  body=format(
  format=MessageTemplate,
  args=[Timestamp, CommandLine, ClientId])
  )
  })

---

If someone could give me instructions with kid gloves on how to configure the mail plugin I would very much appreciate it.
Many thanks in advance,
Jon

[scudette]

You need to specify the mail server to connect to (over port 445) to actually send the email. If you have a local mail agent for example (exim or sendmail) it would be localhost, but more than likely it will be and external relay server - like for example smtp.gmail.com

See https://developers.google.com/gmail/imap/imap-smtp#protocol

and if you want to use gmail you will need an application password see here

https://support.google.com/mail/answer/185833?hl=en

[scudette]

The VQL should something like (You do not need to skip verify because gmail has a proper cert).

SELECT * FROM mail(
   to=EmailAddress,
   subject='thumb drive alert',
   period=60,
   server="smtp.gmail.com",
   body=format(
      format=MessageTemplate,
      args=[Timestamp, CommandLine, ClientId])
)

[spza2929]

Thank you Mike. I was able to get it working, thanks for the help!