# Automating Email Whitelisting for Alerts (elasticsearch, kibana) **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [August 31, 2022, 2:41pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369 "2022-08-31T14:41:36Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Hayden\_WB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hayden_wb/32/100898_2.png) [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Post date:** [August 31, 2022, 2:41pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/1 "2022-08-31T14:41:36Z")
Hi folks! We are trying to achieve observability for a large organisation, and we now have users creating alerts in various elastic deployments. We have recently learned that, in order to receive the email alerts our users have set up, their emails must be whitelisted in the Elastic admin GUI ([cloud.elastic.co](http://cloud.elastic.co)). We have been performing this step manually (by adding their email addresses into the "Monitoring Email Whitelist" text box at [cloud.elastic.co/account/contacts](http://cloud.elastic.co/account/contacts)), but are seeing an increase in users, and thus an increase in manual input needed to whitelist email addresses. We are looking to automate this process, but I am struggling to find documentation that would help me to do so. The Elasticsearch Service Documentation on RESTful API suggests that the Organisation can be managed using API calls, but there is no mention of Contacts, or management of the email whitelist. Any pointers would be much appreciated. Thanks for your time! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 31, 2022, 2:51pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/2 "2022-08-31T14:51:04Z")
Hi @Hayden_WB Curious... What version of the Stack are you On? and How are you creating alerts? Watcher or new Kibana Alerting Frameworks? or Both? ---
**Author:** ![Hayden\_WB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hayden_wb/32/100898_2.png) [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Post date:** [August 31, 2022, 3:37pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/3 "2022-08-31T15:37:07Z")
Hi @stephenb! Most deployments are on 8.2.3, and we're using the new Kibana Alerting system. We're using the in-built connector (Elastic Cloud SMTP) if that helps? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 31, 2022, 5:08pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/4 "2022-08-31T17:08:59Z")
@Hayden_WB Apologies.. Looking at the API (and Terraform) I do not see a programatic way to update the email whitelist at this time.. I will poke around a bit more. Contact / Members can be update via that API but that is different than the operational contacts / emails which are you are looking to manage. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 31, 2022, 7:45pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/5 "2022-08-31T19:45:21Z")
@Hayden_WB Poked around internall .. No Not Today, have some items on the backlog but no public date Perhaps 1. remove the per-email whitelist altogether 2. allow customers to run a "domain allowlist" instead of per-email ---
**Author:** ![Hayden\_WB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hayden_wb/32/100898_2.png) [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Post date:** [September 1, 2022, 9:22am UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/6 "2022-09-01T09:22:09Z")
Thanks for your help Stephen! Could you provide some more detail on your two suggested steps? 1. remove the per-email whitelist altogether As in, don't use the "Monitoring Email Whitelist" text box at [cloud.elastic.co/account/contacts](http://cloud.elastic.co/account/contacts)? Or do I need to do something more than not using it? 1. allow customers to run a "domain allowlist" instead of per-email Is this achieved through `xpack.actions.email.domain_allowlist`? From the documentation: > A list of allowed email domains which can be used with the email connector. When this setting is not used, all email domains are allowed. When this setting is used, if any email is attempted to be sent that (a) includes an addressee with an email domain that is not in the allowlist, or (b) includes a from address domain that is not in the allowlist, it will fail with a message indicating the email is not allowed. If so, then I'll have a go and see where I get! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 1, 2022, 1:32pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/7 "2022-09-01T13:32:35Z")
Apologies for the confusion. > [@stephenb](#): > > Perhaps > > 1. remove the per-email whitelist altogether > 2. allow customers to run a "domain allowlist" instead of per-email Those were the potential future capabilities that may be on the road map. I was not suggesting that you could implement them today. And no, you cannot apply that setting the allowed list setting. None of these restrictions apply. If you use your own email endpoint or service, perhaps you should consider that. ---
**Author:** ![Hayden\_WB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hayden_wb/32/100898_2.png) [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Post date:** [September 1, 2022, 2:46pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/8 "2022-09-01T14:46:56Z")
Thanks for the clarification Stephen, much appreciated! ---
**Author:** ![EricDavisX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericdavisx/32/73456_2.png) [@EricDavisX](https://discuss.elastic.co/u/EricDavisX)\ **Post date:** [September 1, 2022, 5:03pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/9 "2022-09-01T17:03:29Z")
Hi - I came across this, and wanted to be sure if this wasn't solvable by moving to one or more domains to be allow-listed in Kibana, as per here: > **[Alerting and action settings in Kibana | Kibana Guide \[8.4\] | Elastic](https://www.elastic.co/guide/en/kibana/current/alert-action-settings-kb.html)** Good luck! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 1, 2022, 5:27pm UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/10 "2022-09-01T17:27:55Z")
> [@EricDavisX](#): > > Hi - I came across this, and wanted to be sure if this wasn't solvable by moving to one or more domains to be allow-listed in Kibana, as per here: Hi @EricDavisX Unfortunately those setting are not supported how the OP is operating, using the built in Elastic Cloud SMTP service. The referenced settings only apply if you are using yours / 3rd party mail services set up through connectors etc. not the Built in Elastic Cloud SMTP service ---
**Author:** ![Hayden\_WB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hayden_wb/32/100898_2.png) [@Hayden\_WB](https://discuss.elastic.co/u/Hayden_WB)\ **Post date:** [September 2, 2022, 8:33am UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/11 "2022-09-02T08:33:11Z")
Thanks Eric! I've seen what Stephen has posted below too, but this is helpful - we may move out to a 3rd party mail service for this functionality if we see a deluge of whitelisting requests 😃 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 30, 2022, 8:33am UTC](https://discuss.elastic.co/t/automating-email-whitelisting-for-alerts-elasticsearch-kibana/313369/12 "2022-09-30T08:33:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.