Configuring Scheduled Email Reports in Atomic Inspector

1. Create the SMTP sender in Inspector

In Inspector, go to:

Management → Notifications → Email senders → Create sender

Enter:

• Sender name: use a simple lowercase name, such as reports
• Email address: the From address
• SMTP hostname / port: supplied by your mail provider
• Encryption: normally STARTTLS or SSL/TLS

Save the sender. Do not put the password in the UI.

2. Add the SMTP credentials to OpenSearch

These commands run on the Hub host. Replace reports only if you used a different sender name in the UI.

docker exec -it opensearch-node1 \
  /usr/share/opensearch/bin/opensearch-keystore add \
  opensearch.notifications.core.email.reports.username

Enter the SMTP username when prompted.

docker exec -it opensearch-node1 \
  /usr/share/opensearch/bin/opensearch-keystore add \
  opensearch.notifications.core.email.reports.password

Enter the SMTP password when prompted.

3. Save the keystore outside the container

This makes the credentials survive an Inspector/OpenSearch update that recreates the container.

docker cp opensearch-node1:/usr/share/opensearch/config/opensearch.keystore \
  /var/awp/contrib/db/config/opensearch/opensearch.keystore

chown 1000:1000 /var/awp/contrib/db/config/opensearch/opensearch.keystore
chmod 600 /var/awp/contrib/db/config/opensearch/opensearch.keystore

4. Mount the persistent keystore into OpenSearch

Back up the compose file:

cp /var/awp/contrib/db/docker-compose.yml \
  /var/awp/contrib/db/docker-compose.yml.pre-smtp-keystore

Edit it:

vi /var/awp/contrib/db/docker-compose.yml

Find the service for the opensearch-node1 container and its existing volumes: section. Add this line alongside the other OpenSearch volume mappings:

- /var/awp/contrib/db/config/opensearch/opensearch.keystore:/usr/share/opensearch/config/opensearch.keystore

If the other host-path volume lines in that section end in :Z, add that same suffix to this new line.

Validate the compose file:

cd /var/awp/contrib/db
docker compose config -q

No output means the compose syntax is valid.

5. Recreate OpenSearch

docker compose up -d --force-recreate opensearch-node1

Inspector searches and reports may be unavailable for a minute or two while OpenSearch starts.

Confirm the credentials are present:

docker exec opensearch-node1 \
  /usr/share/opensearch/bin/opensearch-keystore list | \
  grep 'opensearch.notifications.core.email.reports'

You should see:

opensearch.notifications.core.email.reports.username
opensearch.notifications.core.email.reports.password

6. Create an email channel

In Inspector:

Management → Notifications → Channels → Create channel

• Choose Email
• Select the sender created in step 1
• Add the recipient email address(es)
• Click Send test message
• Save the channel after the test arrives

7. Schedule and email the report

1. Open the dashboard, visualization, or saved search.
2. Set the filters and time range you want.
3. Select Reporting → Create report definition.
4. Choose the report format:
   • Dashboard/visualization: PDF or PNG
   • Saved search: CSV or XLSX
5. Under Report trigger, choose Schedule and set the interval or cron schedule.
6. Under Delivery, select the email channel from step 6.
7. Save the report definition.

OpenSearch will generate the report on schedule, then email it through that channel.