Integration with external APIs

Configuration

The integrations are configured on the Wazuh manager ossec.conf file. You can find this file in the Wazuh installation folder /var/ossec/etc/. To configure an integration, add the following configuration within the <ossec_config> section:

<integration>
  <name> </name>
  <hook_url> </hook_url> <!-- Required for Slack and Shuffle -->
  <api_key> </api_key> <!-- Required for PagerDuty and VirusTotal -->
  <alert_format>json</alert_format> <!-- Required for Slack, VirusTotal and Shuffle -->

  <!-- Optional filters -->
  <rule_id> </rule_id>
  <level> </level>
  <group> </group>
  <event_location> </event_location>
</integration>

After enabling the daemon and configuring the integrations, restart the Wazuh manager to apply the changes:

# systemctl restart wazuh-manager

# service wazuh-manager restart

Slack

This integration uses Slack Incoming Webhooks and allows posting Wazuh alerts into a Slack channel.

To set up this integration, follow these steps.

1. Enable Incoming Webhooks and create one for your Slack channel. Follow the Slack guide on Incoming Webhooks for this.

2. Edit /var/ossec/etc/ossec.conf in the Wazuh server and include a configuration block such as the following. Replace WEBHOOK_URL with your Incoming Webhook URL.

   <integration>
     <name>slack</name>
     <hook_url>WEBHOOK_URL</hook_url> <!-- Replace with your Slack hook URL -->
     <alert_format>json</alert_format>
   </integration>
   

3. Restart the Wazuh manager to apply the changes.

   SystemdSysV init

   # systemctl restart wazuh-manager
   

Once the configuration is complete, alerts start showing in the selected channel.

PagerDuty

PagerDuty is a SaaS incident response platform suitable for IT departments. The Pagerduty integration uses the Pagerduty API to forward Wazuh alerts to its Incidents Dashboard.

To set up this integration, do the following.

1. Get your own Events API v2 integration key by creating a Pagerduty new service.

2. Edit /var/ossec/etc/ossec.conf in the Wazuh server and include a configuration block such as the following. Replace API_KEY with your Pagerduty integration key. The rule level filter is optional and you can remove it or set another level value for the integration.

   <integration>
     <name>pagerduty</name>
     <api_key>API_KEY</api_key> <!-- Replace with your PagerDuty API key -->
     <level>10</level>
   </integration>
   

3. Restart the Wazuh manager to apply the changes.

   SystemdSysV init

   # systemctl restart wazuh-manager
   

Once the configuration is complete, alerts start showing on the Pagerduty dashboard.

VirusTotal

This integration allows the inspection of malicious files using the VirusTotal database. Find more information about this on the VirusTotal integration page.

To set up this integration, follow these steps.

1. Get your API key from the Virustotal API key page.

2. Edit /var/ossec/etc/ossec.conf in the Wazuh server and include a configuration block such as the following. Replace API_KEY with your Virustotal API key.

   <integration>
     <name>virustotal</name>
     <api_key>API_KEY</api_key> <!-- Replace with your VirusTotal API key -->
     <group>syscheck</group>
     <alert_format>json</alert_format>
   </integration>
   

3. Restart the Wazuh manager to apply the changes.

   SystemdSysV init

   # systemctl restart wazuh-manager
   

Shuffle

Shuffle is an Open Source interpretation of SOAR. It transfers data throughout the enterprise with plug-and-play Apps. The Shuffle integration allows forwarding Wazuh alerts into a Shuffle Workflow using a webhook.

To set up this integration, do the following.

1. Go to Shuffle and make a Workflow.

2. Set Recipients and Subject in the email configuration. Put $exec in the Body to include the alert information.

3. Add a webhook to the Workflow.

4. Start the webhook and copy the webhook URL.

5. Edit /var/ossec/etc/ossec.conf in the Wazuh server and include a configuration block such as the following. Replace https://shuffler.io/api/v1/hooks/webhook_WEBHOOK_ID with the webhook URL. The rule level filter is optional. You can remove it or set another level value for the integration.

   <integration>
      <name>shuffle</name>
      <hook_url>https://shuffler.io/api/v1/hooks/webhook_WEBHOOK_ID</hook_url> <!-- Replace with your Shuffle hook URL -->
      <level>3</level>
      <alert_format>json</alert_format>
   </integration>
   

6. Restart the Wazuh manager to apply the changes.

   SystemdSysV init

   # systemctl restart wazuh-manager
   

Once the configuration is complete, alerts start showing in the email inbox.

Custom integration

The integrator tool is able to connect Wazuh with other external software. Read the How to integrate external software using Integrator document for more information.

Below, you can find an example of a configuration block in the ossec.conf file for custom integration.

<!--Custom external Integration -->
<integration>
  <name>custom-integration</name>
  <hook_url>WEBHOOK</hook_url>
  <level>10</level>
  <group>multiple_drops,authentication_failures</group>
  <api_key>APIKEY</api_key> <!-- Replace with your external service API key -->
  <alert_format>json</alert_format>
</integration>