Wazuh

Wazuh

1) Connector overview

Field
Value
Type
XDR, SIEM
Vendor platform
 https://wazuh.com 
Vendor documentation
 https://documentation.wazuh.com 
Pre-filtered link
Yes. Opens the Discover view of your Wazuh dashboard on the Wazuh alerts, filtered on the IP address of the agent installed on the target and on the execution window of the event.
API data retrieval
Yes. For each alert: rule name, date and command. The name of the alert links to its details in the Wazuh console.
Qualification modes
Automatic & Semi-automatic
Automatic behavior
Sets the Alerted detection status when at least one command reported by a Wazuh alert matches an IOC command of the BlackNoise event.

Example of automated data retrieval through API
See  Connectors  for how the pre-filtered link, data collection and qualification modes work, and  Event statuses & severity  for the meaning of the detection statuses.

2) Configuration

Before you start

You need:
  • an account on the Wazuh indexer allowed to read the Wazuh alerts;
  • the URLs of your Wazuh dashboard, Wazuh server API and Wazuh indexer;
  • HTTPS access from BlackNoise to your Wazuh URLs. For on-premises instances, allow inbound HTTPS traffic from BlackNoise to the API URL on the configured port. BlackNoise initiates all connections. Contact your BlackNoise administrator for the source IP address.

Prepare Wazuh

Wazuh relies on three components, which can run on the same machine or on separate ones: the dashboard, the server and the indexer. BlackNoise reads the alerts from the indexer, and builds its links to the dashboard.
Step 1 - Make the indexer reachable. In an all-in-one installation, the Wazuh indexer listens only on 127.0.0.1 by default. Set network.host in /etc/wazuh-indexer/opensearch.yml so that BlackNoise can reach it, then restart the indexer.
Step 2 - Get the indexer credentials. BlackNoise authenticates on the indexer with a username and a password. Use an account allowed to read the Wazuh alerts, and treat its password like any other credential: store it in your password manager, and never paste it into a ticket or a chat.

Fill in the connector in BlackNoise

In BlackNoise, open Resources > Connectors and click Configure on the Wazuh card.
Field
What it is
Where to find it
Dashboard URL
Address of the Wazuh web interface, used to build the pre-filtered links
The address you use to open Wazuh, port 443 by default, for example https://wazuh.example.com
API URL
Address of the RESTful API of the Wazuh server
Port 55000 by default, for example https://wazuh.example.com:55000
Indexer URL
Address of the RESTful API of the Wazuh indexer, from which BlackNoise reads the alerts
Port 9200 by default, for example https://wazuh.example.com:9200
Username
Account used to read the alerts on the indexer
Step 2
Password
Password of this account
Step 2
The same window offers an option to disable verification of the TLS certificate of your Wazuh instance. See  Connectors  for when to use it.
Click Save and connect. BlackNoise runs connection tests, and the connector becomes operational if they pass.