Wazuh

Send Wazuh security alerts to Notifiq using a custom integration script.

Features

• Automatic severity mapping based on Wazuh rule levels
• Includes agent info, rule ID, description, and full log
• Bearer token authentication via Wazuh api_key parameter
• Configurable alert group filtering

Installation

1. Copy integration files to Wazuh:

cp examples/integrations/wazuh/custom-notifiq /var/ossec/integrations/
cp examples/integrations/wazuh/custom-notifiq.py /var/ossec/integrations/
chmod +x /var/ossec/integrations/custom-notifiq*
chown root:wazuh /var/ossec/integrations/custom-notifiq*

2. Verify Python requests is available:

/var/ossec/framework/python/bin/python3 -c "import requests"
# If not: /var/ossec/framework/python/bin/pip3 install requests

Configuration

Edit /var/ossec/etc/ossec.conf and add inside <ossec_config>:

<integration>
  <name>custom-notifiq</name>
  <hook_url>https://notify.yourdomain.com/api/notify</hook_url>
  <api_key>your_bearer_token_here</api_key>
  <group>syslog,sshd,authentication_success,authentication_failed,sudo,syscheck</group>
  <alert_format>json</alert_format>
</integration>

Restart Wazuh:

systemctl restart wazuh-manager

Severity mapping

Wazuh level	Notifiq level
0–6	info
7–9	warning
10–12	error
13+	critical

Troubleshooting

tail -f /var/ossec/logs/ossec.log
tail -f /var/ossec/logs/integrations.log

Common issues:

• Permission denied — check chown root:wazuh
• Integration not triggering — verify <group> matches actual Wazuh rule groups
• No alerts appearing — check minimum level setting in ossec.conf

Rate limiting

Add your Wazuh manager's IP to Settings → Security → Rate Limit Whitelist.