Edit the ossec.conf file by entering the following:
<syslog_output>
<server>IP ADDRESS</server>
<format>cef</format>
</syslog_output>
NOTE: The IP ADDRESS should be the address of the Precinct Streamer or All-In-One appliance you choose to send the syslog output to.
Wazuh instructions can be found here.