Sending Wazuh syslog output to Precinct

[Mike Riforgiate]

Configuring Wazuh

Note: For server IP, input the IP address of the Precinct Streamer node or All-In-One appliance.

Note: Use level configuration to select specific alert levels to be sent to Precinct.  No level config will send all alerts (recommended).

Syslog output is configured in the ossec.conf file. All of the available options are detailed in Syslog output.

 

<ossec_config>
  <syslog_output>
    <format>cef</format>
    <server>WITFOO APPLIANCE IP</server>
  </syslog_output>
</ossec_config>

The above configuration will send all alerts to Precinct.

 

To send only level-specific alerts to Precinct, insert the level format as shown below

<ossec_config>
  <syslog_output>
    <level>9</level>
    <format>cef</format>
    <server>WITFOO APPLIANCE IP</server>
  </syslog_output>
</ossec_config>

The above configuration will send alerts to Precinct if the alert level is higher than 9.

 

To apply the changes, restart Wazuh:

1. For Systemd:  # systemctl restart wazuh-manager

2. For SysV Init:  # service wazuh-manager restart

 

Wazuh Syslog Config doc

[Author]

Posts