Wazuh

The Wazuh connector retrieves into OverView the endpoints monitored by your Wazuh agents: their operating system, hardware (processor, memory, serial number) and network interfaces, their installed software (packages, Windows updates, services, browser extensions), open ports and local user accounts, the vulnerabilities detected on them (CVE, severity, CVSS score), the security alerts they raised and, optionally, the results of their SCA compliance scans (CIS benchmarks). The Wazuh console accounts and their roles are imported as well.

A Wazuh deployment exposes two APIs and the connector reads both: the Wazuh server API holds the agent registry, groups and compliance results, while the Wazuh indexer holds the endpoint inventory, vulnerabilities and alerts. Each one has its own URL and its own account.

Prerequisites

• Wazuh 4.13 or later, the first version that stores the endpoint inventory in the Wazuh indexer
• An administrator account on the Wazuh dashboard, to create the two read-only accounts below
• Network access from OverView to:
  • the Wazuh server API (HTTPS, port 55000 by default)
  • the Wazuh indexer (HTTPS, port 9200 by default)

On a single-node (all-in-one) installation, the Wazuh indexer usually listens on 127.0.0.1 only, so it refuses connections from outside the server even when the firewall allows port 9200. The listening address is the network.host setting in /etc/wazuh-indexer/opensearch.yml: set it to an address OverView can reach, then restart the wazuh-indexer service.

Information to provide in OverView

Parameters

These parameters are optional. Leave them at their default value unless you have a specific reason to change them.

A deployment whose rules produce a high volume of false positives at levels 12 and above can return hundreds of thousands of alerts a week. Raising Minimum Alert Level reduces that volume; disabling Include Alerts leaves the inventory and vulnerabilities unaffected.

Procedure

The procedure creates two read-only accounts: a Wazuh server API user and a Wazuh indexer internal user. They are separate accounts, stored in two separate user databases; they can share the same username and password.

Create the policy and role for the server API

The built-in readonly role covers agents, groups, compliance and inventory, but not the Wazuh console accounts. A dedicated role adds that read access.

1. On the Wazuh dashboard, open the menu (☰) and go to Server management > Security.
2. On the Policies tab, click Create policy and fill in:
   • Policy name: overview-security-read
   • Action: security:read
   • Resource: user:id, role:id and policy:id, each with the resource identifier *
   • Select an effect: Allow
3. Click Create policy.
4. On the Roles tab, click Create Role, enter the Role name overview-security-read, select the overview-security-read policy in Policies, then click Create role.

Create the server API user

1. In Server management > Security, create a user (e.g., overview-connector) with a password.
2. Assign it two roles: readonly and overview-security-read.

Copy the username and password into Server API Username and Server API Password in OverView.

Create the indexer user

1. Open the menu (☰) and go to Indexer management > Security > Internal users.
2. Click Create internal user, enter a username (e.g., overview-connector) and a password, then click Create.
3. Go to Indexer management > Security > Roles and click Create role:
   • Name: overview-read
   • Cluster permissions: cluster_composite_ops_ro
   • Index: *
   • Index permissions: read
4. Click Create.
5. On the Mapped users tab of the new role, click Manage mapping, add the internal user created in step 2, then click Map.

Without step 5, the user authenticates but cannot read any index: the import then fails on the vulnerabilities and inventory.

Copy the username and password into Indexer Username and Indexer Password in OverView.

Configure the Connector in OverView

1. In OverView, go to Data Sources Settings > Sources.
2. Select Wazuh and click Configure.
3. Fill in the two URLs and the two accounts, adjust the parameters if needed, then click Save Configuration.

Required Permissions

The connector only reads data; it never modifies the Wazuh configuration, agents or rules.

Verify the access

From a machine that can reach the Wazuh server, run:

# Server API: returns a token, then the agents visible to the user
TOKEN=$(curl -sk -u "SERVER_USER:SERVER_PASSWORD" -X POST \
  "https://wazuh.example.com:55000/security/user/authenticate?raw=true")
curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://wazuh.example.com:55000/agents?limit=1"

# Indexer: number of vulnerabilities readable by the user
curl -sk -u "INDEXER_USER:INDEXER_PASSWORD" \
  "https://wazuh.example.com:9200/wazuh-states-vulnerabilities-*/_count"

Both calls must return data. A 401 means a wrong username or password; a 403 on the indexer means the role is not mapped to the user.

Security Best Practices

• Use dedicated accounts for the OverView integration rather than the admin or wazuh accounts
• Keep both accounts read-only: the roles above grant no write action
• The indexer role can be restricted to the wazuh-states-vulnerabilities-*, wazuh-states-inventory-* and wazuh-alerts-* index patterns instead of *
• Rotate the passwords regularly according to your organization's security policy

Official Documentation

• Wazuh RBAC: creating a read-only user
• Wazuh server API RBAC configuration
• Wazuh server API reference
• Wazuh indexer configuration