[{"data":1,"prerenderedAt":1032},["ShallowReactive",2],{"connector-en-wazuh":3},{"id":4,"title":5,"body":6,"category":1023,"description":1024,"extension":1025,"meta":1026,"navigation":878,"path":1027,"seo":1028,"sidebar":1029,"stem":1030,"updatedAt":1023,"__hash__":1031},"connectorsEn\u002Fen\u002Fconnectors\u002Fwazuh.md","Wazuh",{"type":7,"value":8,"toc":1007},"minimark",[9,13,25,30,66,86,90,178,182,185,304,313,317,328,333,340,440,444,465,473,477,565,568,574,578,603,607,610,765,774,778,781,906,917,921,963,967,971,1003],[10,11,12],"p",{},"The Wazuh connector retrieves into OverView the endpoints monitored by your Wazuh agents: their operating system, hardware (processor, memory, serial number) and network interfaces, their installed software (packages, Windows updates, services, browser extensions), open ports and local user accounts, the vulnerabilities detected on them (CVE, severity, CVSS score), the security alerts they raised and, optionally, the results of their SCA compliance scans (CIS benchmarks). The Wazuh console accounts and their roles are imported as well.",[10,14,15,16,20,21,24],{},"A Wazuh deployment exposes two APIs and the connector reads both: the ",[17,18,19],"strong",{},"Wazuh server API"," holds the agent registry, groups and compliance results, while the ",[17,22,23],{},"Wazuh indexer"," holds the endpoint inventory, vulnerabilities and alerts. Each one has its own URL and its own account.",[26,27,29],"h2",{"id":28},"prerequisites","Prerequisites",[31,32,33,41,44],"ul",{},[34,35,36,37,40],"li",{},"Wazuh ",[17,38,39],{},"4.13 or later",", the first version that stores the endpoint inventory in the Wazuh indexer",[34,42,43],{},"An administrator account on the Wazuh dashboard, to create the two read-only accounts below",[34,45,46,47],{},"Network access from OverView to:\n",[31,48,49,59],{},[34,50,51,52,54,55,58],{},"the ",[17,53,19],{}," (HTTPS, port ",[17,56,57],{},"55000"," by default)",[34,60,51,61,54,63,58],{},[17,62,23],{},[17,64,65],{},"9200",[10,67,68,69,73,74,77,78,81,82,85],{},"On a single-node (all-in-one) installation, the Wazuh indexer usually listens on ",[70,71,72],"code",{},"127.0.0.1"," only, so it refuses connections from outside the server even when the firewall allows port 9200. The listening address is the ",[70,75,76],{},"network.host"," setting in ",[70,79,80],{},"\u002Fetc\u002Fwazuh-indexer\u002Fopensearch.yml",": set it to an address OverView can reach, then restart the ",[70,83,84],{},"wazuh-indexer"," service.",[26,87,89],{"id":88},"information-to-provide-in-overview","Information to provide in OverView",[91,92,93,106],"table",{},[94,95,96],"thead",{},[97,98,99,103],"tr",{},[100,101,102],"th",{},"Field",[100,104,105],{},"Description",[107,108,109,125,135,145,159,169],"tbody",{},[97,110,111,118],{},[112,113,114,117],"td",{},[17,115,116],{},"Server API URL","*",[112,119,120,121,124],{},"URL of the Wazuh server API, with its port (e.g., ",[70,122,123],{},"https:\u002F\u002Fwazuh.example.com:55000",")",[97,126,127,132],{},[112,128,129,117],{},[17,130,131],{},"Server API Username",[112,133,134],{},"Username of the Wazuh server API user created for OverView",[97,136,137,142],{},[112,138,139,117],{},[17,140,141],{},"Server API Password",[112,143,144],{},"Password of that user",[97,146,147,152],{},[112,148,149,117],{},[17,150,151],{},"Indexer URL",[112,153,154,155,158],{},"URL of the Wazuh indexer, with its port (e.g., ",[70,156,157],{},"https:\u002F\u002Fwazuh.example.com:9200","). On a single-node installation, it is the same host as the server API, on a different port.",[97,160,161,166],{},[112,162,163,117],{},[17,164,165],{},"Indexer Username",[112,167,168],{},"Username of the Wazuh indexer internal user created for OverView",[97,170,171,176],{},[112,172,173,117],{},[17,174,175],{},"Indexer Password",[112,177,144],{},[26,179,181],{"id":180},"parameters","Parameters",[10,183,184],{},"These parameters are optional. Leave them at their default value unless you have a specific reason to change them.",[91,186,187,199],{},[94,188,189],{},[97,190,191,194,196],{},[100,192,193],{},"Parameter",[100,195,105],{},[100,197,198],{},"Default",[107,200,201,214,227,253,265,278,291],{},[97,202,203,208,211],{},[112,204,205],{},[17,206,207],{},"Verify SSL Certificate",[112,209,210],{},"Verifies the TLS certificates presented by the Wazuh server API and indexer. Disable it only if they still use the self-signed certificates Wazuh ships with.",[112,212,213],{},"Enabled",[97,215,216,221,224],{},[112,217,218],{},[17,219,220],{},"Agent Group",[112,222,223],{},"Imports only the agents of this Wazuh group. Leave empty to import every agent.",[112,225,226],{},"Empty",[97,228,229,234,251],{},[112,230,231],{},[17,232,233],{},"Agent Status",[112,235,236,237,240,241,240,244,240,247,250],{},"Imports only the agents in the selected states: ",[17,238,239],{},"Active",", ",[17,242,243],{},"Disconnected",[17,245,246],{},"Pending",[17,248,249],{},"Never connected",". Leave empty to import every agent. Disconnected agents are the ones that reveal endpoints no longer reporting.",[112,252,226],{},[97,254,255,260,263],{},[112,256,257],{},[17,258,259],{},"Include Alerts",[112,261,262],{},"Imports the Wazuh security alerts of each agent.",[112,264,213],{},[97,266,267,272,275],{},[112,268,269],{},[17,270,271],{},"Alert Retrieval Days",[112,273,274],{},"Number of days of alerts retrieved at each import.",[112,276,277],{},"7",[97,279,280,285,288],{},[112,281,282],{},[17,283,284],{},"Minimum Alert Level",[112,286,287],{},"Imports only the alerts whose Wazuh rule level (0 to 15) is at least this value. Levels 12 and above are the high importance levels. Lowering it can import millions of alerts on a busy deployment.",[112,289,290],{},"12",[97,292,293,298,301],{},[112,294,295],{},[17,296,297],{},"Include Compliance",[112,299,300],{},"Imports the SCA compliance results (CIS benchmarks) with their individual checks. They are retrieved agent by agent, which significantly lengthens the import on large deployments.",[112,302,303],{},"Disabled",[10,305,306,307,309,310,312],{},"A deployment whose rules produce a high volume of false positives at levels 12 and above can return hundreds of thousands of alerts a week. Raising ",[17,308,284],{}," reduces that volume; disabling ",[17,311,259],{}," leaves the inventory and vulnerabilities unaffected.",[26,314,316],{"id":315},"procedure","Procedure",[10,318,319,320,323,324,327],{},"The procedure creates two read-only accounts: a ",[17,321,322],{},"Wazuh server API user"," and a ",[17,325,326],{},"Wazuh indexer internal user",". They are separate accounts, stored in two separate user databases; they can share the same username and password.",[329,330,332],"h3",{"id":331},"create-the-server-api-role","Create the policy and role for the server API",[10,334,335,336,339],{},"The built-in ",[17,337,338],{},"readonly"," role covers agents, groups, compliance and inventory, but not the Wazuh console accounts. A dedicated role adds that read access.",[341,342,343,354,410,415],"ol",{},[34,344,345,346,349,350,353],{},"On the Wazuh dashboard, open the menu (☰) and go to ",[17,347,348],{},"Server management"," > ",[17,351,352],{},"Security",".",[34,355,356,357,360,361,364,365],{},"On the ",[17,358,359],{},"Policies"," tab, click ",[17,362,363],{},"Create policy"," and fill in:\n",[31,366,367,376,384,402],{},[34,368,369,372,373],{},[17,370,371],{},"Policy name",": ",[70,374,375],{},"overview-security-read",[34,377,378,372,381],{},[17,379,380],{},"Action",[70,382,383],{},"security:read",[34,385,386,372,389,240,392,395,396,399,400],{},[17,387,388],{},"Resource",[70,390,391],{},"user:id",[70,393,394],{},"role:id"," and ",[70,397,398],{},"policy:id",", each with the resource identifier ",[70,401,117],{},[34,403,404,372,407],{},[17,405,406],{},"Select an effect",[70,408,409],{},"Allow",[34,411,412,413,353],{},"Click ",[17,414,363],{},[34,416,356,417,360,420,423,424,427,428,430,431,433,434,436,437,353],{},[17,418,419],{},"Roles",[17,421,422],{},"Create Role",", enter the ",[17,425,426],{},"Role name"," ",[70,429,375],{},", select the ",[70,432,375],{}," policy in ",[17,435,359],{},", then click ",[17,438,439],{},"Create role",[329,441,443],{"id":442},"create-the-server-api-user","Create the server API user",[341,445,446,458],{},[34,447,448,449,349,451,453,454,457],{},"In ",[17,450,348],{},[17,452,352],{},", create a user (e.g., ",[70,455,456],{},"overview-connector",") with a password.",[34,459,460,461,395,463,353],{},"Assign it two roles: ",[17,462,338],{},[17,464,375],{},[10,466,467,468,395,470,472],{},"Copy the username and password into ",[17,469,131],{},[17,471,141],{}," in OverView.",[329,474,476],{"id":475},"create-the-indexer-user","Create the indexer user",[341,478,479,490,502,548,552],{},[34,480,481,482,349,485,349,487,353],{},"Open the menu (☰) and go to ",[17,483,484],{},"Indexer management",[17,486,352],{},[17,488,489],{},"Internal users",[34,491,412,492,495,496,498,499,353],{},[17,493,494],{},"Create internal user",", enter a username (e.g., ",[70,497,456],{},") and a password, then click ",[17,500,501],{},"Create",[34,503,504,505,349,507,349,509,511,512,514,515],{},"Go to ",[17,506,484],{},[17,508,352],{},[17,510,419],{}," and click ",[17,513,439],{},":\n",[31,516,517,525,533,540],{},[34,518,519,372,522],{},[17,520,521],{},"Name",[70,523,524],{},"overview-read",[34,526,527,372,530],{},[17,528,529],{},"Cluster permissions",[70,531,532],{},"cluster_composite_ops_ro",[34,534,535,372,538],{},[17,536,537],{},"Index",[70,539,117],{},[34,541,542,372,545],{},[17,543,544],{},"Index permissions",[70,546,547],{},"read",[34,549,412,550,353],{},[17,551,501],{},[34,553,356,554,557,558,561,562,353],{},[17,555,556],{},"Mapped users"," tab of the new role, click ",[17,559,560],{},"Manage mapping",", add the internal user created in step 2, then click ",[17,563,564],{},"Map",[10,566,567],{},"Without step 5, the user authenticates but cannot read any index: the import then fails on the vulnerabilities and inventory.",[10,569,467,570,395,572,472],{},[17,571,165],{},[17,573,175],{},[329,575,577],{"id":576},"configure-the-connector-in-overview","Configure the Connector in OverView",[341,579,580,589,597],{},[34,581,582,583,349,586,353],{},"In OverView, go to ",[17,584,585],{},"Data Sources Settings",[17,587,588],{},"Sources",[34,590,591,592,511,594,353],{},"Select ",[17,593,5],{},[17,595,596],{},"Configure",[34,598,599,600,353],{},"Fill in the two URLs and the two accounts, adjust the parameters if needed, then click ",[17,601,602],{},"Save Configuration",[26,604,606],{"id":605},"required-permissions","Required Permissions",[10,608,609],{},"The connector only reads data; it never modifies the Wazuh configuration, agents or rules.",[91,611,612,625],{},[94,613,614],{},[97,615,616,619,622],{},[100,617,618],{},"Data retrieved",[100,620,621],{},"API",[100,623,624],{},"Requirement",[107,626,627,653,670,687,709,725,739,753],{},[97,628,629,632,641],{},[112,630,631],{},"Agents and manager information",[112,633,634,635,240,638],{},"Server API, ",[70,636,637],{},"GET \u002Fagents",[70,639,640],{},"GET \u002Fmanager\u002Finfo",[112,642,643,240,646,649,650,652],{},[70,644,645],{},"agent:read",[70,647,648],{},"manager:read"," (",[17,651,338],{}," role)",[97,654,655,658,663],{},[112,656,657],{},"Agent groups",[112,659,634,660],{},[70,661,662],{},"GET \u002Fgroups",[112,664,665,649,668,652],{},[70,666,667],{},"group:read",[17,669,338],{},[97,671,672,675,680],{},[112,673,674],{},"Compliance results (optional)",[112,676,634,677],{},[70,678,679],{},"GET \u002Fsca\u002F{agent_id}",[112,681,682,649,685,652],{},[70,683,684],{},"sca:read",[17,686,338],{},[97,688,689,692,703],{},[112,690,691],{},"Wazuh console accounts and roles",[112,693,634,694,240,697,240,700],{},[70,695,696],{},"GET \u002Fsecurity\u002Fusers",[70,698,699],{},"\u002Froles",[70,701,702],{},"\u002Fpolicies",[112,704,705,649,707,652],{},[70,706,383],{},[17,708,375],{},[97,710,711,714,720],{},[112,712,713],{},"Vulnerabilities",[112,715,716,717],{},"Indexer, ",[70,718,719],{},"wazuh-states-vulnerabilities-*",[112,721,722,724],{},[70,723,547],{}," on the index",[97,726,727,730,735],{},[112,728,729],{},"Endpoint inventory",[112,731,716,732],{},[70,733,734],{},"wazuh-states-inventory-*",[112,736,737,724],{},[70,738,547],{},[97,740,741,744,749],{},[112,742,743],{},"Alerts (optional)",[112,745,716,746],{},[70,747,748],{},"wazuh-alerts-*",[112,750,751,724],{},[70,752,547],{},[97,754,755,758,761],{},[112,756,757],{},"Paginated reads",[112,759,760],{},"Indexer",[112,762,763],{},[70,764,532],{},[766,767,768],"note",{},[10,769,770,771,773],{},"Without ",[70,772,383],{},", the Wazuh server API does not refuse the request: it returns an empty list. The import then succeeds without any Wazuh console account.",[329,775,777],{"id":776},"verify-the-access","Verify the access",[10,779,780],{},"From a machine that can reach the Wazuh server, run:",[782,783,788],"pre",{"className":784,"code":785,"language":786,"meta":787,"style":787},"language-bash shiki shiki-themes github-light github-dark","# Server API: returns a token, then the agents visible to the user\nTOKEN=$(curl -sk -u \"SERVER_USER:SERVER_PASSWORD\" -X POST \\\n  \"https:\u002F\u002Fwazuh.example.com:55000\u002Fsecurity\u002Fuser\u002Fauthenticate?raw=true\")\ncurl -sk -H \"Authorization: Bearer $TOKEN\" \\\n  \"https:\u002F\u002Fwazuh.example.com:55000\u002Fagents?limit=1\"\n\n# Indexer: number of vulnerabilities readable by the user\ncurl -sk -u \"INDEXER_USER:INDEXER_PASSWORD\" \\\n  \"https:\u002F\u002Fwazuh.example.com:9200\u002Fwazuh-states-vulnerabilities-*\u002F_count\"\n","bash","",[70,789,790,799,837,846,867,873,880,886,900],{"__ignoreMap":787},[791,792,795],"span",{"class":793,"line":794},"line",1,[791,796,798],{"class":797},"sJ8bj","# Server API: returns a token, then the agents visible to the user\n",[791,800,802,806,810,813,817,821,824,828,831,834],{"class":793,"line":801},2,[791,803,805],{"class":804},"sVt8B","TOKEN",[791,807,809],{"class":808},"szBVR","=",[791,811,812],{"class":804},"$(",[791,814,816],{"class":815},"sScJk","curl",[791,818,820],{"class":819},"sj4cs"," -sk",[791,822,823],{"class":819}," -u",[791,825,827],{"class":826},"sZZnC"," \"SERVER_USER:SERVER_PASSWORD\"",[791,829,830],{"class":819}," -X",[791,832,833],{"class":826}," POST",[791,835,836],{"class":819}," \\\n",[791,838,840,843],{"class":793,"line":839},3,[791,841,842],{"class":826},"  \"https:\u002F\u002Fwazuh.example.com:55000\u002Fsecurity\u002Fuser\u002Fauthenticate?raw=true\"",[791,844,845],{"class":804},")\n",[791,847,849,851,853,856,859,862,865],{"class":793,"line":848},4,[791,850,816],{"class":815},[791,852,820],{"class":819},[791,854,855],{"class":819}," -H",[791,857,858],{"class":826}," \"Authorization: Bearer ",[791,860,861],{"class":804},"$TOKEN",[791,863,864],{"class":826},"\"",[791,866,836],{"class":819},[791,868,870],{"class":793,"line":869},5,[791,871,872],{"class":826},"  \"https:\u002F\u002Fwazuh.example.com:55000\u002Fagents?limit=1\"\n",[791,874,876],{"class":793,"line":875},6,[791,877,879],{"emptyLinePlaceholder":878},true,"\n",[791,881,883],{"class":793,"line":882},7,[791,884,885],{"class":797},"# Indexer: number of vulnerabilities readable by the user\n",[791,887,889,891,893,895,898],{"class":793,"line":888},8,[791,890,816],{"class":815},[791,892,820],{"class":819},[791,894,823],{"class":819},[791,896,897],{"class":826}," \"INDEXER_USER:INDEXER_PASSWORD\"",[791,899,836],{"class":819},[791,901,903],{"class":793,"line":902},9,[791,904,905],{"class":826},"  \"https:\u002F\u002Fwazuh.example.com:9200\u002Fwazuh-states-vulnerabilities-*\u002F_count\"\n",[10,907,908,909,912,913,916],{},"Both calls must return data. A ",[70,910,911],{},"401"," means a wrong username or password; a ",[70,914,915],{},"403"," on the indexer means the role is not mapped to the user.",[26,918,920],{"id":919},"security-best-practices","Security Best Practices",[31,922,923,938,945,957],{},[34,924,925,926,929,930,933,934,937],{},"Use ",[17,927,928],{},"dedicated accounts"," for the OverView integration rather than the ",[70,931,932],{},"admin"," or ",[70,935,936],{},"wazuh"," accounts",[34,939,940,941,944],{},"Keep both accounts ",[17,942,943],{},"read-only",": the roles above grant no write action",[34,946,947,948,240,950,395,952,954,955],{},"The indexer role can be restricted to the ",[70,949,719],{},[70,951,734],{},[70,953,748],{}," index patterns instead of ",[70,956,117],{},[34,958,959,962],{},[17,960,961],{},"Rotate the passwords"," regularly according to your organization's security policy",[964,965],"s3-upload",{"bucket":936,"connector":5,"file":966},"export.csv",[26,968,970],{"id":969},"official-documentation","Official Documentation",[31,972,973,982,989,996],{},[34,974,975],{},[976,977,981],"a",{"href":978,"rel":979},"https:\u002F\u002Fdocumentation.wazuh.com\u002Fcurrent\u002Fuser-manual\u002Fuser-administration\u002Frbac.html#creating-and-setting-a-wazuh-read-only-user",[980],"nofollow","Wazuh RBAC: creating a read-only user",[34,983,984],{},[976,985,988],{"href":986,"rel":987},"https:\u002F\u002Fdocumentation.wazuh.com\u002Fcurrent\u002Fuser-manual\u002Fapi\u002Frbac\u002Fconfiguration.html",[980],"Wazuh server API RBAC configuration",[34,990,991],{},[976,992,995],{"href":993,"rel":994},"https:\u002F\u002Fdocumentation.wazuh.com\u002Fcurrent\u002Fuser-manual\u002Fapi\u002Freference.html",[980],"Wazuh server API reference",[34,997,998],{},[976,999,1002],{"href":1000,"rel":1001},"https:\u002F\u002Fdocumentation.wazuh.com\u002Fcurrent\u002Fuser-manual\u002Fwazuh-indexer\u002Findex.html",[980],"Wazuh indexer configuration",[1004,1005,1006],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":787,"searchDepth":801,"depth":801,"links":1008},[1009,1010,1011,1012,1018,1021,1022],{"id":28,"depth":801,"text":29},{"id":88,"depth":801,"text":89},{"id":180,"depth":801,"text":181},{"id":315,"depth":801,"text":316,"children":1013},[1014,1015,1016,1017],{"id":331,"depth":839,"text":332},{"id":442,"depth":839,"text":443},{"id":475,"depth":839,"text":476},{"id":576,"depth":839,"text":577},{"id":605,"depth":801,"text":606,"children":1019},[1020],{"id":776,"depth":839,"text":777},{"id":919,"depth":801,"text":920},{"id":969,"depth":801,"text":970},null,"Integrate Wazuh to retrieve your agents, their software, vulnerabilities, alerts and compliance results","md",{},"\u002Fen\u002Fconnectors\u002Fwazuh",{"title":5,"description":1024},{"label":5},"en\u002Fconnectors\u002Fwazuh","0NCAwYr373NoeGL_0IBGy4znEBkzvke9wui4GCLM3js",1793011496234]