configuring Elastalert with wazuh

[Flori Llapi]

Hi all I am new to wazuh ,I need to configure elastalert with opensearch of wazuh .

I am using lattest version of wazuh. I dont know how to configure at all elastalert config.yaml file at all that is compatible with opensearch how to find SSL , usernames and passes , etc.The tutorials on internet are not acurate. Please help

[Mauricio Ruben Santillan]

Hello!

Is there any specifig reason you're attempting to use Elastalert?

You see, Wazuh Dashboard (which is a fork of Opensearch Dashboard) includes Opensearch's Alerting module that is fully compatible with Wazuh alerts.

Also, Wazuh includes its own integration module that allows you to send alerts to external APIs defining a criteria to filter them. In case you're new to Elastalert, I do recommend you to check any of these commented methods.

Now, If you still want to proceed using Elastalert, then are you getting any specific error? Can you provide some screenshot of it? Any additional information will be usefult.

Also, there Elastalert official documentation here: https://elastalert2.readthedocs.io/en/latest/elastalert.html

And an old post about Wazuh+Elastalert here: https://infosecwriteups.com/building-a-siem-combining-elk-wazuh-hids-and-elastalert-for-optimal-performance-f1706c2b73c6

Looking forward to your comments.

[flor]

Hi Mauricio , just want to monitor through MS teams in real and in better view thats all.

One more question do you know any tool to convert sigma rules to wazuh rules as they are many and manually needs many human resources ?

Regards 

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh mailing list" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/cVT7RDQ9M1c/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/99c18466-bde4-4ded-be83-37dec17baad6n%40googlegroups.com.

[Mauricio Ruben Santillan]

Hello!

If you want to receive alerts in your MS Teams, then you should have no problem using the commented Wazuh Dashboard's Alerting feature. Check this out.

Now about converting Sigma rules to Wazuh rules, I haven't heard of nor used any tool as such, but I found next ones:

• https://github.com/theflakes/sigma_to_wazuh.
• https://github.com/SanWieb/sigWah

And there's some related information here:

https://www.reddit.com/r/Wazuh/comments/w1t1u8/usage_with_sigma/

I hope this helps! Let me know how it goes.