webhook

115 views
Skip to first unread message

Romain Hennebois

unread,
Jun 10, 2024, 8:23:59 AM6/10/24
to Wazuh | Mailing List
Hi team,

I would like some help with the opensearch notification plugin. I am currently looking for a way to send data to my Rocket.Chat webhook but nothing is working.


I've tried adding a custom webhook channel but every time an error occurs:

[status_exception] {"event_status_list": [{"config_id":"qDnhyY8BldJqsO0F2Izp","config_type":"webhook","config_name":"Rocket.Chat","email_recipient_status":[],"delivery_status":{"status_code":"500","status_text":"Failed to send webhook message Failed: <!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<title>Error</title>\n</head>\n<body>\n<pre>Bad Request</pre>\n</body>\n</html>\n"}}]}

I've tried a curl and it works fine.
I've also tried selecting "Slack" instead and it works halfway (empty message).
Similarly, if I replace the content type 'application/json' with 'text/html' it works but the message is empty.
The 'application/json' MIME produces an error every time and I'm struggling with the webhook.

I am using wazuh 4.7.4.

Any help is appreciated

Nicolas Alejandro Bertoldo

unread,
Jun 10, 2024, 10:39:59 AM6/10/24
to Wazuh | Mailing List
Hi Romain,

I hope you are doing fine.

Since this is an OpenSearch feature, we can't provide you with specific support. I suggest you check the official documentation and contact OpenSearch support.
However, Wazuh allows integration with external software. Below you will find the documentation:
I hope this helps. Please let me know if you have any further questions.
Regards.

Romain Hennebois

unread,
Jun 11, 2024, 5:31:11 AM6/11/24
to Wazuh | Mailing List
Hi Nicolas,

I've done the following configuration in ossec.conf:

  <!-- ROCKET CHAT WEBHOOK INTEGRATION -->
<integration>
  <name>RC</name>
  <hook_url><WEBHOOK_URL></hook_url>
  <level>10</level>
  <group>errors</group>
  <alert_format>json</alert_format>
</integration>

but nothing comes out. I want to send some events like my rule.groups "errors" to rocket.chat via webhook.
What can I change to manage this? Thanks in advance.

Romain Hennebois

unread,
Jun 11, 2024, 8:17:45 AM6/11/24
to Wazuh | Mailing List

Hi Nicolas,


Logs came into rocket.chat. Thanks for your help !
Reply all
Reply to author
Forward
0 new messages