Webhook

[Romain Hennebois]

Hello everyone,

I would like some helps in resolving my webhook.

A few months ago, i had configured my webhook integration and with recent updates, the configuration is deprecated.

Here is my configuration in the /var/ossec/etc/ossec.conf file :

  <integration>
    <name>slack</name>
    <hook_url>WEBHOOK_URL</hook_url>
    <alert_format>json</alert_format>
    <group>vulnerability-detector</group>
    <event_location>vulnerability-detector</event_location>
    <level>3</level>
  </integration>

But for some reason, in my vulnerability detector inventory the group tag is gone and some blanks alerts are being sent.

Can i have some help to change this configuration in aim to send my critical vulnerability in my channel.

Thanks in advance for any help.

[Isaiah Daboh]

Hello,

I am taking a look at this and would revert shortly.

Regards

[Romain Hennebois]

It may be due to the fact that I don't have any events from Vulnerability Detector.

I tried to sample data and I see events in vulnerability-detector and the 'locator' tag and group is here.

[Romain Hennebois]

But if this is done for fixed CVEs, how can I configure the webhook in order to send a notification in my channel for high severity vulnerabilities?

[Isaiah Daboh]

Hello Romain,

High severity vulnerabilities should have high alert level. 

<level></level> option in the config, filters alerts by rule level so only alerts with the specified level or above are pushed. The allowed value is any alert level from 0 to 16.

Changing the alert level in the ossec.conf should help filter correctly.

<integration>
    <name>slack</name>
    <hook_url>WEBHOOK_URL</hook_url>
    <alert_format>json</alert_format>
    <group>vulnerability-detector</group>
    <event_location>vulnerability-detector</event_location>

    <level>10</level>
  </integration>

References:

https://documentation.wazuh.com/current/user-manual/ruleset/rules/rules-classification.html

https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/configuring-scans.html

Please let me know if this works.

[Romain Hennebois]

I have changed my configuration from the one you gave me. It might work, I can't tell you because I don't have any events in my vulnerability detection, but I think it's normal.