How to Integrate Maria db in wazuh 4.7

[Emil David]

Hi Team,

Please share the steps to Integrate Maria db in wazuh 4.7

Please share db side and wazuh manager side steps.

[Tomas Sarquis]

Hi Emil David

Wazuh offers by default rules and decoders for MariaDB logs:

- https://github.com/wazuh/wazuh/blob/4.7/ruleset/decoders/0378-mariadb_decoders.xml

- https://github.com/wazuh/wazuh/blob/4.7/ruleset/rules/0535-mariadb_rules.xml

This means that, if you configure Wazuh to monitor MariaDB logs, Wazuh should be able to create events related to the SQL engine.

You should configure something like this in your ossec.conf file:

<localfile>

  <location>[MARIADB_LOGFILE_PATH]</location>

  <log_format>syslog</log_format>

</localfile>

I've also found an article that configures MariaDB to send the log information through syslog:

- https://www.linkedin.com/pulse/monitoring-mariadb-security-wazuh-luis-contreras/

Hope this helps!