Can Wazuh Manager be configured to send traffic to a HEC on splunk?

[Supriya Sudharani Kumaraswamy US]

Hi all,

Currently our team uses Splunk Universal Forwarder to forward wazuh traffic from manager to Splunk. We understand there are options available to secure this traffic (https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/ConfigureSplunkforwardingtousesignedcertificates).

But, we were wondering does Wazuh has any ways to send traffic to a HEC on Splunk?

Regards,

Supriya

[Jesus Linares]

Hi Supriya,

At this moment, Wazuh sends the alerts to a file (alerts.json) or via Syslog. If you want to forward them to another place, you need to use another tool like Filebeat/Logstash.

So, what I recommend is using the following setup: [Wazuh Manager -> alerts.json <- Filebeat] -> [Logstash] -> [Splunk].

Here you can see an example: https://medium.com/ibm-garage/how-to-forward-events-from-logstash-to-splunk-4f2608041feb.

I hope it helps.