Does wazuh support syslog over TLS?

[Daniel D'Angeli]

Hi,

we need to implement syslog retrieving from a remote source.

Regards,

Daniel D.

[Manuel Jose Cano Rojo]

Hi Daniel,

Unfortunately, Wazuh does not support syslog over TLS natively, you can follow the issue status in GitHub to keep yourself updated about the progress of this feature, #11197 and #11198.

Despite this, you can do it using TCP or UDP, as it is explained in our documentation.

Hope this helps.

Regards,

Manuel.

[Daniel D'Angeli]

Hi,

thanks for the clarification. Can Wazuh retrieve logs from a remote API?

Regards,

Daniel D.

[Manuel Jose Cano Rojo]

Hi Daniel,

sorry for my late response. 

Sure, you can do it via Logcollector. You will have to retrieve these logs using a specific call to the API you want to retrieve logs from. Then, you can add the resulting file to a Logcollector configuration block in the ossec.conf file. For example:

<localfile> 
   <location>/var/log/example.log</location> 
   <log_format>syslog</log_format> 
</localfile>

Here you can consult the documentation about log collection and its capabilities. Hope it helps.

Regards,

Manuel.