Issue Integration with The-Hive/Cortex, forward of alerts

[Eric]

Hello everyone!

I'm configuring Wazuh integration with The-hive. It's new for me, and I'm researching IR/SIRP with Wazuh. As I can see, Wazuh has not developed the integrator with IR/SIRP yet, Any plan for that? 

I have found some people who contribute to the project, but it's not useful for now with Wazuh 4.x. I can find some information use information in Wazuh logs. So here my problem. 

If you could help, I'll be glad to hear your thoughts and bits of advice. 

For more details about Wazuh logs, you can check it here:

https://github.com/crow1011/wazuh2thehive

2021-05-21 04:21:00,422 - __main__ - INFO - Create TheHive alert: ~294666448

2021-05-21 04:21:03,336 - __main__ - ERROR - Error create TheHive alert: 400/{"type":"CreateError","message":"Observable already exists"}

2021-05-21 04:21:24,322 - __main__ - ERROR - Error create TheHive alert: 400/{"type":"CreateError","message":"Observable already exists"}

Regards,

[Adrián Jesús Peña Rodríguez]

Hi,

Unfortunately, as you indicate there is no official integration of Wazuh with TheHive. There is currently an open issue to add such integration: https://github.com/wazuh/wazuh/issues/3680, this issue is currently not prioritized, however, there is a lot of interest in adding this integration so we will review it as soon as possible to add it to the product roadmap.

On the other hand, in the meantime, there is another procedure apart of the https://github.com/crow1011/wazuh2thehive repository, you can find more information about this procedure here: https://groups.google.com/g/wazuh/c/_pPhkjtGSzs. It is important to note that these procedures are not officially supported by Wazuh and they may stop working in the short or medium term.

We are sorry for the inconvenience, we hope to include this integration natively as soon as possible.

Best regards,

Adrián Peña

[Eric]

Hi Adrián, 

Thank you for the quick response, I got it, it's clear now.

Regards, 

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/e95c2210-8a89-4fd6-9ad4-ded5e7092been%40googlegroups.com.