Router logs integration into Wazuh

[Peter Lyons]

Hi, I have an Asus router with merlin software and I would like to the router to be integrated into Wazuh.  I could setup the router as an agentless device but not sure how to get the Wazuh manager to receive the router logs.

Any ideas?

[Awwal Ishiaku]

Hi Peter,

Agentless monitoring in Wazuh executes commands on the router via SSH and processes the output of the commands as log input. Is this what you are referring to?
Here is a guide for agentless monitoring in Wazuh.

Is this what you want? or do you want to forward syslog from the router to the Wazuh server?

Regards.

[Peter Lyons]

Hi Assal,

I want the Wazuh server to monitor the router syslog.

Can I forward the router syslog to the Wazuh server?

Regards.

[Awwal Ishiaku]

You can forward syslog to the Wazuh server. You need to verify that your router can send syslog messages.

And then configure the Wazuh server to listen for syslog messages by following the guide here.
You may need to create custom rules and decoders to parse your logs if Wazuh doesn't already support it.

Regards