Wazuh Channel -> Mattermost

[Xavier Mertens]

Hello Wazuh'ers!

I'd like to create a channel to send notifications to a Mattermost server.

I tried to use a custom webhook but it seems that the HTTP POST request is not properly formatted for Mattermost. Anyone successfully implemented this?

Tx!

[Md. Nazmur Sakib]

Hi Xavier,

You can use the script for Slack to send the notification to Mattermost.
The only thing to do is to create a proper Mattermost incoming webhook and set the webhook in manager's ossec.conf like if we were using Slack

 <integration>

    <name>slack</name>

    <hook_url>https://xxxxxxxxx.cloud.mattermost.com/hooks/xxxxxxxxxxxxxxxxxxxxxxxxxxx</hook_url>

    <level>3</level>

    <alert_format>json</alert_format>

  </integration>

After restarting the manager, new alerts will appear in the Mattermost channel.

sudo systemctl restart wazuh-manager

Ref: https://documentation.wazuh.com/current/user-manual/manager/integration-with-external-apis.html


Let me know if this works for you.

[Xavier Mertens]

Tx! It worked, strange feeling to use "Slack" for Mattermost :-)