Wazuh Integration - Retry on Failure

[Jiří Chalota]

Hello everyone, I'm testing integrations on DFIR-IRIS, Jira, Opsgenie, and similar. The integrations work without a problem, but I have a question. What if, for example, the internet isn't working? How can I ensure that the command retries until it succeeds? For instance, to try every minute to get the alert into JIRA? Is that possible?

many thx

Jiri

[tomas....@wazuh.com]

Hi Jiří,

Currently, the only integration that allows retries is VirusTotal. By default, it retries at most 3 times when the API call times out.

However, we offer the possibility to configure the number of retries (an timeout if necessary) to any custom integration. These are the settings you need to add:

<integration>

    <name>custom-integration</name>

    ...

    <timeout>30</timeout>

    <retries>5</retries>

</integration>

You can read these parameters and use them accordingly. Check the VirusTotal integration as an example: https://github.com/wazuh/wazuh/blob/master/integrations/virustotal.py

This is the only option we offer as the integratord daemon doesn't retry the call in case of failure.

I hope this information helps you.

Best regards.

Tomás Turina