Seeking Assistance with Configuring Syslog Decoders for Aruba APs in Wazuh

[Mustapha Balti]

Hi Wazuh Community,

I'm integrating Aruba Access Points into Wazuh for a project. Despite configuring my Wazuh manager to receive Syslog messages, they're not appearing as expected on the dashboards. I've set up the reception through a remote config block in my ossec.conf. Given the generic nature of the logs, I'm unsure how to proceed with decoding them effectively.

Could anyone provide guidance or share insights on creating decoders for Syslog messages, especially for enhancing log identification and processing? Any advice on configuring Wazuh to handle these specific logs would be greatly appreciated.

Thank you!

[Héctor Gómez]

Hello, thank you for using wazuh

Of course, we can help you, in order to guide you on how to create a custom decoder you need to share with us one of the events you are trying to decode so we can advise you correctly knowing the log structure.


The first thing we recommend you to do with decoders is to go to our documentation and check what you need to add a new one.

These references may be helpful:

https://documentation.wazuh.com/current/user-manual/ruleset/custom.html
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/decoders.html
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/regex.html
https://documentation.wazuh.com/current/user-manual/ruleset/testing.html


It may also be a good idea to check the current decoders to have some examples of what we want to achieve: https://github.com/wazuh/wazuh/tree/master/ruleset/decoders


The first thing I would recommend you is to check what return those logs have in the logtest installation located in /var/ossec/bin/wazuh-logtest (if you don't have wazuh greater or equal to version 4.2, the name will be ossec-logtest), this is a powerful ally when creating rules and decoders, here you can have more information about it: https://documentation.wazuh.com/current/user-manual/capabilities/wazuh-logtest/how-it-works.html

To create the regex needed for the decoder to work correctly, we use regex101: https://regex101.com/

Here you can test your logs and extract the fields you need.

After each field implementation, we recommend testing it using the logtest function.

Once you have all the fields you want to extract, you will complete your first custom decoder!

If you need additional help during the process or have any further questions, please don't hesitate to ask.
Best regards...