"What data does Wazuh's <integration> block (e.g. Shuffle/custom hook_url) actually send in the outbound POST — full alert JSON or a subset?"

[Asmit Desai]

Hi Team 
I have this integration on my wazuh setup I just wanted to know what is actually being sent onto the shuffle webhook as I havent found any documentation on whether the entire alert gets pushed or only certain fields are pushed.

  <integration>
    <name>shuffle</name>
    <hook_url>redacted </hook_url>
    <group>bitdefender,</group>
    <alert_format>json</alert_format>
  </integration>

Thanks 

Asmit 

[Md. Nazmur Sakib]

Hi Asmit,

It forwards the fields you define in the script from the alerts.json file.

For example, your integration script(/var/ossec/integrations/shuffle.py) is reading this.

tail -f /var/ossec/logs/alerts/alerts.json | jq 'select(.rule.groups[]? == "bitdefender")'


# Read args

    alert_file_location: str = args[ALERT_INDEX]
___________________________
    # Load alert. Parse JSON object.

    json_alert = get_json_alert(alert_file_location)

    debug(f"# Opening alert file at '{alert_file_location}' with '{json_alert}'")


Now, based on the condition in the script(shuffle.py).

msg = {

        'severity': severity,

        'pretext': 'WAZUH Alert',

        'title': alert['rule']['description'] if 'description' in alert['rule'] else 'N/A',

        'text': alert.get('full_log'),

        'rule_id': alert['rule']['id'],

        'timestamp': alert['timestamp'],

        'id': alert['id'],

        'all_fields': alert,

    }

It makes a temp message file from the alerts.json  and forwards the values saved in the temp file to shuffle using the shuffle webhook.


Let me know if you need any further information.