wazuh-opencti

[Hamza]

Hi,

i want to integrate Opencti with Wazuh, i tried this script below but it didn't work. I use wazuh 4.8. Any help please ?

[Damian Nicastro]

Hello Hamza:

I hope you are fine.

Integration with OpenCTI is not officially supported, but I have found a script that you can test here:

juaromu/wazuh-opencti (github.com)

There is also another Github repository where they are working with OpenCTI integration:

misje/opencti-wazuh-connector: OpenCTI–Wazuh connector looking for indicators in Wazuh and creating sightings (github.com)

And also this script that can be tested:

client-python/examples/create_incident_with_ttps_and_indicators.py at master · OpenCTI-Platform/client-python (github.com)

Finally, here you can find some useful information to create your custom integration scripts:

Integration with external APIs - Wazuh server · Wazuh documentation

If any of these things work for you, you can send me the errors you are having in the Wazuh manager:

# less /var/ossec/logs/ossec.log | grep -i opencti

And the errors in the script itself.

I hope this helps.

Thanks