Integrating Wazuh with Windmill.dev

[DEADpool260]

Summery:
In my quest to identify an effective SOAR (Security Orchestration, Automation, and Response) solution for managing Wazuh level 12 alerts, I considered several options, including Shuffle, another open-source tool. Ultimately, I decided to utilize Windmill.dev for its robust capabilities. This repository documents my configurations and the steps I took to successfully route Wazuh alert logs to a Windmill.dev Flow.

Description:
The initial challenge was figuring out how to transmit Wazuh alerts to Windmill.dev before implementing any other configurations. I devised a solution that enables the seamless transfer of Wazuh level 12 alerts to Windmill.dev. This documentation provides a detailed walkthrough of the steps and configurations involved in achieving this integration.

Solution:

1. Create a API token
   
   

2. Create a test flow with input as “Input” which takes “String” as input parameter
   

3. Deploy it

4. Got to “Details & Triggers” and copy the URL
   

5. Add a integration in Wazuh for custom-windmill

custom-windmill json 12

6. Add a python script in /var/ossec/integration with the name “custom-winmill” (Note: no .py extention)

#!/var/ossec/framework/python/bin/python3

import sys
import json
import requests

Read configuration parameters

alert_file = open(sys.argv[1])
api_key = sys.argv[2]
hook_url = sys.argv[3]

Read the alert file

alert_json = json.loads(alert_file.read())
alert_file.close()

#msg_data
alert_level = alert_json['rule']['level']
description = alert_json['rule']['description']
agent_name = alert_json['agent']['name']
full_log = alert_json['full_log']

#headers
headers = {'Content-Type': 'application/json', "Authorization": f"Bearer {api_key}"}

#data
data = {"Input": f"alert level: {alert_level}\n description: {description}\n Agent name: {agent_name}\n Full log: {full_log}"}

Send the request

response = requests.post(hook_url, data=json.dumps(data), headers=headers)

sys.exit(0)

7. To test create a alert.json in /home/wazuh-user directory and add this
   {"timestamp":"2024-07-24T08:40:29.950+0000","rule":{"level":12,"description":"PAM: Login session closed.","id":"5502","firedtimes":4,"mail":false,"groups":["pam","syslog"],"pci_dss":["10.2.5"],"gpg13":["7.8","7.9"],"gdpr":["IV_32.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"000","name":"wazuh-server"},"manager":{"name":"wazuh-server"},"id":"1721810429.30990","full_log":"Jul 24 08:40:29 wazuh-server sshd[27695]: pam_unix(sshd:session): session closed for user wazuh-user","predecoder":{"program_name":"sshd","timestamp":"Jul 24 08:40:29","hostname":"wazuh-server"},"decoder":{"parent":"pam","name":"pam"},"data":{"dstuser":"wazuh-user"},"location":"/var/log/secure"}

8. To test if it works run the command
   ./custom-windmill /home/wazuh-user/alert.json <your API key from step 1>

9. Go to Winmill “Run” to check if it has triggered any new flow
   

Additional context

I will try to make a blog for this issue, but I would like to work on this further for better integration, visibility, and reduced workload for the SOC team. If you have any feedback, suggestions, or would like to collaborate on improving this integration, please feel free to reach out. Your contributions and insights are highly valued.