The Complete Wazuh Integration Guide

Modern security environments rarely rely on a single platform. Organizations collect telemetry from endpoints, firewalls, cloud services, identity providers, vulnerability scanners, and threat intelligence feeds, making integration a critical requirement rather than an optional feature.

Wazuh integrations allow security teams to enrich alerts with external threat intelligence, collect logs from diverse systems, automate responses, and forward security events to other analytics platforms.

Instead of investigating isolated alerts, analysts gain broader context that helps them detect attacks faster and reduce investigation time.

According to the 2024 IBM Cost of a Data Breach Report, organizations that extensively use security AI and automation detect and contain breaches significantly faster while reducing the average cost of a breach by millions of dollars compared to organizations with limited automation. Integrations are one of the primary ways organizations build these automated security workflows.

Industry experts also emphasize the importance of integrating security tools instead of operating them independently.

“Organizations need integrated security operations that combine visibility, automation, and intelligence across the environment.”
— Gartner Security and Risk Research

Integrating Wazuh with external platforms improves security operations by:

Centralizing logs from multiple sources
Enriching alerts with external threat intelligence
Automating incident response actions
Improving detection accuracy
Reducing analyst workload
Simplifying compliance reporting
Creating end-to-end security workflows

This guide explains how Wazuh integrations work, the different categories of supported integrations, common deployment architectures, best practices, and troubleshooting techniques.

It also links to detailed implementation guides for individual integrations, including:

What Is Wazuh Integration?

Wazuh integration refers to connecting Wazuh with external security products, cloud services, networking equipment, APIs, and collaboration platforms so information can flow automatically between systems.

Instead of operating as an isolated security platform, Wazuh becomes part of a larger security ecosystem that continuously exchanges data with other tools.

These integrations can provide:

External threat intelligence
Centralized logging
Automated incident response
Cloud monitoring
Vulnerability data
Asset information
Security notifications
Compliance evidence

Because Wazuh supports REST APIs, Syslog, Filebeat/OpenSearch pipelines, active response scripts, and custom integrations, it can communicate with hundreds of enterprise security products.

How Wazuh Fits into a Security Stack

Wazuh performs several core security functions that allow it to integrate naturally into modern SOC environments.

SIEM Capabilities

Wazuh collects logs from multiple sources, parses events, correlates security activity, and generates alerts based on detection rules.

Unlike traditional SIEM platforms that primarily focus on log aggregation, Wazuh combines log management with endpoint security capabilities.

XDR Capabilities

Wazuh extends detection across endpoints, servers, cloud workloads, containers, and network devices by correlating telemetry from multiple sources.

Although it is not a commercial XDR platform, many organizations use Wazuh alongside EDR and threat intelligence platforms to build an open-source XDR-like architecture.

Endpoint Monitoring

The Wazuh agent continuously monitors:

File changes
Running processes
Installed software
Windows Event Logs
Linux system logs
macOS events
Registry modifications
Rootkit activity

Endpoint telemetry forms the foundation for many integrations.

Log Collection

One of Wazuh’s biggest strengths is centralized log collection.

It can ingest logs from:

Servers
Applications
Firewalls
IDS/IPS solutions
Cloud services
Containers
Authentication systems
Network appliances

These logs become searchable within the Wazuh platform.

Threat Detection

Wazuh detects suspicious activity using:

Signature-based detection
Behavioral rules
Threat intelligence feeds
File Integrity Monitoring (FIM)
Rootcheck
Syscollector
Vulnerability Detection

External integrations significantly improve detection accuracy by providing additional context.

Compliance Monitoring

Wazuh includes compliance modules for frameworks such as:

PCI DSS
HIPAA
GDPR
NIST
CIS Benchmarks

Integrating with cloud platforms and enterprise infrastructure allows compliance monitoring to cover a much broader attack surface.

How Wazuh Integrations Work

Wazuh supports multiple integration mechanisms depending on the external system.

Data Ingestion

Many integrations simply send data into Wazuh.

Examples include:

Firewall logs
Cloud logs
DNS logs
Authentication events
VPN logs

These events are decoded, classified, and matched against Wazuh detection rules.

API-Based Integrations

Many modern security products expose REST APIs that Wazuh can query.

Examples include:

Threat intelligence platforms
Microsoft Graph
Cloud providers
Asset inventories
Vulnerability scanners

API integrations allow Wazuh to enrich alerts with external information instead of relying solely on local events.

Syslog Forwarding

Syslog remains one of the most common enterprise integration methods.

Devices that commonly forward logs to Wazuh include:

Firewalls
Switches
Routers
VPN gateways
Unix servers
IDS appliances

Syslog simplifies centralized monitoring without requiring agents.

Webhooks

Some integrations push alerts to external systems through webhooks.

Common webhook destinations include:

Chat platforms
Ticketing systems
SOAR platforms
Automation pipelines

Webhooks enable real-time workflows without polling APIs.

Active Response

Active Response allows Wazuh to execute scripts automatically after detecting predefined events.

Common actions include:

Blocking IP addresses
Disabling user accounts
Killing malicious processes
Isolating compromised hosts
Updating firewall rules

Automation reduces the time between detection and containment.

External Enrichment

One of the most valuable integration features is external enrichment.

Instead of generating alerts with limited context, Wazuh can query external services for additional information such as:

File reputation
IP reputation
Domain reputation
Vulnerability details
Asset ownership
User identity
Cloud resource metadata

This reduces manual investigation time and helps analysts prioritize incidents.

For example, integrating VirusTotal allows Wazuh to determine whether a suspicious file hash has already been identified as malicious by dozens of antivirus engines.

Types of Wazuh Integrations

Wazuh supports integrations across nearly every layer of an organization’s infrastructure.

These integrations enhance visibility, automate security workflows, and improve incident response by allowing Wazuh to exchange information with complementary platforms.

Threat Intelligence Platforms

Threat intelligence integrations enrich Wazuh alerts with external information about malicious files, IP addresses, domains, and attack campaigns.

Rather than relying solely on local detection rules, Wazuh can compare indicators against global threat intelligence databases to improve detection confidence.

Common threat intelligence integrations include:

VirusTotal

VirusTotal enriches alerts by checking:

File hashes
URLs
IP addresses
Domains

This helps analysts quickly determine whether an indicator has been previously associated with malware.

AbuseIPDB

AbuseIPDB provides reputation information for IP addresses involved in malicious activities such as:

Brute-force attacks
Spam
Botnets
Port scanning

Enriching alerts with AbuseIPDB data helps prioritize hostile IP addresses.

MISP

The Malware Information Sharing Platform (MISP) enables organizations to share Indicators of Compromise (IOCs) and threat intelligence across security communities.

Organizations often integrate MISP with Wazuh to correlate internal events against shared threat intelligence.

AlienVault OTX

AlienVault OTX supplies community-driven threat intelligence including:

Malicious IPs
Domains
File hashes
Emerging malware campaigns

OTX enrichment improves visibility into known threats affecting multiple organizations.

Network Security Devices

Network devices provide valuable telemetry that complements endpoint monitoring.

Common integrations include:

Firewalls

Firewall logs reveal:

Blocked connections
Allowed traffic
VPN activity
NAT translations
Suspicious inbound connections

Integrating firewall events improves attack visibility.

IDS/IPS

Intrusion Detection and Prevention Systems generate alerts when suspicious network activity is detected.

A popular integration is:

Suricata

Combining Suricata network alerts with Wazuh endpoint events provides stronger detection through event correlation.

VPN Appliances

VPN gateways provide authentication logs that help identify:

Failed logins
Geographic anomalies
Concurrent sessions
Suspicious remote access

Routers

Routers contribute:

NetFlow data
Routing changes
Interface events
Administrative logins

These events help identify network infrastructure attacks.

Cloud Platforms

Cloud services generate a significant amount of security telemetry that Wazuh can ingest and analyze.

AWS

Typical AWS integrations include:

CloudTrail
CloudWatch
GuardDuty
VPC Flow Logs
S3 access logs

These provide visibility into cloud infrastructure activity.

Microsoft Azure

Azure integrations commonly include:

Azure Activity Logs
Azure AD sign-ins
Microsoft Defender
Azure Monitor

Administrators frequently use Microsoft Graph APIs during Azure integrations.

Google Cloud Platform

Common GCP integrations include:

Cloud Audit Logs
Cloud Logging
Security Command Center
Compute Engine logs

Cloud integrations improve hybrid infrastructure monitoring.

Endpoint Security Tools

Endpoint security products provide additional context beyond native operating system logs.

Antivirus

Common antivirus integrations correlate:

Malware detections
Quarantine events
Signature updates
Scan results

EDR

Endpoint Detection and Response platforms contribute:

Behavioral detections
Process trees
Memory analysis
Attack timelines

Combining EDR telemetry with Wazuh provides broader visibility into endpoint attacks.

Asset Management

Asset inventories help enrich alerts with:

Device ownership
Operating system
Installed software
Business criticality

Vulnerability Scanners

Vulnerability management platforms provide:

CVE information
Risk scores
Patch status
Exposure data

This allows Wazuh to prioritize alerts affecting vulnerable systems.

Log Management Platforms

Many organizations forward Wazuh alerts to centralized analytics platforms.

Syslog Servers

Syslog forwarding supports long-term storage and centralized log aggregation.

SIEM Platforms

Organizations sometimes forward Wazuh alerts into enterprise SIEM solutions for additional correlation or enterprise reporting.

For example, administrators may integrate Wazuh with Splunk when standardized dashboards or enterprise workflows already exist.

Log Forwarding

Logs can be forwarded using:

Syslog
Filebeat
APIs
Custom integrations

This allows multiple security platforms to consume the same events.

Data Lakes

Security teams often archive Wazuh data in data lakes for:

Threat hunting
Machine learning
Compliance retention
Historical investigations

Notification and Collaboration Platforms

Rapid notification is essential for effective incident response.

Slack

Slack integrations can send alerts directly to SOC channels, enabling analysts to review and triage incidents collaboratively.

Microsoft Teams

Microsoft Teams notifications help organizations that use the Microsoft ecosystem receive security alerts in real time.

Email

Email notifications remain useful for:

Critical alerts
Daily summaries
Compliance reports
Administrative notifications

PagerDuty

PagerDuty integrations automatically escalate high-severity incidents to on-call responders, reducing response times for critical security events.

According to the SANS Institute, integrating detection platforms with collaboration and incident management tools improves operational efficiency by shortening the time between detection, investigation, and response.

Wazuh Integration Architecture

A well-designed integration architecture ensures that Wazuh can ingest, process, enrich, and distribute security events efficiently across your environment.

Understanding how each component interacts with the others makes it easier to deploy new integrations, troubleshoot issues, and optimize performance.

At a high level, the workflow follows a predictable path:

Security events are generated by endpoints, applications, or network devices.
Wazuh agents or log collectors capture the events.
The Wazuh Manager analyzes the data against decoders and detection rules.
Alerts are indexed and stored.
The Wazuh Dashboard displays the results.
External integrations enrich alerts or trigger automated responses.

This modular architecture allows organizations to integrate Wazuh with hundreds of third-party products without significantly altering the core platform.

Core Components

Understanding the purpose of each Wazuh component is essential before implementing integrations.

Wazuh Manager

The Wazuh Manager is the central processing engine responsible for receiving telemetry from agents and external sources.

Its primary responsibilities include:

Processing incoming logs
Running decoders
Evaluating detection rules
Correlating events
Triggering Active Response
Managing agents
Executing integrations
Generating alerts

Nearly every integration communicates directly or indirectly with the Manager.

Examples include:

Threat intelligence lookups
Syslog ingestion
API requests
Active response scripts
Cloud log processing

Wazuh Agents

Agents collect telemetry from monitored endpoints and forward it securely to the Wazuh Manager.

They gather information such as:

Operating system logs
File Integrity Monitoring (FIM) events
Process activity
Registry changes
Installed software
Vulnerability information
Authentication events

Because agents operate locally, they provide detailed visibility that network-only monitoring cannot.

Indexer

The Wazuh Indexer stores processed security events and makes them searchable.

Its responsibilities include:

Indexing alerts
Storing historical events
Supporting fast searches
Retaining security data
Powering dashboards
Supporting threat hunting

As environments grow, proper Indexer sizing becomes increasingly important for maintaining query performance.

Dashboard

The Dashboard provides the graphical interface used by analysts and administrators.

Users can:

View alerts
Search events
Investigate incidents
Review compliance reports
Analyze trends
Monitor integrations
Manage configurations

Many external integrations ultimately enhance the information displayed within the Dashboard.

API

The Wazuh REST API enables automation and communication with external platforms.

Common API use cases include:

Querying alerts
Managing agents
Updating configurations
Retrieving inventory data
Automating workflows
Integrating SOAR platforms
Building custom dashboards

Most enterprise integrations rely on API communication to exchange data securely.

Data Flow

Understanding the data flow helps explain where integrations fit into the detection pipeline.

Event Generation

Security events originate from many sources, including:

Windows Event Logs
Linux syslogs
Firewall appliances
IDS/IPS sensors
Cloud services
Applications
Identity providers
Endpoint agents

Every integration begins with one or more event sources.

Log Collection

Logs are collected using methods such as:

Wazuh Agents
Syslog
API ingestion
File monitoring
Cloud connectors

The Manager normalizes incoming data before analysis.

Rule Evaluation

After logs are received, Wazuh evaluates them using:

Decoders
Detection rules
Correlation logic
Threat intelligence
Custom rules

This stage determines whether an event should generate an alert.

Alert Generation

When a rule matches, Wazuh creates an alert containing information such as:

Severity level
Source host
Event details
Detection rule
Timestamp
Relevant indicators

Additional integrations can enrich these alerts with contextual information.

External Integrations

Once alerts are generated, Wazuh can interact with external platforms to:

Check file reputations
Query IP intelligence
Send notifications
Forward logs
Open tickets
Trigger SOAR playbooks
Update asset inventories

These integrations transform basic alerts into actionable security intelligence.

Incident Response

Finally, Wazuh can initiate automated or semi-automated response actions.

Examples include:

Blocking malicious IP addresses
Disabling compromised accounts
Killing malicious processes
Updating firewall rules
Isolating endpoints
Sending alerts to collaboration platforms

Automation significantly reduces the time between detection and containment.

Common Integration Methods

Wazuh supports several mechanisms for integrating with external systems.

The appropriate method depends on the capabilities of the third-party platform.

REST APIs

REST APIs are the preferred integration method for modern cloud services and security platforms.

Typical API integrations include:

Threat intelligence platforms
Cloud providers
Identity providers
Asset management systems
Vulnerability scanners
SOAR platforms

API-based integrations enable real-time data exchange and richer contextual information.

Syslog

Syslog remains one of the most widely supported integration protocols.

Common devices forwarding logs via Syslog include:

Firewalls
Routers
Switches
VPN gateways
IDS/IPS appliances
Unix servers

Syslog provides a simple and reliable way to centralize security logs.

File Monitoring

Some applications generate logs locally rather than exposing APIs or Syslog.

Wazuh can monitor these files directly to ingest:

Application logs
Audit logs
Database logs
Web server logs
Security appliance exports

File monitoring is particularly useful for legacy systems.

Active Response Scripts

Active Response scripts allow Wazuh to perform automated remediation after detecting predefined threats.

Common automated actions include:

Blocking IP addresses
Removing malicious files
Restarting compromised services
Updating firewall policies
Disabling user accounts

These scripts can also invoke external APIs to orchestrate broader response workflows.

Webhooks

Webhooks allow Wazuh to send alerts instantly to external platforms whenever specified conditions are met.

Popular webhook destinations include:

Slack
Microsoft Teams
PagerDuty
Ticketing systems
SOAR platforms
Custom automation services

Because webhooks push data immediately, they are well suited for real-time notification and workflow automation.

Preparing Your Environment

Proper preparation minimizes deployment issues and helps ensure integrations operate securely and reliably.

Before connecting Wazuh to third-party platforms, verify that your infrastructure, authentication methods, and network configuration are ready.

Verify Version Compatibility

Not every integration supports every version of Wazuh or the connected platform.

Before deployment, verify:

Wazuh version compatibility
Supported operating systems
API version requirements
Plugin compatibility
Indexer compatibility
Dashboard compatibility

Review release notes whenever upgrading either Wazuh or an integrated product, as API changes and deprecated features can affect existing integrations.

Wazuh Documentation – Release Notes: https://documentation.wazuh.com/current/release-notes/

Configure Network Connectivity

Most integrations depend on reliable communication between systems.

Confirm that:

Required ports are open
Firewalls allow traffic
DNS resolution functions correctly
Routing is configured properly
Proxy settings are correct
TLS communication succeeds

Network connectivity should be validated before troubleshooting application-level issues.

Secure API Access

API integrations often require elevated permissions, making them an attractive target for attackers.

Follow these security practices:

Use HTTPS exclusively
Rotate API keys regularly
Limit API permissions using the principle of least privilege
Restrict API access by IP address where possible
Enable audit logging
Monitor failed authentication attempts

Avoid embedding credentials directly into scripts whenever secure alternatives such as environment variables or secret management solutions are available.

Configure Authentication

Different integrations support different authentication methods.

Common options include:

API keys
OAuth tokens
JWT tokens
Client certificates
Basic authentication
Service accounts

Choose the strongest authentication mechanism supported by both Wazuh and the integrated platform.

Backup Existing Configuration

Before modifying production integrations, create backups of relevant configuration files.

Common files to back up include:

ossec.conf
Local rules
Custom decoders
Active Response scripts
Integration configuration files
SSL certificates

Maintaining version-controlled backups simplifies rollback if an integration introduces unexpected behavior.

Test Basic Connectivity

Before enabling production workflows, verify connectivity between Wazuh and the external platform.

Typical validation steps include:

Ping or reachability tests
DNS resolution checks
TLS certificate validation
API authentication tests
Sample log transmission
Test alert generation
Response verification

Incremental testing helps isolate configuration problems before they impact production monitoring.

Integrating Threat Intelligence

Threat intelligence transforms security alerts into actionable intelligence by providing additional context about suspicious indicators.

Rather than investigating every alert manually, analysts can quickly determine whether an IP address, domain, URL, or file hash has already been associated with known malicious activity.

Why Threat Intelligence Matters

Threat intelligence helps security teams prioritize alerts based on real-world risk.

Benefits include:

Faster incident triage
Reduced false positives
Improved detection accuracy
Better prioritization of high-risk alerts
Enhanced malware identification
Greater visibility into emerging threats

According to the Verizon Data Breach Investigations Report (DBIR), organizations increasingly rely on threat intelligence and contextual analysis to improve detection and accelerate incident response in complex attack environments.

Security expert Troy Hunt, creator of Have I Been Pwned, has consistently emphasized that context is critical when evaluating indicators of compromise, noting that raw indicators become significantly more valuable when enriched with reliable intelligence sources. This principle underpins modern security operations and explains why threat intelligence integrations are now a standard component of mature SOCs.

Threat Enrichment Workflow

A typical Wazuh threat enrichment workflow follows these steps:

A security event is detected.
Wazuh extracts indicators such as IP addresses, file hashes, or domains.
The integration queries one or more threat intelligence providers.
Reputation data is returned.
Wazuh enriches the alert with contextual information.
Detection rules may increase the alert severity based on the enrichment.
Analysts investigate or automated response actions are triggered.

This automated workflow enables analysts to focus on genuine threats instead of manually researching every indicator.

Common Threat Intelligence Sources

Organizations commonly integrate Wazuh with multiple intelligence providers to improve coverage.

Popular sources include:

VirusTotal
AbuseIPDB
MISP
AlienVault OTX
OpenPhish
Spamhaus
Emerging Threats
Commercial intelligence feeds

Using multiple sources helps validate indicators and reduces reliance on any single provider.

Best Practices

To maximize the value of threat intelligence integrations:

Integrate multiple reputable intelligence sources.
Cache lookups when appropriate to reduce API usage.
Respect API rate limits and quotas.
Prioritize high-confidence indicators over low-confidence feeds.
Regularly rotate API credentials.
Continuously review enrichment rules to reduce false positives.
Combine threat intelligence with endpoint and network telemetry rather than relying on reputation data alone.
Monitor enrichment performance and API failures to ensure consistent alert quality.

When implemented thoughtfully, threat intelligence integrations significantly enhance Wazuh’s detection capabilities while reducing investigation time and improving overall security operations.

Integrating Network Security Tools

Network security devices provide critical visibility into traffic flowing across your infrastructure.

While Wazuh agents monitor activity on individual endpoints, network security tools detect attacks occurring between systems, making them an excellent complement to endpoint monitoring.

By integrating firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS), organizations can correlate network events with endpoint telemetry to improve detection accuracy and reduce investigation time.

IDS/IPS Platforms

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) monitor network traffic for malicious behavior such as exploits, malware communications, command-and-control (C2) traffic, reconnaissance, and policy violations.

One of the most widely used integrations is Suricata, an open-source IDS/IPS capable of inspecting network traffic in real time and generating detailed alerts for suspicious activity.

Integrating Suricata with Wazuh enables security teams to combine endpoint events with network detections, providing a more complete picture of an attack.

Benefits

Connecting Wazuh with IDS/IPS platforms offers several advantages:

Improved detection accuracy
Greater network visibility
Earlier identification of attacks
Reduced false positives
Faster incident investigation
Better attack attribution
Enhanced threat hunting capabilities

Rather than relying on endpoint activity alone, analysts can determine whether malicious network traffic accompanied suspicious system behavior.

Event Correlation

One of the biggest advantages of integrating IDS/IPS solutions with Wazuh is event correlation.

For example:

Suricata detects an exploit attempt against a web server.
Wazuh simultaneously records unexpected process creation on the same host.
File Integrity Monitoring detects changes to application files.
Active Response blocks the attacker’s IP address.

Individually, these events may appear unrelated. Correlated together, they provide strong evidence of a successful compromise.

Correlation also helps reduce alert fatigue by grouping related events into a single security incident.

Alert Enrichment

Network alerts become significantly more useful when enriched with endpoint and threat intelligence data.

A typical enriched alert may include:

Source and destination IP addresses
File hashes
Process information
User accounts
Host inventory
Threat intelligence reputation
Vulnerability information
MITRE ATT&CK mappings

This additional context enables analysts to prioritize investigations more effectively.

Firewall Platforms

Firewalls remain one of the primary sources of security telemetry within enterprise environments.

They record connection attempts, policy decisions, VPN activity, and administrative actions that are often essential during incident investigations.

One commonly deployed integration is OPNsense, which can forward firewall logs directly to Wazuh for centralized monitoring and correlation.

Related Guide: How to Integrate Wazuh with OPNsense

Other enterprise firewall platforms can typically integrate using Syslog, APIs, or log forwarding mechanisms.

Log Collection

Firewall integrations enable Wazuh to collect events such as:

Allowed connections
Blocked connections
VPN sessions
NAT translations
Administrative logins
Policy changes
Intrusion prevention events
DNS requests

These logs provide valuable insight into network activity that endpoint agents cannot observe.

Firewall Event Monitoring

Once firewall logs are ingested, Wazuh can detect suspicious activities including:

Port scanning
Brute-force attacks
Geographic anomalies
Excessive denied connections
Unexpected outbound traffic
VPN authentication failures
Unauthorized configuration changes

Combining firewall telemetry with endpoint monitoring significantly improves detection confidence.

Network Visibility

Integrating network security tools gives security teams a broader understanding of how attackers move throughout an environment.

Benefits include:

Visibility into east-west traffic
Monitoring internet-facing services
Detecting lateral movement
Tracking command-and-control communications
Identifying unauthorized outbound connections
Correlating endpoint and network events

According to the MITRE ATT&CK framework, adversaries frequently combine network-based techniques with endpoint compromise throughout the attack lifecycle.

Correlating both data sources allows defenders to detect attacks that may otherwise go unnoticed.

Integrating Log Management Platforms

Many organizations already operate centralized log management or SIEM platforms.

Rather than replacing these systems, Wazuh can integrate with them by forwarding alerts, sharing telemetry, and enriching existing security workflows.

This approach allows organizations to leverage Wazuh’s endpoint detection capabilities while continuing to use familiar dashboards, reporting tools, and long-term storage solutions.

Splunk Integration

Splunk is one of the most commonly integrated enterprise SIEM platforms.

Organizations frequently forward Wazuh alerts into Splunk for advanced analytics, executive dashboards, enterprise reporting, and cross-platform event correlation.

A properly configured integration enables analysts to investigate endpoint events alongside logs from network devices, cloud platforms, identity providers, and business applications.

Log Forwarding

Wazuh can forward alerts to Splunk using several methods, including:

Universal Forwarder
Syslog
File-based forwarding
APIs
Custom integrations

Selecting the appropriate forwarding method depends on your organization’s architecture, scalability requirements, and existing Splunk deployment.

Data Mapping

Successful integrations depend on consistent field mapping between Wazuh and the receiving platform.

Important fields typically include:

Timestamp
Hostname
Agent ID
Rule ID
Severity
Event category
Source IP
Destination IP
Username
Process name

Proper normalization ensures that searches, dashboards, alerts, and correlation rules function as expected across both platforms.

Common Configuration Issues

Administrators frequently encounter issues such as:

Incorrect field mappings
Timestamp mismatches
Missing indexes
Parsing errors
Duplicate events
Authentication failures
Broken forwarder configurations
Incomplete log ingestion

Most of these problems can be identified by validating forwarding pipelines, reviewing parser configurations, and testing sample events before moving integrations into production.

Other SIEM Platforms

Although Splunk is a popular choice, Wazuh can integrate with many other log management and analytics platforms.

Elasticsearch

Organizations using Elasticsearch can forward Wazuh alerts for:

Long-term storage
Advanced search
Custom analytics
Machine learning
Security reporting

Careful index lifecycle management helps maintain query performance as data volumes grow.

OpenSearch

Modern Wazuh deployments commonly use OpenSearch as the underlying indexing and search engine.

Benefits include:

Fast querying
Scalable storage
Rich visualizations
Security dashboards
Role-based access control
Distributed architecture

Because Wazuh is tightly integrated with OpenSearch, many organizations use it as their primary analytics platform without requiring an additional SIEM.

Graylog

Graylog can also ingest Wazuh-generated events for centralized log analysis.

Common use cases include:

Unified log management
Enterprise search
Alert routing
Custom dashboards
Long-term archival
Cross-platform investigations

The flexibility of Syslog and API-based forwarding makes Graylog a practical option for organizations with heterogeneous logging environments.

According to the NIST Cybersecurity Framework (CSF) 2.0, centralized collection and analysis of security events improve an organization’s ability to detect, investigate, and respond to cybersecurity incidents.

Integrating Microsoft Services

Many organizations rely heavily on Microsoft services for identity management, cloud infrastructure, productivity, and endpoint security. Integrating these services with Wazuh enhances visibility into authentication events, cloud activity, and administrative operations.

Among these integrations, Microsoft Graph API plays a central role by providing secure access to Microsoft 365 and Azure resources.

Microsoft Graph API

Microsoft Graph API enables Wazuh to retrieve information from Microsoft cloud services, including:

Microsoft Entra ID (formerly Azure Active Directory)
Microsoft 365
Exchange Online
SharePoint
OneDrive
Microsoft Teams
Security alerts
User and group information

Many Microsoft integrations rely on Graph API authentication before data can be collected.

Authentication Flow

A typical Microsoft Graph API integration follows these steps:

Register an application in Microsoft Entra ID.
Assign the required API permissions.
Generate client credentials or configure certificate-based authentication.
Request an OAuth access token.
Authenticate API requests using the access token.
Retrieve logs, alerts, or resource information.
Process the data within Wazuh.

Following Microsoft’s recommended OAuth 2.0 flow ensures secure communication between Wazuh and Microsoft services.

Common Authentication Errors

Authentication problems are among the most common causes of Microsoft integration failures.

Typical issues include:

Expired access tokens
Invalid client secrets
Incorrect tenant IDs
Missing API permissions
Misconfigured redirect URIs
Clock synchronization issues
Conditional Access restrictions
Disabled service principals

Reviewing Microsoft Entra ID sign-in logs can often help identify the root cause of authentication failures.

Token Management

Proper token management improves both security and reliability.

Best practices include:

Automatically refresh access tokens before expiration.
Rotate client secrets regularly.
Prefer certificate-based authentication where supported.
Store credentials securely using a secrets management solution.
Monitor authentication failures and token expiration events.
Remove unused application credentials promptly.

Effective token lifecycle management reduces service interruptions and limits the risk of credential compromise.

Security Best Practices

When integrating Microsoft services with Wazuh:

Apply the principle of least privilege to API permissions.
Enable multifactor authentication (MFA) for administrative accounts.
Use managed identities or certificate-based authentication when available.
Protect client secrets in a secure vault rather than configuration files.
Audit API usage regularly.
Enable logging for authentication events.
Rotate credentials according to organizational security policies.
Continuously review application permissions and remove unnecessary access.

Microsoft’s security guidance recommends minimizing privileged access, monitoring application permissions, and using modern authentication methods to reduce the attack surface of cloud integrations.

Common Wazuh Integration Challenges

Even well-designed integrations can experience issues as environments evolve.

Configuration changes, software upgrades, API modifications, networking problems, and authentication failures can interrupt data collection or reduce the effectiveness of security monitoring.

Understanding the most common integration challenges makes it easier to diagnose problems quickly and maintain reliable security operations.

Authentication Failures

Authentication issues are among the most frequent causes of failed integrations.

Common causes include:

Expired API tokens
Invalid API keys
Incorrect client secrets
Expired certificates
OAuth configuration errors
Disabled service accounts
Incorrect usernames or passwords
Multi-factor authentication restrictions

Authentication failures typically prevent Wazuh from collecting data or enriching alerts from external platforms.

To reduce authentication problems:

Rotate credentials before expiration.
Monitor failed login attempts.
Use dedicated service accounts.
Enable secure credential storage.
Regularly verify API permissions.

API Rate Limits

Many cloud providers and threat intelligence services enforce API rate limits to protect their infrastructure.

Symptoms include:

HTTP 429 (“Too Many Requests”) responses
Delayed enrichment
Missing threat intelligence lookups
Temporary API lockouts

Rate limits are especially common when integrating with:

VirusTotal
Microsoft Graph API
Cloud provider APIs
Commercial threat intelligence platforms

Mitigation strategies include:

Caching frequently requested data
Implementing exponential backoff
Scheduling requests intelligently
Monitoring API usage
Upgrading API plans when appropriate

SSL Certificate Errors

Secure communication depends on properly configured TLS certificates.

Common SSL issues include:

Expired certificates
Self-signed certificates
Invalid certificate chains
Hostname mismatches
Unsupported TLS versions
Missing trusted certificate authorities

Certificate problems often prevent secure API communication or Syslog over TLS connections.

Administrators should regularly validate certificate expiration dates and renew certificates before they expire.

Network Connectivity Problems

Many integration failures originate from basic networking issues rather than application configuration.

Potential causes include:

Firewall restrictions
Closed ports
Incorrect routing
DNS failures
Proxy misconfiguration
VPN disruptions
Packet filtering
High latency

Simple connectivity tests can often identify these issues before extensive troubleshooting is required.

Log Parsing Issues

Wazuh relies on decoders to interpret incoming log data.

Parsing problems commonly occur when:

Log formats change after software updates.
Custom applications produce inconsistent logs.
Incorrect decoders are selected.
Fields are reordered.
Unexpected characters appear in messages.

Symptoms include:

Unknown event types
Missing fields
Incorrect rule matching
Decoder errors

Updating decoders or creating custom decoders usually resolves these issues.

Duplicate Events

Duplicate alerts increase storage consumption and contribute to alert fatigue.

Common causes include:

Multiple log forwarding paths
Duplicate Syslog configurations
Multiple agents monitoring the same files
Repeated API polling
Overlapping integrations

Regular audits of log collection paths help eliminate duplicate event ingestion.

Missing Logs

Missing logs reduce visibility and create blind spots during investigations.

Possible causes include:

Network interruptions
Agent failures
API authentication errors
Incorrect file permissions
Log rotation problems
Misconfigured collection rules
Buffer overflows

Monitoring ingestion rates can help detect missing data before it affects security operations.

Version Compatibility Problems

Software upgrades sometimes introduce:

API changes
Deprecated features
Modified log formats
Updated authentication methods
Configuration changes

Before upgrading Wazuh or any integrated platform:

Review release notes.
Verify supported versions.
Test integrations in a staging environment.
Validate custom scripts.
Update decoders if necessary.

Proper change management significantly reduces upgrade-related outages.

Permission and Access Errors

Insufficient permissions can prevent integrations from functioning correctly.

Examples include:

Missing API scopes
Restricted filesystem permissions
Firewall management restrictions
Read-only service accounts
Missing cloud IAM roles

Applying the principle of least privilege while ensuring required permissions are available provides the best balance between security and functionality.

According to the OWASP API Security Project, authentication, authorization, and access control failures remain among the most common security issues affecting modern API-driven applications.

Best Practices for Wazuh Integrations

Following established best practices helps ensure that Wazuh integrations remain secure, reliable, and maintainable over time.

These recommendations reduce operational risk while improving detection quality and long-term scalability.

Use Secure Authentication

Always use strong authentication methods when connecting Wazuh to external platforms.

Recommended approaches include:

OAuth 2.0
API keys stored securely
Certificate-based authentication
Managed identities
Service accounts

Avoid hardcoding credentials directly into configuration files or scripts whenever possible.

Encrypt Data in Transit

Security telemetry often contains sensitive information that should be protected during transmission.

Use encrypted communication channels such as:

HTTPS
TLS
Syslog over TLS
Secure VPN tunnels

Regularly verify certificates and disable outdated encryption protocols to reduce exposure to interception attacks.

Apply Least-Privilege Permissions

Grant integrations only the permissions necessary to perform their intended tasks.

Examples include:

Read-only API access for log collection
Limited IAM roles
Minimal filesystem permissions
Restricted firewall management privileges

Periodic permission reviews help identify excessive privileges that can increase security risks.

Monitor Integration Health

Successful integrations require ongoing monitoring rather than one-time configuration.

Track metrics such as:

API response times
Authentication failures
Log ingestion rates
Alert generation
Processing delays
Queue sizes
Failed enrichment requests

Proactive monitoring allows administrators to detect issues before they impact security visibility.

Keep Integrations Updated

Regular updates improve:

Security
Compatibility
Performance
Stability
Feature availability

Whenever updates are planned:

Review release notes.
Test integrations in staging.
Validate custom scripts.
Confirm API compatibility.
Monitor post-upgrade performance.

Validate Incoming Data

Incoming logs should be validated before being used for detection and automation.

Validation helps identify:

Corrupted events
Malformed JSON
Unexpected field values
Missing timestamps
Invalid IP addresses
Unsupported log formats

Early validation reduces parsing failures and improves alert accuracy.

Tune Alert Rules

Default detection rules are designed to support a wide range of environments but may generate unnecessary alerts.

Regular tuning can:

Reduce false positives
Improve detection precision
Prioritize high-risk events
Eliminate redundant alerts
Reduce analyst workload

Alert tuning should be based on observed operational data rather than assumptions.

Document Integration Configurations

Maintain documentation covering:

Architecture diagrams
Authentication methods
API endpoints
Firewall requirements
Configuration files
Service accounts
Certificates
Troubleshooting procedures

Well-maintained documentation accelerates onboarding, simplifies troubleshooting, and improves disaster recovery.

Regularly Test Failover Procedures

Integrations should continue operating during component failures whenever possible.

Periodic testing should verify:

Backup communication paths
Secondary API endpoints
High-availability clusters
Disaster recovery procedures
Configuration restoration
Alert continuity

According to Google’s Site Reliability Engineering (SRE) principles, systems become more reliable when failure scenarios are tested proactively rather than assumed to work during an outage.

Troubleshooting Wazuh Integrations

Even mature environments occasionally experience integration failures.

A structured troubleshooting process allows administrators to identify root causes efficiently and restore functionality with minimal disruption.

Rather than changing multiple settings simultaneously, troubleshoot systematically by verifying connectivity, authentication, data processing, and alert generation one layer at a time.

Verify API Connectivity

For API-based integrations, begin by confirming that Wazuh can communicate with the external service.

Verify:

DNS resolution
Network reachability
HTTPS connectivity
API endpoint availability
TLS negotiation
HTTP response codes

Command-line tools such as curl or API testing clients can help isolate connectivity issues before investigating application-level problems.

Check Authentication Credentials

Many integration failures stem from invalid or expired credentials.

Confirm that:

API keys are valid.
OAuth tokens have not expired.
Client secrets are current.
Certificates remain valid.
Service accounts are enabled.
Required permissions have been granted.

Authentication logs from the external platform often provide valuable diagnostic information.

Review Wazuh Logs

Wazuh logs frequently contain detailed error messages that identify configuration or communication problems.

Review logs for:

Authentication failures
Decoder errors
Integration execution failures
Active Response issues
Connection timeouts
Certificate validation errors

Searching log files by timestamp helps correlate failures with recent configuration changes.

Validate Decoder and Rule Processing

If logs are reaching Wazuh but alerts are not generated, verify that decoders and detection rules are functioning correctly.

Check for:

Successful decoder matching
Correct field extraction
Expected rule execution
Rule severity assignments
Correlation logic
Custom rule conflicts

Testing sample events can quickly determine whether processing is functioning as expected.

Confirm Network Connectivity

If communication failures persist, verify the underlying network infrastructure.

Check:

Firewall rules
Open ports
Routing
DNS
Proxy settings
VPN connectivity
Packet loss
Latency

Network monitoring tools can help identify intermittent communication issues.

Test Data Flow End-to-End

Validate the complete integration pipeline rather than individual components.

A comprehensive test should confirm that:

The source system generates an event.
Wazuh successfully receives the data.
Decoders process the event correctly.
Detection rules evaluate the event.
Alerts are indexed.
External enrichment executes successfully.
Notifications or automated responses occur as expected.

End-to-end testing helps identify failures that may not be visible when testing components independently.

Monitor Integration Performance

Performance monitoring helps detect problems before they affect security operations.

Useful metrics include:

API latency
Event throughput
Queue depth
Processing time
Error rates
Failed API requests
Resource utilization
Alert processing delays

Monitoring trends over time makes it easier to identify gradual performance degradation.

Verify Alert Generation

The final validation step is confirming that security alerts are generated as expected.

Verify that:

Detection rules trigger correctly.
Alert severity is appropriate.
Threat intelligence enrichment is included when applicable.
Notifications reach their intended destinations.
Active Response actions execute successfully.
Alerts appear in the Wazuh Dashboard and any integrated SIEM platforms.

Establishing routine health checks and scheduled integration testing helps ensure that Wazuh continues to deliver complete and accurate security visibility as your infrastructure evolves.

Monitoring Integration Performance

Once Wazuh integrations are deployed, continuous performance monitoring becomes essential to ensure reliability, responsiveness, and data integrity across the security pipeline.

Poorly performing integrations can lead to delayed alerts, missed events, or degraded detection quality, which directly impacts incident response effectiveness.

A structured monitoring approach focuses on throughput, latency, error rates, and resource consumption across all integration layers.

Event Throughput

Event throughput measures how many security events Wazuh processes over a given period.

Key considerations include:

Number of logs ingested per second
Peak vs average event rates
Agent-to-manager ingestion capacity
External log source volume (firewalls, cloud, IDS/IPS)
Indexer indexing capacity

A sudden drop in throughput may indicate:

Network bottlenecks
Agent failures
API rate limiting
Misconfigured log sources

Sustained high throughput without proper scaling can lead to processing delays and queue buildup.

API Response Times

API-based integrations rely heavily on external service responsiveness.

Monitor:

Average API latency
P95/P99 response times
Timeouts and retries
Slow endpoints (threat intelligence, Microsoft Graph, cloud APIs)

Increased response times can cause:

Delayed enrichment
Backlogged integration pipelines
Missed automation triggers

Optimizing API usage and implementing caching strategies can significantly improve performance stability.

Failed Requests

Tracking failed requests is critical for maintaining integration reliability.

Common failure types include:

HTTP 4xx errors (authentication/authorization issues)
HTTP 5xx errors (server-side issues)
Timeout errors
DNS resolution failures
TLS handshake failures

A rising failure rate often indicates:

Expired credentials
API deprecation
Network instability
Misconfigured endpoints

Centralized logging of failed requests helps identify systemic issues early.

Alert Volume

Alert volume reflects the number of security alerts generated and processed by Wazuh.

Key metrics include:

Total alerts per time interval
High vs low severity distribution
Alerts per integration source
Duplicate alert frequency
Alert spikes correlated with infrastructure changes

Unexpected increases in alert volume may indicate:

Misconfigured rules
Integration duplication
Active attacks
Log ingestion errors

Monitoring alert trends helps maintain signal quality and reduces analyst fatigue.

Resource Utilization

Wazuh integrations consume system resources across multiple components.

Monitor:

CPU usage (Manager, Indexer, API services)
Memory consumption
Disk I/O and storage growth
Network bandwidth usage
Indexer shard performance

Resource exhaustion can degrade:

Log processing speed
API responsiveness
Alert generation
Dashboard performance

Proper capacity planning is essential for environments with high-volume integrations such as firewall logs or cloud telemetry.

Integration Health Checks

Regular health checks ensure integrations remain functional over time.

Effective health checks include:

API connectivity tests
Authentication validation
Sample log ingestion
Rule execution verification
Alert generation confirmation
Webhook delivery validation

Automated health checks can quickly detect integration failures before they impact security visibility.

Security Considerations

Wazuh integrations often connect to sensitive systems, making security a critical design factor.

Poorly secured integrations can introduce vulnerabilities such as credential exposure, unauthorized access, or data interception.

A strong security posture requires protecting credentials, securing communication channels, validating external data sources, and auditing all integration activity.

Protect API Keys

API keys and tokens are commonly targeted by attackers due to their broad access capabilities.

Best practices include:

Store keys in secure vaults (not in plaintext configs)
Avoid hardcoding credentials in scripts
Use environment variables where appropriate
Restrict key usage by IP or service
Disable unused keys immediately

Compromised API keys can allow attackers to extract sensitive security data or disable integrations entirely.

Rotate Credentials Regularly

Regular credential rotation reduces long-term exposure risks.

Recommended practices:

Rotate API keys and secrets on a scheduled basis
Use short-lived tokens when possible
Automate credential renewal workflows
Maintain versioned secret histories for rollback
Audit credential usage patterns

Frequent rotation limits the usefulness of stolen credentials in the event of a breach.

Secure Communication Channels

All integration traffic should be encrypted to prevent interception or tampering.

Use:

TLS/HTTPS for API communication
Syslog over TLS for log forwarding
Secure VPN tunnels for internal integrations
Strong cipher suites and modern TLS versions

Avoid legacy protocols that transmit data in plaintext.

Validate Third-Party Sources

Wazuh often ingests data from external intelligence feeds and APIs, which must be validated before use.

Validation includes:

Verifying data integrity
Filtering malformed or unexpected fields
Ensuring source authenticity
Cross-checking multiple intelligence providers
Rejecting suspicious or corrupted payloads

This reduces the risk of poisoning detection systems with unreliable data.

Audit Integration Activity

Regular auditing ensures integrations are functioning securely and as intended.

Audit logs should capture:

API access events
Authentication attempts
Configuration changes
Data ingestion patterns
Active Response executions
Failed requests and anomalies

Audit data is essential for forensic investigations and compliance reporting.

Restrict Administrative Access

Limiting administrative access reduces the risk of accidental misconfiguration or malicious activity.

Best practices include:

Role-based access control (RBAC)
Principle of least privilege
Multi-factor authentication (MFA)
Segregation of duties for security operations
Restricted API administration rights

Only authorized personnel should have the ability to modify integration configurations or access sensitive credentials.

Frequently Asked Questions (FAQ)

This section addresses common questions about Wazuh integrations, covering functionality, compatibility, security, and troubleshooting.

Question: What is Wazuh integration?

Wazuh integration refers to connecting Wazuh with external systems such as firewalls, cloud platforms, threat intelligence feeds, SIEM tools, and collaboration platforms to enhance security monitoring, automate responses, and enrich alerts with contextual information.

Question: Which tools can Wazuh integrate with?

Wazuh can integrate with a wide range of tools including:

Threat intelligence platforms (VirusTotal, MISP, OTX)
Firewalls and IDS/IPS systems
Cloud providers (AWS, Azure, GCP)
SIEM platforms (Splunk, OpenSearch, Elasticsearch)
Collaboration tools (Slack, Microsoft Teams, PagerDuty)
Microsoft services via Graph API

Question: Can Wazuh integrate with firewalls?

Yes. Wazuh can integrate with firewalls using Syslog forwarding or API-based ingestion. Firewall logs provide visibility into network traffic, blocked connections, VPN usage, and potential intrusion attempts.

Question: Does Wazuh support threat intelligence integrations?

Yes. Wazuh supports integration with multiple threat intelligence sources such as VirusTotal, AbuseIPDB, and MISP to enrich alerts with reputation data for IPs, domains, file hashes, and URLs.

Question: Can Wazuh integrate with Microsoft 365?

Yes. Wazuh can integrate with Microsoft 365 services using Microsoft Graph API to collect authentication logs, user activity data, security alerts, and cloud service events.

Question: Can Wazuh send alerts to external platforms?

Yes. Wazuh can send alerts to external systems using webhooks, APIs, Syslog, or custom integrations. Common destinations include Slack, Microsoft Teams, and PagerDuty.

Question: How do I troubleshoot Wazuh integration failures?

Troubleshooting typically involves:

Checking API connectivity
Verifying authentication credentials
Reviewing Wazuh logs
Validating decoders and rules
Confirming network connectivity
Testing end-to-end data flow

Most issues are caused by authentication errors, network misconfiguration, or API changes.

Question: Are Wazuh integrations secure?

Yes, when properly configured. Wazuh supports secure communication using TLS, API authentication, role-based access control, and encrypted log transmission. Security depends on correct configuration and adherence to best practices.

Question: Does Wazuh support REST APIs?

Yes. Wazuh provides a REST API that allows administrators to manage agents, query alerts, configure settings, and integrate with external automation or SOAR platforms.

Question: Can I create custom Wazuh integrations?

Yes. Wazuh supports custom integrations using scripts, APIs, active response modules, and log parsing rules. This allows organizations to extend functionality beyond built-in integrations.

Conclusion

Wazuh integrations are a foundational component of modern security operations, enabling organizations to unify endpoint monitoring, network visibility, cloud telemetry, and threat intelligence into a single cohesive security ecosystem.

Throughout this guide, we explored:

How Wazuh integrates with external systems using APIs, Syslog, webhooks, and active response mechanisms
Key integration architectures and data flow models
Threat intelligence enrichment workflows and common data sources
Integration with network security tools, log management platforms, and Microsoft services
Common challenges, best practices, and troubleshooting techniques
Performance monitoring and security considerations for long-term stability

When properly designed and maintained, Wazuh integrations significantly improve visibility across the entire infrastructure, enhance detection accuracy, and accelerate incident response through automation and enrichment.

For implementation details, refer to the dedicated tutorials linked throughout this guide:

A well-integrated Wazuh deployment transforms security monitoring from reactive alerting into a proactive, intelligence-driven defense system capable of adapting to evolving threats across the entire environment.