Collect Wazuh logs

Overview

This Wazuh parser ingests SYSLOG and JSON formatted logs, normalizes fields into a common format, and enriches them with Wazuh-specific metadata. It then uses a series of conditional statements based on the event_typeand rule_idfields to map the raw log data to the appropriate UDM event type and fields, handling various log formats and edge cases within the Wazuh ecosystem.

Before you begin

Ensure that you have the following prerequisites:

• Google SecOps instance.
• Active Wazuh instance.
• Privileged access to Wazuh configuration files.

Set up feeds

To configure a feed, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed namefield, enter a name for the feed; for example, Wazuh Logs.
5. Select Webhookas the Source type.
6. Select Wazuhas the Log type.
7. Click Next.
8. Optional: specify values for the following input parameters:
   • Split delimiter: the delimiter that is used to separate log lines, such as \n .
9. Click Next.
10. Review the feed configuration in the Finalizescreen, and then click Submit.
11. Click Generate Secret Keyto generate a secret key to authenticate this feed.
12. Copy and store the secret key. You cannot view this secret key again. If needed, you can regenerate a new secret key, but this action makes the previous secret key obsolete.
13. On the Detailstab, copy the feed endpoint URL from the Endpoint Informationfield. You need to specify this endpoint URL in your client application.
14. Click Done.

Create an API key for the webhook feed

1. Go to **Google Cloud console > Credentials.

   Go to Credentials

2. Click Create credentials, and then select API key.

3. Restrict the API key access to the Google Security Operations API.

Specify the endpoint URL

1. In your client application, specify the HTTPS endpoint URL provided in the webhook feed.

2. Enable authentication by specifying the API key and secret key as part of the custom header in the following format:

    X-goog-api-key = API_KEY 
   X-Webhook-Access-Key = SECRET 
    
   

   Recommendation: Specify the API key as a header instead of specifying it in the URL. If your webhook client doesn't support custom headers, you can specify the API key and secret key using query parameters in the following format:

     ENDPOINT_URL 
   ?key= API_KEY 
   &secret= SECRET 
    
   

Replace the following:

• ENDPOINT_URL : the feed endpoint URL.
• API_KEY : the API key to authenticate to Google Security Operations.
• SECRET : the secret key that you generated to authenticate the feed.

Configure Wazuh Cloud Webhook

Complete the following steps to configure Wazuh Cloud Webhook:

1. Sign in to your Wazuh Cloud.
2. Go to Settings, located in the left pane menu under Server management.
3. Click the Edit configuration.

4. Add the following integration block within the <integration> section of the configuration.

   • If the section doesn't exist, copy the entire block with <integration> to create one.
   • Replace the placeholder values with your actual Google SecOps details:

 <integration>  
<name>google-chronicle</name>  
<hook_url>https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs?key=<API_KEY>&secret=<SECRET></hook_url>  
<alert_format>json</alert_format>  
<level>0</level>  
<!--  
Adjust  
the  
level  
as  
needed  
-->
</integration> 

• CHRONICLE_REGION : Your Google SecOps region (for example, us , europe-west1 ).
• GOOGLE_PROJECT_NUMBER : Your Google Cloud project number.
• LOCATION : Your Google SecOps region (for example, us , europe-west1 ).
• CUSTOMER_ID : Your Google SecOps customer ID.
• FEED_ID : The ID of your Google SecOps feed.
• API_KEY : The API Key of your Google Cloud that hosts Google SecOps.
• SECRET : The Secret of your Google SecOps feed.
• alert_format : Set to json for Google SecOps compatibility.
• level : Specifies the minimum alert level to be forwarded. 0 sends all alerts.

1. Click Savebutton.
2. Click Restart wazuh-manager.

Configure Wazuh On-Premise Webhook

Complete the following steps to configure Wazuh On-Premise Webhook:

1. Access your on-premise Wazuh manager.
2. Go to /var/ossec/etc/ directory.
3. Open the ossec.conf file using a text editor (for example, nano , vim ).

4. Add the following integration block within the <integration> section of the configuration.

   • If the section doesn't exist, copy the entire block with <integration> to create one.
   • Replace the placeholder values with your actual Google SecOps details:

    <integration>  
   <name>google-chronicle</name>  
   <hook_url>https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs?key=<API_KEY>&secret=<SECRET></hook_url>  
   <alert_format>json</alert_format>  
   <level>0</level>  
   <!--  
   Adjust  
   the  
   level  
   as  
   needed  
   -->
   </integration> 
   

   • CHRONICLE_REGION : Your Google SecOps region (for example, us , europe-west1 ).
   • GOOGLE_PROJECT_NUMBER : Your Google Cloud project number.
   • LOCATION : Your Google SecOps region (for example, us , europe-west1 ).
   • CUSTOMER_ID : Your Google SecOps customer ID.
   • FEED_ID : The ID of your Google SecOps feed.
   • API_KEY : The API Key of your Google Cloud that hosts Google SecOps.
   • SECRET : The Secret of your Google SecOps feed.
   • alert_format : Set to json for Google SecOps compatibility.
   • level : Specifies the minimum alert level to be forwarded. 0 sends all alerts.

5. Restart Wazuh manager to apply the changes:

    sudo  
   systemctl  
   restart  
   wazuh-manager 
   

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.