Skip to content
Documentation

Wazuh SIEM Integration

Overview

In the rapidly evolving world of cybersecurity, it's crucial to harness every tool in our arsenal to guard against threats, particularly social engineering attacks. This document details how to integrate Wazuh, a powerful Security Information and Event Management (SIEM) system, with ChallengeWord, the leader in social engineering protection.


Requirements

  • Wazuh server (latest version recommended)
  • ChallengeWord Business account with administrative access


Step 1: Create a Rules File in Wazuh

  • Navigate to your Wazuh manager’s rules directory.

Greenshot 2024-04-28 14.45.49

  • Create a new rules file

Greenshot 2024-04-28 14.46.42

  • Use the following template and customize if needed.
  • Take note of the "integration" field value. We'll need that later.
 

Filename: challengeword.xml

<group name="challengeword,">
    <rule id="99999" level="10">
        <decoded_as>json</decoded_as>
        <field name="integration">ChallengeWord</field>
        <description>ChallengeWord alert.</description>
    </rule>
</group>

Greenshot 2024-04-28 14.47.28


Step 2: Establish API Access in Wazuh

  • Create a new API user specifically for ChallengeWord integration, ensuring proper permissions are set for event submission.

 Greenshot 2024-04-28 15.14.49


Step 3: Configure ChallengeWord

  • Log into your ChallengeWord portal.
  • Navigate to:
    • Settings
    • Incident Management
    • SIEM Integrations
  • Click the "Add SIEM Integration" and select "Wazuh"
  • Enter your Host (IP or FQDN) and update your Username & Password

Greenshot 2024-04-28 15.27.51 

  • The first field of Event Data, "integration = ChallengeWord" must match the field from "challengeword.xml" created in Wazuh:

<field name="integration">ChallengeWord</field>

Greenshot 2024-04-28 15.49.49

  • Wazuh receives event information as a Json object containing an "events" array of Json string data. ChallengeWord's Wazuh template is pre-configured and no changes to the section should be necessary.
  {
  "events": [
    "{eventDataAsJsonString}"
  ]
}

Greenshot 2024-04-28 15.50.18


Step 4: Test and Validate

  • After setting up the integration, perform a test to ensure that the events from ChallengeWord are correctly being sent to and processed by Wazuh.
  • ChallengeWord provides a "Test Pre-Auth" button and a "Test Event Submission" button for testing purposes.
  • Verify that the events appear in the Wazuh dashboard and that alerts are generated according to the configured rules.


Troubleshooting

  • Ensure that the Wazuh's API port is accessible from the internet.
  • Verify API credentials and permissions if ChallengeWord is unable to connect to the Wazuh server.
  • Check the rules file for syntax errors if events are not triggering alerts as expected.

By following these steps, you can effectively integrate ChallengeWord with Wazuh, enhancing your ability to detect and respond to social engineering threats.