Connect Wazuh SIEM

Import Wazuh agents and alerts into ThreatClaw through the skill-wazuh-connector skill

intermediate15 minUpdated 2026-06-12

Wazuh is an open-source SIEM that monitors your machines through agents installed on each host (Windows, Linux, macOS). It detects intrusions, changes to critical files, vulnerabilities (CVEs), rootkits and compliance drift.

ThreatClaw connects to the Wazuh Manager API to import your Wazuh agents as assets, then pulls security alerts from the Wazuh Indexer (OpenSearch) to create findings in its detection pipeline.

Wazuh-side prerequisites

  • Wazuh Manager reachable on the API port (55000 by default)
  • A Wazuh API account (read-only is enough; the default wazuh user works)
  • Optional but recommended: Wazuh Indexer (OpenSearch) reachable on port 9200. Without it, only agents are imported, no alerts.
Network

The connection goes out from ThreatClaw to Wazuh. Make sure TCP 55000 (Manager) and 9200 (Indexer) are reachable from the ThreatClaw host to your Wazuh.

Configure it in ThreatClaw

The Wazuh connector is a skill. All configuration happens in the Skills panel, not in a separate "Sources" menu.

  1. Open the ThreatClaw dashboard
  2. Go to Skills in the main menu
  3. Find Wazuh SIEM in the list (skill skill-wazuh-connector)
  4. Click Configure
  5. Fill in the fields below, then Enable the skill

ThreatClaw then syncs every 5 minutes and keeps a cursor so the same alert is never ingested twice.

Form fields

Wazuh Manager connection (required)

FieldTypeDefaultPurpose
urlstring,Wazuh Manager URL with port, e.g. https://192.168.1.10:55000
usernamestringwazuhAPI user. You can create a dedicated account in Wazuh → Security
passwordpassword,API password. The wazuh default must be changed in production
no_tls_verifybooleantrueSet to true if Wazuh uses a self-signed certificate (the usual case). Turn it off in production with a real cert

Indexer connection (optional, for alerts)

FieldTypeDefaultPurpose
indexer_urlstring,OpenSearch URL, e.g. https://192.168.1.10:9200. Without it, no alerts are ingested
indexer_usernamestringadminIndexer user
indexer_passwordpassword,Indexer password

Tuning the stream

FieldTypeDefaultPurpose
max_alertsnumber500Maximum batch size per 5-minute cycle. Beyond 500 in 5 minutes, the cursor resumes on the next cycle, nothing is lost
min_levelnumber7Minimum Wazuh level ingested (0-15). 7 filters out informational events and keeps intrusions, brute force and anomalies. Lower to 3-5 for more verbosity, raise to 10 for HIGH+ only
skip_rule_idsstring,Wazuh rule IDs to ignore, comma-separated, e.g. 1234,5678
skip_if_log_containsstring (JSON),Skip a rule IF its full_log contains a pattern. Format {"rule_id": "pattern"}, e.g. {"5104": "veth"}

Built-in noise filter

ThreatClaw silences by default three rule families known to emit 40 to 80 events per minute on any Docker host and to drown the real signal:

  • rule 5104 when full_log contains veth, Docker veth promiscuous noise
  • rule 80710 when full_log contains dev=veth, auditd veth promiscuous noise
  • all rules 80700-80799, Linux audit inventory events

These filters are not configurable; they apply automatically. You can add your own noise rules through skip_rule_ids and skip_if_log_contains.

Check that data is flowing

  1. Open Assets in the dashboard, your Wazuh agents appear within a few cycles, tagged with their agent version and OS.
  2. Open Findings, new Wazuh alerts above min_level come in, mapped onto the MITRE ATT&CK matrix whenever the Wazuh rule exposes a technique.
  3. Go back to Skills → Wazuh SIEM: the Sync cursor panel shows the timestamp of the last ingested event. If the cursor moves, the stream is running.

Pitfalls and limits

No indexer means no alerts

If you leave indexer_url empty, ThreatClaw imports agents as assets but ingests no alerts at all. This is pitfall number one: the connection looks "green" and yet no finding ever lands.

Replaying the last hour

If you fix an indexer corruption or want to test a detector, Skills → Wazuh SIEM → Reset cursor clears the sync position and the next cycle re-ingests the last hour.

  • min_level=7 is a deliberately conservative default. To see softer anomalies, drop to 5 · but expect more findings to triage.
  • The max_alerts=500 batch is a memory guard. Raise it and, if your Wazuh emits 5000 alerts in 5 minutes, ThreatClaw will use more RAM on the sync cycle.
  • Self-signed TLS: no_tls_verify=true is the default because the vast majority of Wazuh deployments run self-signed. In serious production, install a real certificate and switch it to false.