AiStrike Documentation
AiStrike Documentation
Breadcrumbs

AiStrike - Wazuh Integration

This guide explains how to integrate a customer's Wazuh server with AiStrike to fetch alerts and monitor your environment.◼︎

Prerequisites

  1. The Customer Wazuh server must be reachable from AiStrike IPs on port 9200.

  2. Allow the following AiStrike IP addresses in your firewall/security group:

3.135.165.25/32
3.148.24.98/32
3.148.93.249/32
3.14.192.137/32
13.201.28.59/32
18.223.178.199/32
52.15.138.222/32
54.246.180.34/32
63.35.37.74/32
54.220.227.162/32

  1. Login credentials for the Wazuh admin user.

Step 1: Log in to the Wazuh Server

  1. Open your Wazuh server web console.

  2. Log in as administrator.

Step 2: Create an Internal User for AiStrike

  1. Navigate to Indexer Management → (Left-hand side hamburger menu icon) → Security.

    image-20260910-095823.png

  2. Click Internal Users → Create Internal User.

  3. Enter the following:

    • Username: Aistrike_user

    • Password: Set a strong password

    • Leave other settings as the default.

  4. Click Create.

    image-20260910-095905.png

Step 3: Create a Dedicated Role for AiStrike

  1. Go to Roles → find readall_and_monitor → click on it.

  2. Click Duplicate Role → name it: readall_and_monitor_copy_aistrike.

    image-20260910-095925.png

Step 3a: Assign Cluster Permissions

Permission:

  • Cluster_monitor

  • Cluster_composite_ops_ro

Step 3b: Assign Index Permissions

  • Index = *

  • Permissions = read, indices_monitor, get, search

Step 3c: Assign Tenant Permissions

  • Tenant = global_tenant

  • permission = Read Only

  • Click Save.

    image-20260910-095951.png

Step 4: Map AiStrike User to Role

  1. Open the newly created role: readall_and_monitor_copy_aistrike.

  2. Navigate to Mapped Users → click Managed Mapped User.

  3. Add the Aistrike_user created earlier.

  4. Save the mapping.

    image-20260910-100006.png

Step 5: Share Credentials with AiStrike

  • Provide the following credentials to AiStrike, or add them in the AiStrike app:

    • Username: Aistrike_user

    • Password: (The strong password you set)

Required attributes:

  • Wazuh Indexer URL: https://<your-wazuh-server>:9200

  • Username

  • Password

  • ElasticSearch/Opensearch Port: default 9200