Wazuh

Integrate a Wazuh server with AiStrike to fetch alerts and monitor your environment.

Prerequisites

• Your Wazuh server is reachable from AiStrike IPs on port 9200.

• Login credentials for the Wazuh admin user.

• Allow the following AiStrike IPs in your firewall/security group:

3.135.165.25/32     3.148.24.98/32     52.15.138.222/32
13.201.28.59/32     3.148.93.249/32    3.14.192.137/32
18.223.178.199/32

Step 1: Log in

Open your Wazuh server web console and log in as administrator.

Step 2: Create an internal user

1. Go to Indexer Management → Security → Internal Users → Create Internal User.

2. Enter username Aistrike_user, set a strong password, leave other settings default, and click Create.

Step 3: Create a dedicated role

Go to Roles, open readall_and_monitor, click Duplicate Role, and name it readall_and_monitor_copy_aistrike. Then assign:

• Cluster permissions:cluster_monitor, cluster_composite_ops_ro

• Index permissions: index = *; permissions = read, indices_monitor, get, search

• Tenant permissions: tenant = global_tenant; permission = Read Only

Click Save.

Step 4: Map the user to the role

Open readall_and_monitor_copy_aistrike, go to Mapped Users → Manage Mapped Users, add Aistrike_user, and save.

Step 5: Connector configuration