search

misje / opencti-wazuh-connector

OpenCTI–Wazuh connector looking for indicators in Wazuh and creating sightings
https://misje.github.io/opencti-wazuh-connector/
Apache License 2.0
15 stars 1 forks source link

connector state null #61

Open NaufalIhsan2002 opened 5 months ago

NaufalIhsan2002 commented 5 months ago

can anyone help me? my connector doesn't working Capture Capture2 is there something wrong with my configuration?

misje commented 5 months ago

Do you have anything that indicates that it isn't working? This is an enrichment connector, so it will only perform work when a new entity is ingested into your platform. Alternatively, you can enrich an entity manually (see the documentation in the Usage section).

The state field is not used for enrichment connectors. I believe they are only used by stream connectors, possibly other types.

I'll take this cause confusion into consideration when updating the manual.

NaufalIhsan2002 commented 5 months ago

i have try to manually enrich but i got this error. what should i do? Capture3 Capture 4JPG

misje commented 5 months ago

You most likely have a self-signed certificate in OpenSearch (which is the norm). You will have to skip TLS verification. See important settings in the documentation. The env. var. would be WAZUH_OPENSEARCH_VERIFY_TLS=false.

NaufalIhsan2002 commented 5 months ago

im sorry but can you help me one more time Capture5 do my manual enrichment working right? Capture6 i also have error like this

misje commented 5 months ago

Your last screenshot is not an error. Have a look in the documentation:

As for your errors in the previous runs, please provide information about what they say, and I will try to help.

NaufalIhsan2002 commented 5 months ago

Capture9 is it normal that the operations complete and total number of operation is 0? image i run docker compose logs -f --tail=100 connector-wazuh, and i got this.

im sorry for bothering you so much. i really want to learn this

misje commented 5 months ago

It appears that you are enriching indicators. As I pointed out earlier with the references to the documentation, enriching indicators only work if those indicators have relationships to observables, as there is no direct STIX indicator pattern support. The only workaround I can offer for now, is using automation to create these relationships automatically.

is it normal that the operations complete and total number of operation is 0?

It is if there is nothing for the connector to do, or if the indicator was not found in Wazuh. It only creates STIX objects when the search is performed, and results are found.

NaufalIhsan2002 commented 5 months ago

image image do i have to manually make incident or the connector make incident automatically?

i also trying to search for "Wazuh SIEM" in opencti and i can't found it. can you help me please?

misje commented 5 months ago

do i have to manually make incident or the connector make incident automatically?

Incidents are created depending on your configuration. See the documentation on the topic.

i also trying to search for "Wazuh SIEM" in opencti and i can't found it. can you help me please?

This is an identity of type system. You'll find this under "systems" in OpenCTI, and linked to in all incidents.