search

wazuh / wazuh-splunk

Wazuh - Splunk App
https://wazuh.com
GNU General Public License v2.0
51 stars 27 forks source link
compliance file-integrity-management gdpr ids intrusion-detection log-analysis loganalyzer monitoring openscap ossec pci-dss policy-monitoring security security-awareness security-hardening splunk vulnerability-detection wazuh

readme

Splunk App for Wazuh

Slack Email Documentation Documentation

The Wazuh App for Splunk offers an option to visualize Wazuh Alerts and API data. Wazuh helps you to gain deeper security visibility into your infrastructure by monitoring hosts at an operating system and application level.

Overview

Documentation

Branches

Installation and Upgrade

Requirements

  1. A Wazuh Manager with a running and accesible API.
  2. A Splunk Universal Forwarder installed along with the Wazuh Manager.
  3. At least one Splunk Enterprise Indexer.

Using the Web User Interface (WUI)

  1. Download the App package that matches your installation (Wazuh and Splunk version, check the Compatibilty Matrix).
  2. Go to the Splunk WUI main page and click on the gear icon (Manage Apps), at the sidebar.
  3. Click on the Install App from file button.
  4. Select and upload the downloaded App package.
  5. Check the Upgrade App checkbox if a Wazuh App is already installed.
  6. Click on Upload. A restart of the Indexer may be required.

Using the Command Line Interface (CLI)

  1. Download the App package that matches your installation (Wazuh and Splunk version, check the Compatibilty Matrix).

  2. If an older App is already installed, remove it using the Splunk binary:

    $SPLUNK_HOME/bin/splunk remove app SplunkAppForWazuh

  3. Install the App:

    $SPLUNK_HOME/bin/splunk install app <downloaded_package>

Compatibility Matrix

The compatibility matrix is avaliable in the repository wiki.

Contribute

If you want to contribute to our project please don't hesitate to send a pull request. You can also join our users mailing list, by sending an email to mailto:wazuh+subscribe@googlegroups.com, to ask questions and participate in discussions.

Copyright & License

Copyright (C) 2015-2022 Wazuh, Inc.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

Find more information about this on the LICENSE file.

References