Install the Wazuh integration
Three install paths — bootstrap script, tarball, or .deb/.rpm — on a Wazuh 4.x manager, and how to verify enrichment is firing.
On this page (9)
Install the Wazuh integration Documentation
All three methods run the same install.sh. Pick whichever fits your configuration management.
Requirements
- A Wazuh manager on the 4.x line, and root on that host. Verified end-to-end on 4.14.5.
- TLS egress to
graph.whisper.security. - An API key only if you want the keyed modes — the on-demand CLI or the agent-activity log source. Per-alert enrichment needs none.
Download
From the releases page, v1.1.0:
| Asset | For |
|---|---|
whisper-wazuh.tar.gz | the latest/download URL used by method B |
whisper-wazuh-1.1.0.tar.gz | the version-pinned tarball |
whisper-wazuh_1.1.0_all.deb | Debian / Ubuntu |
whisper-wazuh-1.1.0-1.noarch.rpm | RHEL family |
SHA256SUMS | checksum verification |
Warning: Method A pipes a script into
shas root.SHA256SUMSis published for exactly this reason — if that is a step your change process requires, use method B and verify the tarball before you run anything.
Method A — one-line bootstrap
curl -sSL https://raw.githubusercontent.com/whisper-sec/whisper-wazuh/main/bootstrap.sh \
| sudo sh -s -- --group sshd --api-key-file /path/to/your-whisper-key.txt
Drop --api-key-file entirely if you are running keyless.
Method B — the tarball, inspected first
curl -sSL https://github.com/whisper-sec/whisper-wazuh/releases/latest/download/whisper-wazuh.tar.gz | tar xz
cd whisper-wazuh-*
sudo sh install.sh --group sshd --api-key-file /path/to/your-whisper-key.txt
Method C — the .deb or .rpm package
sudo dpkg -i whisper-wazuh_1.1.0_all.deb # Debian/Ubuntu
sudo rpm -i whisper-wazuh-1.1.0-1.noarch.rpm # RHEL family
The package stages files to /usr/share/whisper-wazuh and adds a whisper-wazuh-install command. It does not auto-activate. Activation patches ossec.conf and restarts the manager, so it is a deliberate, separate admin step:
sudo whisper-wazuh-install --group sshd --api-key-file /path/to/your-whisper-key.txt
Containerised manager? Skip --api-key-file and inject WHISPER_API_KEY as a container-env secret instead.
What every method does
Pushes the indexer template, drops the files, patches ossec.conf with rollback, restarts the manager, and verifies.
Verify
grep whisper: /var/ossec/logs/integrations.log # expect invoke → api → emit
Then search data.whisper.ioc:<the IP> in the dashboard. A new enrichment alert appears next to the original one.
Note: Enrichment starts on the next alert in a trigger group that carries a public IP or domain. It does not backfill, so if the group is quiet, nothing is broken — generate an alert with an external indicator in it and look again.
Uninstall
integrations/whisper/uninstall.sh in the package removes it cleanly, reverting the ossec.conf patch.
Related
- Wazuh integration — overview — the two modes and what Whisper never receives
- Configure the Wazuh integration — trigger groups, the envelope and the verdict gates