Wazuh integration — overview
Enrich Wazuh alerts with Whisper infrastructure context on every external indicator, and optionally bring your own agents' DNS and egress activity into Wazuh.
On this page (7)
Wazuh integration — overview Documentation
The connector adds a Whisper enrichment alert beside any Wazuh alert that carries a public IP or domain. It ships today, it installs from GitHub releases, and its primary mode needs no API key.
Key concepts: Threat Intelligence, Indicator of Compromise, Reconciled Verdict.
What you get
Every alert in a trigger group you choose is scanned for external indicators. For each one, the connector queries WhisperGraph and injects a new alert alongside the original, nested under data.whisper.* — the same shape Wazuh's in-tree VirusTotal and Maltiverse integrations use. Your original alert is untouched, the enrichment appears in the native Alerts view, and the two correlate in the dashboard.
There is a second, opt-in direction: the agent-activity log source brings your own tenant's agent DNS, egress and identity activity into Wazuh as a log source.
The two modes, and which one needs a key
There are two modes and they have different requirements, so read this before you get a key.
Per-alert enrichment is keyless. The connector queries the graph with no API key. Every alert in a trigger group carrying a public IP or domain gets an enrichment alert alongside it, and you can run the whole integration this way indefinitely.
The keyed mode is two extra things: the on-demand investigation CLI, and the opt-in agent-activity log source (install.sh --logs), which brings your tenant's own agent DNS, egress and identity activity into Wazuh. Both read data that belongs to your account, which is why they need a key.
Get one in the console.
Supported indicator types
IPv4, IPv6 and domain names, pulled from one maintained table of dotted alert-field paths — srcip, dstip, src_ip, dst_ip, dest_ip and their siblings — each carrying a type hint.
Two rules the extractor applies before anything reaches Whisper:
- Non-global IPs are skipped. RFC1918 and loopback addresses never leave your manager.
ip:portand[ipv6]:portsuffixes are stripped, and IPv4-mapped IPv6 (::ffff:a.b.c.d) is unwrapped to the embedded IPv4 first.
What Whisper never receives
Whisper receives the external indicator from the alert — an IP address or a domain name — and nothing else. It does not receive the alert body, the agent name, the user, the file path, the process, or any host telemetry, because Whisper has no schema, transport or collector for any of those. The direction of travel is one-way by construction: Whisper enriches your alert; your alert does not enrich Whisper.
See the Privacy Policy for how Whisper handles what it receives.
Verified platform versions
Verified end-to-end on Wazuh 4.14.5. The connector runs on a Wazuh manager on the 4.x line and needs root on that host.
Where it comes from
The connector is distributed from GitHub releases: a one-line installer, a tarball, and .deb / .rpm packages. See Install the Wazuh integration.
Install it
- Install the Wazuh integration — three paths, and how to verify enrichment is firing
- Configure the Wazuh integration — trigger groups, the envelope, and the verdict gates