ilert Wazuh Alerting Plugin

• Wazuh Manager installed and running
• Python 3 installed on the Wazuh server
• Python requests module installed:

  pip3 install requests

• The ilert integration key from the previous step

Clone the ilert-wazuh repository on your Wazuh Manager:

git clone https://github.com/iLert/ilert-wazuh.git
cd ilert-wazuh

cp custom-ilert /var/ossec/integrations/custom-ilert

chmod 750 /var/ossec/integrations/custom-ilert
chown root:wazuh /var/ossec/integrations/custom-ilert

Edit /var/ossec/etc/ossec.conf and add the following inside the <ossec_config> block. Replace INTEGRATION_KEY with your ilert integration key:

<integration>
  <name>custom-ilert</name>
  <api_key>INTEGRATION_KEY</api_key>
  <hook_url>https://api.ilert.com/api/v1/events/wazuh/INTEGRATION_KEY</hook_url>
  <level>3</level>
  <alert_format>json</alert_format>
</integration>

The <api_key> field is required by Wazuh but is not used in the payload, since the integration key is already part of the <hook_url>.

The <level> option defines the minimum alert level that triggers the integration. Only alerts at or above this level are forwarded to ilert. The value must be equal to or greater than the <log_alert_level> in your <alerts> configuration — alerts below <log_alert_level> are not written to the alerts log and will never reach the integration.

systemctl restart wazuh-manager

Trigger a test alert:

systemd-cat -t sshd <<< "Failed password for invalid user admin from 192.168.1.100 port 22 ssh2"

Check the logs:

tail -f /var/ossec/logs/alerts/alerts.json
tail -f /var/ossec/logs/integrations.log

To enable debug logging, add debug to the integration options:

<integration>
  <name>custom-ilert</name>
  <api_key>INTEGRATION_KEY</api_key>
  <hook_url>https://api.ilert.com/api/v1/events/wazuh/INTEGRATION_KEY</hook_url>
  <level>3</level>
  <alert_format>json</alert_format>
  <options>debug</options>
</integration>

Debug output is written to /var/ossec/logs/integrations.log.

The script maps the Wazuh rule level to an ilert event severity: