-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Security Monitoring with Wazuh
By :

Shuffle SOAR is capable of automating multiple security operation activities. When it comes to managing the Wazuh manager and its agent, there is a manual element where a security analyst has to manually add/remove/modify different attributes. The good news is that Wazuh provides a Wazuh API to allow a trusted party to communicate and send required data. In this section, we will remotely manage multiple Wazuh-related tasks, such as managing agents, rules, CDB lists, agent groups, and decoders. We will cover the following topics in this section:
To remotely manage Wazuh using Shuffle SOAR, we need to set up three things – authentication, JWT token generation, and subsequent API requests.
In order to allow Shuffle to talk to the Wazuh manager, Shuffle initiates the authentication process by providing valid authentication. The default credential of the Wazuh API is...