---
title: "Configure integration with Wazuh SIEM system"
sidebar_label: "Configure integration with Wazuh"
sidebar_position: 2
description: "How to configure integration with Wazuh SIEM system"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'
import GetScript from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/audit-logs/get-script.mdx'

# Configure integration with Wazuh SIEM system

1. If you do not have a Wazuh server installed, [install it](#set-up-wazuh).
2. [Create a service user](#create-service-user).
3. [Generate an IAM token for the account](#create-iam-token-account-scoped).
4. [Get the script for exporting audit logs](#get-script).
5. [Configure and run the script](#configure-and-start-script).
6. [Configure audit log ingestion in Wazuh](#configure-log-ingestion-in-wazuh).

## 1. Install Wazuh server \{#set-up-wazuh}

You can install a Wazuh server from a distribution on any available server, or deploy a cloud server with Wazuh from a prepared image in the Control Panel.

<Tabs queryString="see-up-wazuh">
  <TabItem value="from-distributive" default>
    <TabItemLabel>
      Install from distribution
    </TabItemLabel>

    1. Open the CLI.
    2. Install the Wazuh server:

       ```bash
       curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
       ```

       Learn more about installing a Wazuh server from a distribution in the [Quickstart](https://documentation.wazuh.com/current/quickstart.html) section of the official Wazuh documentation.
  </TabItem>

  <TabItem value="from-image">
    <TabItemLabel>
      Install from a prepared image
    </TabItemLabel>

    Use the instructions in [Cloud server with Wazuh](/cloud-servers/applications/wazuh.mdx).
  </TabItem>
</Tabs>

## 2. Create a service user \{#create-service-user}

[Add a service user](/access-control/manage/add-user.mdx#add-service-user) with the [`audit_logs.admin`](/access-control/role-reference.mdx#audit-logs-admin).

Users can be added by the [Account Owner](/access-control/user-types.mdx#account-owner) or users with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin).

## 3. Get an IAM token for the account \{#create-iam-token-account-scoped}

[Obtain an IAM token for the account](/api/authorization/#get-iam-token-account-scoped) for the service user you [created in step 2](#create-service-user).

## 4. Get the script for exporting audit logs \{#get-script}

<GetScript />

## 5. Configure and run the script \{#configure-and-start-script}

1. Open the CLI.

2. Create a virtual environment:

   ```bash
   python3 -m venv .venv
   ```

3. Activate the virtual environment:

   ```bash
   source .venv/bin/activate
   ```

4. Navigate to the script directory:

   ```bash
   cd auditlog-integration
   ```

5. Install the required dependencies:

   ```bash
   pip3 install -r requirements.txt
   ```

6. Create a configuration file `.env`:

   ```bash
   touch .env
   ```

7. Open the configuration file `.env`:

   ```bash
   nano .env
   ```

8. Fill in the configuration file `.env`:

   8.1. Add a block with authentication parameters for the Audit Logs service API:

   ```bash
   AUDIT_LOGS_URL=<base_url>/v1/logs
   USERNAME=<username>
   PASSWORD=<password>
   ACCOUNT_ID=<account_id>
   ```

   Specify:

   * `<base_url>` — the URL for accessing the audit logs API in the required pool. You can view the list of URLs in the [Audit Logs](/api/urls/#audit-logs) subsection of the [URL List](/api/urls/) guide;
   * `<username>` — the name of the service user you [created in step 2](#create-service-user);
   * `<password>` — the service user password. If the password contains any of the characters `[` `]` `\` `^` `$.` `|?` `*` `+` `()`, escape them by placing a backslash before the character `\`;
   * `<account_id>` — account ID, which can be found in the [Control Panel](https://my.selectel.ru/) in the top right corner.

   8.2. Задайте тип транспорта `file` для экспорта аудит-логов in файл:

   ```bash
   TRANSPORT_TYPE=file
   ```

   8.3. Set the API request interval:

   ```bash
   POLL_INTERVAL=<poll_interval>
   ```

   Specify `<poll_interval>` — the interval for API requests in seconds (defaults to 30).

   8.4. Выйдите из файла with сохранением, для этого последовательно нажмите **Ctrl+X** → **Y** → **Enter**.

9. Run the script:

   ```bash
   python3 main.py
   ```

## 6. Configure audit log reception in Wazuh \{#configure-log-ingestion-in-wazuh}

1. Add the path to the audit log export file to Wazuh. To do this, in the main configuration file `/var/ossec/etc/ossec.conf` in the `<ossec_config>` block, add the following entry:

   ```bash
   <localfile>
       <log_format>json</log_format>
       <location><path></location>
   </localfile>
   ```

   Укажите `<path>` — the path to the audit log file. By default, files are saved in the script folder as `events.txt`. You can change the file name; to do this, in the script folder, in the `savers.py` file, within the `class FileSaver` block, change the value in the `self.filename`.

2. Add a new rule to Wazuh to display the uploaded events. To do this, in the `/var/ossec/etc/rules/local_rules.xml` file, add the following entry:

   ```bash
   <group name="audit_logs">
       <rule id="100001" level="3">
       <decoded_as>json</decoded_as>
       <description>Audit log event from Selectel</description>
       <field name="event_type">audit_logs.audit_logs.download</field>
       <options>no_full_log</options>
       <group>audit_logs</group>
       </rule>
   </group>
   ```

   Where:

   * `group name="audit_logs"` — rule group name;
   * `rule id="100001"` — unique rule identifier;
   * `level="3"` — event criticality level;
   * `<decoded_as>json</decoded_as>` — indicates that the event should be recognized as JSON;
   * `<description>Audit log event from Selectel</description>` — event description in the Wazuh interface;
   * `<field name="event_type">audit_logs.log.download</field>` — condition for rule triggering based on the `event_type`;
   * `<options>no_full_log</options>` — disables saving the full event text in the alert;
   * `<group>audit_logs</group>` — additional group that the event is included in after the rule triggers.

3. Optional: check if the rule works:

   3.1. Open the CLI.

   3.2. Pass the contents of the audit log file as input to the `/var/ossec/bin/wazuh-logtest`:

   ```bash
   cat /var/ossec/logs/audit.log | /var/ossec/bin/wazuh-logtest
   ```

   The response will show the event parsing result in JSON format, for example:

   ```bash
   **Phase 1: Completed pre-decoding.
   **Phase 2: Completed decoding.
       name: 'json'
       event_id: 'ed253073-75ea-4563-919a-f01427f5a4a8'
       event_saved_time: '2025-12-09T11:43:14Z'
       event_time: '2025-12-09T11:42:22Z'
       event_type: 'audit_logs.log.download'
       request.remote_address: '185.55.58.180'
       request.type: 'http'
       request.user_agent: 'Python/3.12 aiohttp/3.13.2'
       request_id: '9604fd73-2225-4946-85bf-c9a47fa6359f'
       resource.account_id: '517043'
       resource.details: 'null'
       resource.id: '517043'
       resource.new_values: 'null'
       resource.old_values: 'null'
       resource.type: 'audit_logs'
       schema_version: '1.0'
       source_type: 'audit_logs'
       status: 'success'
       subject.auth_provider: 'keystone'
       subject.authorized_by: '[]'
       subject.id: 'logs'
       subject.is_authorized: 'true'
       subject.type: 'user'
   ```

4. Restart the `wazuh-manager:` service:

   4.1. Open the CLI.

   4.2. Restart the service:

   ```bash
   systemctl restart wazuh-manager
   ```

5. In the Wazuh web interface, go to **Explore** → **Discover**.

6. In the search bar, specify the rule you created in step 2: `rule.id:100001`. Events from the Audit Logs service will be displayed in the Wazuh web interface.

<Formbricks />