Wazuh
Outputs data to the Wazuh indexer for search and analysis. Writes over the Wazuh indexer's OpenSearch-compatible bulk API.
Requirements
To use the Wazuh output connector, you need to ensure the following prerequisites are met:
-
Wazuh indexer: A running Wazuh indexer and its API endpoint (port
9200by default). This connector targets the Wazuh indexer — the storage and search tier — not the Wazuh server/manager. See What this connector does and does not do. -
Network access: The indexer API must be reachable from Monad. If it sits behind a firewall or IP allowlist, add Monad's egress IP addresses.
-
Indexer user: A Wazuh indexer user with permission to create and write to the target index, including bulk indexing operations.
-
TLS: The connection is always HTTPS. A default Wazuh install presents a self-signed certificate, so you will usually need to supply the indexer's CA certificate via the CA Certificate secret. See TLS and certificate verification.
What this connector does and does not do
Records written by this connector go directly to the Wazuh indexer. They do not pass through the Wazuh server's decoders and ruleset, which means they:
- do not trigger Wazuh rules or generate Wazuh alerts
- do not receive rule levels, rule descriptions, or MITRE ATT&CK enrichment
- do not appear in the Wazuh dashboard's Security Events views
They are, however, fully searchable — visible in Discover and usable in dashboards and visualizations through an index pattern for your index.
Write to a dedicated index of your own. Wazuh's wazuh-alerts-* indices are managed by the Wazuh server and expect an alert schema this connector does not produce; writing to them directly is not supported by Wazuh.
Functionality
-
Batch processing: Records are accumulated and delivered in batches for efficient handling of high volumes.
-
Bulk indexing: Batches are written using the bulk API, avoiding the overhead of per-document requests.
-
Dynamic index creation: If the configured index does not exist, the connector creates it and field mappings are generated dynamically from your data.
-
Verified TLS: Server certificates are verified, including against a private or self-signed CA when one is supplied.
Example record as stored:
Code
Configuration
The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.
Settings
| Setting | Type | Required | Description |
|---|---|---|---|
| URL | string | Yes | The URL of the Wazuh indexer API (must start with https). |
| Username | string | Yes | A Wazuh indexer user with write permissions on the target index. |
| Index | string | Yes | The index to write to. Use a dedicated index rather than Wazuh's own wazuh-alerts-* indices. |
| Insecure Skip Verify | boolean | No | Whether to skip TLS certificate verification (not recommended for production; supply a CA Certificate instead to verify a self-signed indexer). |
Secrets
| Secret | Type | Required | Description |
|---|---|---|---|
| Password | string | Yes | The password for the Wazuh indexer user. |
| CA Certificate | string | No | CA certificate in PEM format used to verify the Wazuh indexer's certificate. Required unless the indexer presents a publicly-trusted certificate. Trusted in addition to the public CAs, and cannot be combined with Insecure Skip Verify. |
TLS and certificate verification
How the indexer's certificate is verified depends on who issued it:
- Issued by a public CA — nothing to configure. The certificate is verified against the system trust store, and CA Certificate can be left empty.
- Self-signed or issued by a private/internal CA — the default for a Wazuh install. Paste that CA's certificate, in PEM format, into the CA Certificate secret.
On a default Wazuh Docker deployment the CA is at config/wazuh_indexer_ssl_certs/root-ca.pem. Supply the CA certificate, not the indexer's own certificate — verification works by chaining the server certificate up to a trusted CA.
Code
The URL must match the certificate
The hostname in your URL must appear as a Subject Alternative Name (SAN) on the indexer's certificate. A default Wazuh certificate is issued for wazuh.indexer only, so pointing the connector at any other hostname — including a public one — requires reissuing the indexer certificate with that name included.
A mismatch fails with an error naming the hostname rather than the certificate, which can read as an unrelated problem. To check what a certificate claims:
Code
Insecure Skip Verify
Insecure Skip Verify disables certificate verification entirely. The connection is still encrypted, but Monad no longer confirms which server it is talking to — anything able to intercept the connection can present its own certificate and read or modify the data, including the credentials sent with every request. Use it only for local testing, and supply a CA Certificate instead for any real deployment.
Setting both CA Certificate and Insecure Skip Verify is rejected as a configuration error, since skipping verification would silently ignore the CA.