# Wazuh

Outputs data to the Wazuh indexer for search and analysis. Writes over the Wazuh indexer's OpenSearch-compatible bulk API.

## Requirements

To use the Wazuh output connector, you need to ensure the following prerequisites are met:

1. **Wazuh indexer**: A running Wazuh indexer and its API endpoint (port `9200` by default). This connector targets the Wazuh **indexer** — the storage and search tier — not the Wazuh server/manager. See [What this connector does and does not do](#what-this-connector-does-and-does-not-do).

2. **Network access**: The indexer API must be reachable from Monad. If it sits behind a firewall or IP allowlist, add [Monad's egress IP addresses](/guides/egress-ip-addresses).

3. **Indexer user**: A Wazuh indexer user with permission to create and write to the target index, including bulk indexing operations.

4. **TLS**: The connection is always HTTPS. A default Wazuh install presents a **self-signed certificate**, so you will usually need to supply the indexer's CA certificate via the **CA Certificate** secret. See [TLS and certificate verification](#tls-and-certificate-verification).

## What this connector does and does not do

Records written by this connector go **directly to the Wazuh indexer**. They do not pass through the Wazuh server's decoders and ruleset, which means they:

- do **not** trigger Wazuh rules or generate Wazuh alerts
- do **not** receive rule levels, rule descriptions, or MITRE ATT&CK enrichment
- do **not** appear in the Wazuh dashboard's Security Events views

They are, however, fully **searchable** — visible in Discover and usable in dashboards and visualizations through an index pattern for your index.

Write to a dedicated index of your own. Wazuh's `wazuh-alerts-*` indices are managed by the Wazuh server and expect an alert schema this connector does not produce; writing to them directly is not supported by Wazuh.

## Functionality

1. **Batch processing**: Records are accumulated and delivered in batches for efficient handling of high volumes.

2. **Bulk indexing**: Batches are written using the bulk API, avoiding the overhead of per-document requests.

3. **Dynamic index creation**: If the configured index does not exist, the connector creates it and field mappings are generated dynamically from your data.

4. **Verified TLS**: Server certificates are verified, including against a private or self-signed CA when one is supplied.

Example record as stored:

```json
{
  "id": 1,
  "message": "This is a sample log message",
  "timestamp": "2026-07-30T12:34:56Z"
}
```

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| URL | string | Yes | The URL of the Wazuh indexer API (must start with https). |
| Username | string | Yes | A Wazuh indexer user with write permissions on the target index. |
| Index | string | Yes | The index to write to. Use a dedicated index rather than Wazuh's own `wazuh-alerts-*` indices. |
| Insecure Skip Verify | boolean | No | Whether to skip TLS certificate verification (not recommended for production; supply a CA Certificate instead to verify a self-signed indexer). |

#### Secrets

| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| Password | string | Yes | The password for the Wazuh indexer user. |
| CA Certificate | string | No | CA certificate in PEM format used to verify the Wazuh indexer's certificate. Required unless the indexer presents a publicly-trusted certificate. Trusted in addition to the public CAs, and cannot be combined with Insecure Skip Verify. |

## TLS and certificate verification

How the indexer's certificate is verified depends on who issued it:

- **Issued by a public CA** — nothing to configure. The certificate is verified against the system trust store, and **CA Certificate** can be left empty.
- **Self-signed or issued by a private/internal CA** — the default for a Wazuh install. Paste that CA's certificate, in PEM format, into the **CA Certificate** secret.

On a default Wazuh Docker deployment the CA is at `config/wazuh_indexer_ssl_certs/root-ca.pem`. Supply the **CA certificate**, not the indexer's own certificate — verification works by chaining the server certificate up to a trusted CA.

```
-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKl...
-----END CERTIFICATE-----
```

### The URL must match the certificate

The hostname in your **URL** must appear as a Subject Alternative Name (SAN) on the indexer's certificate. A default Wazuh certificate is issued for `wazuh.indexer` only, so pointing the connector at any other hostname — including a public one — requires reissuing the indexer certificate with that name included.

A mismatch fails with an error naming the hostname rather than the certificate, which can read as an unrelated problem. To check what a certificate claims:

```bash
openssl x509 -in config/wazuh_indexer_ssl_certs/wazuh.indexer.pem -noout -ext subjectAltName
```

### Insecure Skip Verify

**Insecure Skip Verify** disables certificate verification entirely. The connection is still encrypted, but Monad no longer confirms which server it is talking to — anything able to intercept the connection can present its own certificate and read or modify the data, including the credentials sent with every request. Use it only for local testing, and supply a CA Certificate instead for any real deployment.

Setting both **CA Certificate** and **Insecure Skip Verify** is rejected as a configuration error, since skipping verification would silently ignore the CA.