Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add timeout and retries settings to integratord configuration #6442

Merged
merged 5 commits into from
Sep 8, 2023
Merged

Add timeout and retries settings to integratord configuration #6442

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ca480e9
Add timeout and retries settings to integratord configuration
TomasTurina Sep 6, 2023
df4f259
Reorder options in integratord page
TomasTurina Sep 7, 2023
f001337
Merge branch 'master' into 16488_improve_vt_script
TomasTurina Sep 7, 2023
7c95798
Remove reference not found to options tag
TomasTurina Sep 7, 2023
719275a
Improve language in integratord pages
TomasTurina Sep 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions source/user-manual/manager/manual-integration.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,12 @@ The integrations are configured on the Wazuh manager ``ossec.conf`` file. You ca
<level> </level>
<group> </group>
<event_location> </event_location>

<!-- Optional settings -->
<max_log> </max_log>
<options> </options>
<timeout> </timeout>
<retries> </retries>
</integration>


Expand All @@ -51,7 +56,14 @@ The following considerations must be taken into account when the filters are set
.. note::
It is recommended to carefully check the groups and rule identifiers mentioned above, as defining them incorrectly will result in expected alerts not being sent to the integration.

The full configuration reference for the Integrator daemon can be found :ref:`here <reference_ossec_integration>`.
You can find the full configuration reference for the Integrator daemon in the :ref:`Integration <reference_ossec_integration>` section of our Reference guide.

Optional settings
^^^^^^^^^^^^^^^^^

The `Integrator` daemon uses the `optional settings` fields to tailor the integration behavior.

You can find the full configuration reference for the Integrator daemon in the :ref:`Integration <reference_ossec_integration>` section of our Reference guide.

Slack
-----
Expand All @@ -74,7 +86,7 @@ To set up this integration, follow these steps.

.. note::

You can set a JSON object with customization fields using the :ref:`options <integration_options_tag>` tag. Visit the `Slack API reference <https://api.slack.com/reference/messaging/attachments#legacy_fields>`__ for information about available customization fields.
You can set a JSON object with customization fields using the ``options`` tag. Visit the `Slack API reference <https://api.slack.com/reference/messaging/attachments#legacy_fields>`__ for information about available customization fields.

#. Restart the Wazuh manager to apply the changes.

Expand Down Expand Up @@ -111,7 +123,7 @@ To set up this integration, do the following.

.. note::

You can set a JSON object with customization fields using the :ref:`options <integration_options_tag>` tag. Visit the `PagerDuty API reference <https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event>`__ for information about available customization fields.
You can set a JSON object with customization fields using the ``options`` tag. Visit the `PagerDuty API reference <https://developer.pagerduty.com/docs/ZG9jOjExMDI5NTgx-send-an-alert-event>`__ for information about available customization fields.

#. Restart the Wazuh manager to apply the changes.

Expand Down Expand Up @@ -179,7 +191,7 @@ To set up this integration, do the following.

.. note::

You can set a JSON object with customization fields using the :ref:`options <integration_options_tag>` tag. Visit the `Shuffle API reference <https://shuffler.io/docs/API>`__ for information about available customization fields.
You can set a JSON object with customization fields using the ``options`` tag. Visit the `Shuffle API reference <https://shuffler.io/docs/API>`__ for information about available customization fields.

#. Restart the Wazuh manager to apply the changes.

Expand Down
57 changes: 41 additions & 16 deletions source/user-manual/reference/ossec-conf/integration.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
.. Copyright (C) 2015, Wazuh, Inc.

.. meta::
:description: Learn how to configure the manager to connect Wazuh to external APIs. Check out the options, optional filters, and configuration examples.
:description: Learn how to configure the manager to connect Wazuh to external APIs. Check out the options, optional filters, optional settings, and configuration examples.

.. _reference_ossec_integration:

Expand Down Expand Up @@ -56,6 +56,19 @@ This is the key that you would have retrieved from the PagerDuty, VirusTotal, or
| **Allowed values** | PagerDuty/VirusTotal/Maltiverse Api key |
+--------------------+-----------------------------------------+

alert_format
^^^^^^^^^^^^

This writes the alert file in the JSON format, which the Integrator uses to fetch fields values.

+--------------------+-----------------------------------------------------------+
| **Default value** | n/a |
+--------------------+-----------------------------------------------------------+
| **Allowed values** | json |
+--------------------+-----------------------------------------------------------+

.. note:: Set this option as ``json`` for Slack, VirusTotal, Shuffle, and Maltiverse integrations.

Optional filters
----------------

Expand Down Expand Up @@ -103,18 +116,8 @@ This filters alerts by where the event originated.
| **Allowed values** | Any :ref:`sregex<sregex_os_match_syntax>` expression. |
+--------------------+--------------------------------------------------------------+

alert_format
^^^^^^^^^^^^

This writes the alert file in the JSON format. The Integrator makes use of this file to fetch fields values.

+--------------------+-----------------------------------------------------------+
| **Default value** | n/a |
+--------------------+-----------------------------------------------------------+
| **Allowed values** | json |
+--------------------+-----------------------------------------------------------+

.. note:: This option must be set to ``json`` for Slack, VirusTotal, Shuffle, and Maltiverse integrations.
Optional settings
-----------------

max_log
^^^^^^^
Expand All @@ -129,8 +132,6 @@ The maximum length of an alert snippet that will be sent to the Integrator. Lon

.. note:: This option only applies if ``alert_format`` is not set to ``json``.

.. _integration_options_tag:

options
^^^^^^^

Expand All @@ -142,6 +143,28 @@ This overwrites the previous fields or adds customization fields according to th
| **Allowed values** | json |
+--------------------+-----------------------------------------------------------+

timeout
^^^^^^^

The timeout (in seconds) to wait for a valid response from the external integration server.

+--------------------+-----------------------------------------------------------+
| **Default value** | 10 |
+--------------------+-----------------------------------------------------------+
| **Allowed values** | Any positive integer. |
+--------------------+-----------------------------------------------------------+

retries
^^^^^^^

On timeout, the maximum number of retry attempts for a request to the external integration server.

+--------------------+-----------------------------------------------------------+
| **Default value** | 3 |
+--------------------+-----------------------------------------------------------+
| **Allowed values** | Any positive integer. |
+--------------------+-----------------------------------------------------------+

Configuration example
---------------------

Expand Down Expand Up @@ -171,6 +194,8 @@ Configuration example
<api_key>API_KEY</api_key> <!-- Replace with your VirusTotal API key -->
<group>syscheck</group>
<alert_format>json</alert_format>
<timeout>30</timeout>
<retries>5</retries>
</integration>

<!-- Integration with Shuffle -->
Expand Down Expand Up @@ -199,4 +224,4 @@ Configuration example
<api_key>APIKEY</api_key> <!-- Replace with your external service API key -->
<alert_format>json</alert_format>
<options>{"data": "Custom data"}</options> <!-- Replace with your custom JSON object -->
</integration>
</integration>
Loading