🛡️

Connecting Wazuh to Ayzal AI

Wazuh is an open-source security platform. Forward Wazuh alerts to Agentic SOC for AI-powered analysis and threat intelligence enrichment.

📋 Prerequisites

  • An active Ayzal AI Agentic SOC Platform account with API key
  • Wazuh Manager 4.x or higher

1 Get Your API Key

  1. Log into https://app.ayzalai.com
  2. Go to Settings → API Keys
  3. Generate or copy your API key

2 Configure Wazuh Integration

Add this configuration to your Wazuh manager ossec.conf file:

<integration>
  <name>agentic-soc</name>
  <hook_url>https://api.ayzalai.com/api/integrations/wazuh</hook_url>
  <api_key>YOUR_API_KEY</api_key>
  <level>5</level>
  <group>syscheck,rootcheck,web</group>
</integration>

3 Restart Wazuh Manager 

systemctl restart wazuh-manager

✅ Result: Wazuh alerts at level 5 and above will flow to Agentic SOC. Each alert is analyzed by our AI and enriched with threat intelligence.

⚠️ Make sure your API key has active status in Ayzal AI Agentic SOC Platform Settings.