Remotely managing Wazuh
Shuffle SOAR is capable of automating multiple security operation activities. When it comes to managing the Wazuh manager and its agent, there is a manual element where a security analyst has to manually add/remove/modify different attributes. The good news is that Wazuh provides a Wazuh API to allow a trusted party to communicate and send required data. In this section, we will remotely manage multiple Wazuh-related tasks, such as managing agents, rules, CDB lists, agent groups, and decoders. We will cover the following topics in this section:
- Requirements
- Managing Wazuh agents
Requirement
To remotely manage Wazuh using Shuffle SOAR, we need to set up three things – authentication, JWT token generation, and subsequent API requests.
Authentication
In order to allow Shuffle to talk to the Wazuh manager, Shuffle initiates the authentication process by providing valid authentication. The default credential of the Wazuh API is...
