← KB

🛡️ Connecting Wazuh to Ayzal AI

Wazuh is an open-source security platform. Forward Wazuh alerts to Agentic SOC for AI-powered analysis.

📋 Prerequisites

  • An active Ayzal AI Agentic SOC Platform account with API key
  • Wazuh Manager 4.x+

Step 1: Get Your API Key

  1. Log into https://app.ayzalai.com
  2. Go to Settings → API Keys
  3. Generate or copy your API key

Step 2: Configure Wazuh Integration

Add this to your Wazuh manager ossec.conf:

<integration>
  <name>agentic-soc</name>
  <hook_url>https://api.ayzalai.com/api/integrations/wazuh</hook_url>
  <api_key>YOUR_API_KEY</api_key>
  <level>5</level>
  <group>syscheck,rootcheck,web</group>
</integration>

Step 3: Restart Wazuh Manager

systemctl restart wazuh-manager

✅ Result: Wazuh alerts at level 5+ will flow to Agentic SOC. Each alert is analyzed by our AI and enriched with threat intelligence.

⚠️ Make sure your API key has active status in Ayzal AI Agentic SOC Platform Settings.