redanthrax/wazuh-teams-integration

Wazuh Teams Integration

Setup Teams

Setup the webhook connector in Teams for the channel where you want alerts posted.

Testing

Edit the webhookUrl in run.sh to test your webhook to Teams.

Alert Script

Copy the custom-teams and custom-teams.py file to /var/ossec/integrations/ Use the following commands to allow Wazuh to execute the file.

chmod 750 /var/ossec/integrations/custom-teams
chown root:wazuh /var/ossec/integrations/custom-teams
chmod 750 /var/ossec/integrations/custom-teams.py
chown root:wazuh /var/ossec/integrations/custom-teams.py

ossec.conf Configuration

Add the following integration configuration to ossec.conf via the web UI or direct. Replace WEBHOOK URL with the URL you generated from Teams. You can have multiple integration blocks in your ossec.conf. You can configure multiple options in the integration such as levels and rules. Refer to the following link for all options. It is important the integration name starts with "custom-" otherwise Wazuh will reject the integration.

Integrator Daemon Configuration

<integration>
  <name>custom-teams</name>
  <level>3</level>
  <hook_url>WEBHOOK URL</hook_url> 
  <alert_format>json</alert_format> 
</integration>

Make sure you save the configuration and use the Restart Manager button.

Verify

Trigger an alert in Wazuh and validate you're receiving them in Teams.

Troubleshooting

Use a combination of the ossec.log and microsoft-teams.log files located in the following directory:

/var/ossec/logs

Customize - Advanced

Browse to the following location to customize the card in custom-teams.py.

Card Designer

Be sure to follow the correct formatting when replacing content in the script.

wazuh-teams-integration's Issues

no teams notification

Hi,

I run the test script run.sh and I successfuly received the teams notification, however I don't receive any notification from wazuh alerts by having set the level to 3.

any idea?

Error "/var/ossec/: Is a directory"

Hey @redanthrax, any idea why I might be getting this error?

Sep 27, 2023 @ 11:13:50.000 wazuh-integratord ERROR Exit status was: 126
Sep 27, 2023 @ 11:13:50.000 wazuh-integratord ERROR Unable to run integration for custom-teams -> integrations
Sep 27, 2023 @ 11:13:50.000 wazuh-integratord ERROR While running custom-teams -> integrations. Output: integrations/custom-teams: line 33: /var/ossec/: Is a directory

Thanks!