skills.rest
mbadali25
mbadali25COMMUNITY
Explore all skills by this author →
WebsiteGitHub

wazuh-onprem

Query, configure, and automate self-hosted Wazuh deployments across Server, Indexer, and Dashboard APIs.

2|Updated Jul 28, 2026
Search Tags:#alerting#opensearch#siem#security monitoring#wazuh#active response#ossec.conf
One-click install
npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill wazuh-onprem-mbadali25
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wazuh-onprem
Source: https://github.com/mbadali25/useful-claude-add-ons/tree/main/skills/wazuh-onprem
Command: npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill wazuh-onprem-mbadali25

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve? On-premises Wazuh exposes three separate APIs with different ports, credentials, and auth models, plus manager configuration that only exists in ossec.conf over SSH, making even routine tasks like searching alerts or adding a Slack integration error-prone without deep platform knowledge. ## Core Features & Use Cases - Unified API client: A Python helper handles JWT auth with automatic renewal, pagination, self-signed TLS, and OpenSearch queries against the Server API (55000), Indexer API (9200), and Dashboard saved-objects API (443). - Dashboards-as-code: Export and import Wazuh UI dashboards as ndjson for backup, migration, and version control, or aggregate alert data for standalone HTML reports. - Safe ossec.conf editing over SSH: Backup, diff, XML validation, config test, and automatic rollback when adding Slack/PagerDuty integrations, active-response runbooks, or Office 365 and Cloudflare log feeds. - Use Case: Ask to list all active agents, pull the last 24 hours of level-10+ alerts, then wire a PagerDuty integration for critical rules — the skill picks the right API, authenticates, and previews every change before applying it. ## Quick Start Connect to my Wazuh server and show me all high-severity alerts from the last 24 hours grouped by agent.

Frequently Asked Questions about wazuh-onprem

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query Wazuh alerts with the API?▼

Query the Wazuh Indexer API on port 9200 using OpenSearch Query DSL against the wazuh-alerts-* index pattern. Filter by timestamp, rule.level for severity, and agent.name, using basic auth with an indexer user rather than the Server API JWT.

How do I send Wazuh alerts to Slack or PagerDuty?▼

Add an integration block with the webhook URL or API key to ossec.conf on the manager, since there is no HTTP API for integrations on-prem. Apply it over SSH with backup, XML validation, and a config test, then restart the manager to activate it.

What is the difference between the Wazuh Server API and Indexer API?▼

The Server API on port 55000 manages agents, rules, decoders, and active response using JWT auth. The Indexer API on port 9200 is OpenSearch and holds the actual alert data, queried with basic auth and Query DSL.

Does Wazuh 5.x still support the syscollector inventory API?▼

No, Wazuh 5.0 removed the syscollector inventory endpoints along with Filebeat and legacy security-config APIs. Inventory data now lives in the Indexer as per-category data streams, so detect the version with GET / before choosing endpoints.

How do I back up or migrate Wazuh dashboards?▼

Export dashboards as ndjson through the Dashboard saved-objects API on port 443 using the _export endpoint with includeReferencesDeep, then import on another box with _import. Hand-authoring the ndjson breaks inter-object references, so build once in the UI and treat the export as source of truth.

Why does my Wazuh API call fail with a certificate verify error?▼

On-prem Wazuh uses a self-signed internal CA, so clients fail TLS verification by default. Point the WAZUH_CA_BUNDLE environment variable at the deployment's root-ca.pem to keep verification on instead of disabling it.

Related Skills

Explore More Software Engineering Skills→
NightreaverNightreaver
6

ssh_host_ping

Check TCP reachability and SSH handshake for a specified host.

Community
Basic
lloydchanglloydchang
2

incident-triage-automator

Aggregate alerts from monitoring systems and compute incident severity.

Community
Advanced
xalgordxalgord
954

hunting-for-spearphishing-indicators

Detect spearphishing campaigns by hunting indicators across email logs, endpoint telemetry, and network data.

Community
Intermediate
MHaggisMHaggis
471

Test Environment Builder

Build adversary emulation lab environments across Splunk, Elastic Security, and Microsoft Sentinel.

Community
Advanced