What Cymph uses it for
Cymph connects to the Wazuh server API on your Wazuh manager for two purposes:- Detection rules — reads your ruleset and collects the MITRE ATT&CK tags on each rule, so a preset’s scope can be derived from what you actually detect. See Manage presets for the detection-based scope option.
- Assets — reads your enrolled agents and imports them as host assets. See Importing assets from Wazuh.
Requirements
The Wazuh server API listens on port 55000 by default and is separate from the Wazuh dashboard (port 443). Pointing the integration at the dashboard will fail the connection test.
Authentication
Cymph authenticates with the username and password against/security/user/authenticate and receives a short-lived JWT, which it uses for the rest of the session. Your credentials are used only to obtain that token; Cymph does not hold a Wazuh session open between operations.
Permissions
Cymph needs a Wazuh API user whose role grants read access to rules, agents and syscollector data. The built-in read-only role is the simplest option; if you build a custom role, these are the actions Cymph uses:
Cymph never writes to Wazuh — no rule, agent, or configuration is modified.
Reading the ruleset
Cymph reads the full ruleset in pages of 500 rules — the maximum the Wazuh API returns per request — and continues until every rule has been read. Custom rules at the end of the ruleset are included. Only rules carrying MITRE ATT&CK tags contribute to a detection-based scope; rules without them are read and ignored.Testing the connection
Test Connection authenticates against the instance and reports what it found:Every request Cymph makes to Wazuh times out after 5 seconds. If your manager sits behind a slow link or a firewall that drops rather than rejects, the result is a timeout rather than an error. If Cymph reaches your manager through a source-IP allowlist, confirm the egress addresses are permitted — see Networking.