> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Wazuh

> Read Wazuh detection rules and enrolled agents to scope presets and import assets.

## What Cymph uses it for

Cymph connects to the **Wazuh server API** on your Wazuh manager for two purposes:

1. **Detection rules** — reads your ruleset and collects the MITRE ATT\&CK tags on each rule, so a preset's scope can be derived from what you actually detect. See [Manage presets](/how-tos/create-and-manage-presets) for the detection-based scope option.
2. **Assets** — reads your enrolled agents and imports them as host assets. See [Importing assets from Wazuh](/howto/asset_actions#importing-assets-from-wazuh).

All operations are **read-only**.

## Requirements

| Field        | Description                                                                                                                               |
| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
| **Name**     | A descriptive name for this instance                                                                                                      |
| **Base URL** | The address of the Wazuh server API, e.g. `https://localhost:55000`. This is the **API** port (55000 by default), not the Wazuh dashboard |
| **Username** | A Wazuh API user                                                                                                                          |
| **Password** | The password for that user                                                                                                                |

<Warning>
  The Base URL must not end with a trailing slash — the form rejects it.
</Warning>

<Info>
  The Wazuh server API listens on port **55000** by default and is separate from the Wazuh dashboard (port 443). Pointing the integration at the dashboard will fail the connection test.
</Info>

## Authentication

Cymph authenticates with the username and password against `/security/user/authenticate` and receives a short-lived JWT, which it uses for the rest of the session. Your credentials are used only to obtain that token; Cymph does not hold a Wazuh session open between operations.

## Permissions

Cymph needs a Wazuh API user whose role grants **read** access to rules, agents and syscollector data. The built-in read-only role is the simplest option; if you build a custom role, these are the actions Cymph uses:

| Purpose                                   | Wazuh API call                         | Read access needed on  |
| ----------------------------------------- | -------------------------------------- | ---------------------- |
| Test the connection                       | `POST /security/user/authenticate`     | — (any valid API user) |
| Read detection rules and their MITRE tags | `GET /rules`                           | Rules                  |
| List enrolled agents                      | `GET /agents`                          | Agents                 |
| Read agent OS details                     | `GET /syscollector/{agent_id}/os`      | Syscollector           |
| Read agent network addresses              | `GET /syscollector/{agent_id}/netaddr` | Syscollector           |

Cymph never writes to Wazuh — no rule, agent, or configuration is modified.

<Tip>
  Create a dedicated Wazuh API user for Cymph rather than reusing an administrator account. It keeps the access read-only and makes the integration's activity easy to identify in your Wazuh logs.
</Tip>

## Reading the ruleset

Cymph reads the full ruleset in pages of 500 rules — the maximum the Wazuh API returns per request — and continues until every rule has been read. Custom rules at the end of the ruleset are included.

Only rules carrying MITRE ATT\&CK tags contribute to a detection-based scope; rules without them are read and ignored.

## Testing the connection

**Test Connection** authenticates against the instance and reports what it found:

| Message                                         | Meaning                                                                                                               |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| **Valid Wazuh instance**                        | Authentication succeeded and the URL is a Wazuh API                                                                   |
| **Authorization failed**                        | The instance was reached but rejected the username or password                                                        |
| **Connection timed out**                        | No response within 5 seconds — check network reachability and any firewall or allowlist between Cymph and the manager |
| **Target does not seem to be a Wazuh instance** | Something answered, but not a Wazuh API — usually the dashboard URL or the wrong port                                 |

<Note>
  Every request Cymph makes to Wazuh times out after 5 seconds. If your manager sits behind a slow link or a firewall that drops rather than rejects, the result is a timeout rather than an error. If Cymph reaches your manager through a source-IP allowlist, confirm the egress addresses are permitted — see [Networking](/deployment/networking#egress-control).
</Note>

## Editing the integration

When you edit an existing Wazuh integration, the password field is left blank and is optional — leave it empty to keep the stored password, or enter a new one to replace it. The **Enabled** toggle controls whether the instance is available for use.

## Limitations

Wazuh is a detection source, not a deployment target — playbooks cannot be deployed to it, so it does not appear in the Deploy dialog.