feat(providers): Wazuh Provider #3065

traceroute42 · 2025-01-19T20:57:45Z

📑 Description

The PR is intended to be the first version of integration with Wazuh.
It integrates with usage of the Wazuh custom integrations feature

✅ Checks

My pull request adheres to the code style of this project
My code requires changes to the documentation
I have updated the documentation as required
All the tests have passed

vercel · 2025-01-19T20:57:50Z

@Motii1 is attempting to deploy a commit to the KeepHQ Team on Vercel.

A member of the Team first needs to authorize it.

CLAassistant · 2025-01-19T20:57:52Z

All committers have signed the CLA.

talboren · 2025-01-20T07:25:06Z

Looks great, awesome work!
@traceroute42 mind adding a screenshot of an alert that Keep received from Wazuh in the alerts feed? Cool stuff!

talboren · 2025-01-20T07:25:18Z

@traceroute42 can you also sign the CLA so we can further push that in?

vercel · 2025-01-20T07:25:24Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
keep	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Feb 4, 2025 7:39am

talboren

NICE!

codecov · 2025-01-20T08:06:19Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 43.07%. Comparing base (e8cbcb3) to head (4ddd276).
Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3065      +/-   ##
==========================================
+ Coverage   43.06%   43.07%   +0.01%     
==========================================
  Files         166      167       +1     
  Lines       16685    16741      +56     
==========================================
+ Hits         7186     7212      +26     
- Misses       9499     9529      +30

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

keep/providers/wazuh_provider/custom-keep

shahargl

can you add some docker-compose.yml that spins up Wazuh with the custom-keep.py? so I can re-run it locally and check everything good?

docs/providers/documentation/wazuh-provider.mdx

keep/providers/wazuh_provider/custom-keep

keep/providers/wazuh_provider/custom-keep.py

Matvey-Kuk

I fixed it, let's merge

Matvey-Kuk · 2025-01-21T11:22:43Z

@Motii1 reached out to me that he would love to test this one more. Thank you!

Motii1 · 2025-01-29T23:57:49Z

Looks great, awesome work! @traceroute42 mind adding a screenshot of an alert that Keep received from Wazuh in the alerts feed? Cool stuff!

No problem. I have generated some simple events:

gitguardian · 2025-01-30T05:44:56Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
15359980	Triggered	Generic Private Key	`db918c7`	keep/providers/clickhouse_provider/clickhouse-secure/certs/server.key	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

shahargl

lgtm

Signed-off-by: Matvey Kukuy <Matvey-Kuk@users.noreply.github.com>

shahargl

lgtm

github-actions · 2025-02-04T07:50:11Z

🏆 Fantastic work @traceroute42! Your very first PR to keep has been merged! 🎉🥳

You've just taken your first step into open-source, and we couldn't be happier to have you onboard. 🙌
If you're feeling adventurous, why not dive into another issue and keep contributing? The community would love to see more from you! 🚀

For any support, feel free to reach out on the community: https://slack.keephq.dev. Happy coding! 👩‍💻👨‍💻

Signed-off-by: Matvey Kukuy <Matvey-Kuk@users.noreply.github.com> Co-authored-by: Dawid Motak <dawidmotak1@gmail.com> Co-authored-by: Tal Borenstein <tal@keephq.dev> Co-authored-by: Shahar Glazner <shaharglazner@gmail.com> Co-authored-by: Matvey Kukuy <motakuk@gmail.com> Co-authored-by: Matvey Kukuy <Matvey-Kuk@users.noreply.github.com>

Motii1 added 2 commits January 19, 2025 21:48

feat: add wazuh provider

0c1c2cf

Merge remote-tracking branch 'origin/main' into wazuh

8bc6686

dosubot bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Jan 19, 2025

dosubot bot added Documentation Improvements or additions to documentation Feature A new feature Provider Providers related issues labels Jan 19, 2025

traceroute42 changed the title ~~Add PoC of Wazuh Provider~~ feat: Add PoC of Wazuh Provider Jan 19, 2025

talboren previously approved these changes Jan 20, 2025

View reviewed changes

dosubot bot added the lgtm This PR has been approved by a maintainer label Jan 20, 2025

vercel bot deployed to Preview January 20, 2025 07:29 View deployment

fix: lint

4ddd276

talboren dismissed their stale review via 4ddd276 January 20, 2025 07:59

shahargl reviewed Jan 20, 2025

View reviewed changes

keep/providers/wazuh_provider/custom-keep Show resolved Hide resolved

shahargl reviewed Jan 20, 2025

View reviewed changes

keep/providers/wazuh_provider/custom-keep Show resolved Hide resolved

shahargl requested changes Jan 20, 2025

View reviewed changes

dosubot bot removed the lgtm This PR has been approved by a maintainer label Jan 20, 2025

Matvey-Kuk requested changes Jan 20, 2025

View reviewed changes

docs/providers/documentation/wazuh-provider.mdx Show resolved Hide resolved

keep/providers/wazuh_provider/custom-keep Show resolved Hide resolved

keep/providers/wazuh_provider/custom-keep.py Show resolved Hide resolved

shahargl and others added 2 commits January 20, 2025 19:07

Merge branch 'main' into wazuh

057d6b7

Merge branch 'main' into wazuh

9f3253d

vercel bot deployed to Preview January 21, 2025 09:25 View deployment

fix for comments

08e601c

Matvey-Kuk previously approved these changes Jan 21, 2025

View reviewed changes

Merge branch 'main' into wazuh

8581595

vercel bot deployed to Preview January 22, 2025 09:08 View deployment

Merge branch 'main' into wazuh

842e180

vercel bot deployed to Preview January 27, 2025 08:49 View deployment

Merge branch 'main' into wazuh

b7b1b74

feat: improve message for wazuh related events

1853279

Motii1 dismissed Matvey-Kuk’s stale review via 1853279 January 29, 2025 23:58

Motii1 and others added 3 commits January 30, 2025 01:04

feat: handle agentless host in wazuh events payloads

d97ff57

fix: fix wazuh provider custom integration script

a319a81

Merge branch 'main' into wazuh

db918c7

Motii1 added 2 commits February 3, 2025 22:01

fix: fix fingerprint calculation for wazuh provider

d6c1416

chore: add alerts_mock for wazuh provider

cd68cc4

shahargl changed the title ~~feat: Add PoC of Wazuh Provider~~ feat(providers): Wazuh Provider Feb 4, 2025

shahargl previously approved these changes Feb 4, 2025

View reviewed changes

dosubot bot added the lgtm This PR has been approved by a maintainer label Feb 4, 2025

Merge branch 'main' into wazuh

c5be73b

Signed-off-by: Matvey Kukuy <Matvey-Kuk@users.noreply.github.com>

Matvey-Kuk dismissed shahargl’s stale review via c5be73b February 4, 2025 07:24

Matvey-Kuk approved these changes Feb 4, 2025

View reviewed changes

Matvey-Kuk enabled auto-merge (squash) February 4, 2025 07:26

vercel bot deployed to Preview February 4, 2025 07:39 View deployment

shahargl self-requested a review February 4, 2025 07:49

shahargl approved these changes Feb 4, 2025

View reviewed changes

Matvey-Kuk merged commit d1324ba into keephq:main Feb 4, 2025
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(providers): Wazuh Provider #3065

feat(providers): Wazuh Provider #3065

traceroute42 commented Jan 19, 2025 •

edited

Loading

vercel bot commented Jan 19, 2025

CLAassistant commented Jan 19, 2025 •

edited

Loading

talboren commented Jan 20, 2025

talboren commented Jan 20, 2025

vercel bot commented Jan 20, 2025 •

edited

Loading

talboren left a comment

codecov bot commented Jan 20, 2025

shahargl left a comment

Matvey-Kuk left a comment

Matvey-Kuk commented Jan 21, 2025

Motii1 commented Jan 29, 2025

gitguardian bot commented Jan 30, 2025 •

edited

Loading

shahargl left a comment

shahargl left a comment

github-actions bot commented Feb 4, 2025

feat(providers): Wazuh Provider #3065

feat(providers): Wazuh Provider #3065

Conversation

traceroute42 commented Jan 19, 2025 • edited Loading

📑 Description

✅ Checks

vercel bot commented Jan 19, 2025

CLAassistant commented Jan 19, 2025 • edited Loading

talboren commented Jan 20, 2025

talboren commented Jan 20, 2025

vercel bot commented Jan 20, 2025 • edited Loading

talboren left a comment

Choose a reason for hiding this comment

codecov bot commented Jan 20, 2025

Codecov Report

shahargl left a comment

Choose a reason for hiding this comment

Matvey-Kuk left a comment

Choose a reason for hiding this comment

Matvey-Kuk commented Jan 21, 2025

Motii1 commented Jan 29, 2025

gitguardian bot commented Jan 30, 2025 • edited Loading

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

shahargl left a comment

Choose a reason for hiding this comment

shahargl left a comment

Choose a reason for hiding this comment

github-actions bot commented Feb 4, 2025

traceroute42 commented Jan 19, 2025 •

edited

Loading

CLAassistant commented Jan 19, 2025 •

edited

Loading

vercel bot commented Jan 20, 2025 •

edited

Loading

gitguardian bot commented Jan 30, 2025 •

edited

Loading