Wazuh SIEM

Enterprise SIEM integrated into your AI command centre.

The Wazuh SIEM plugin brings enterprise security monitoring directly into QuoxCORE. It connects your Wazuh manager to the dashboard, giving your AI agents visibility into alerts, vulnerabilities, file integrity changes, and compliance posture across your entire fleet.

Overview

Wazuh is an open-source security platform that provides unified XDR and SIEM capabilities: intrusion detection, log analysis, vulnerability scanning, file integrity monitoring, and regulatory compliance checking. It runs a manager (server) that collects data from lightweight agents deployed on every monitored host.

The QuoxCORE Wazuh plugin wraps the Wazuh API and adds:

• A real-time alert feed inside the dashboard
• Vulnerability and compliance views per host
• AI-assisted alert triage (CommanderQ analyses alerts in context)
• One-click agent deployment to fleet hosts via SSH

This means your security data lives alongside your infrastructure data. When CommanderQ sees a disk alert from QuoxAgent, it can cross-reference Wazuh vulnerability data for the same host and give you a single, informed recommendation.

Architecture

The plugin sits between the QuoxCORE dashboard and your Wazuh manager. All Wazuh API calls are proxied through the collector service, which handles authentication and rate limiting.

Dashboard (React)
    │
    ▼
Collector Service (Express)
    │
    ├──► Wazuh API (https://<wazuh-host>:55000)
    │       │
    │       └── Wazuh Manager
    │            ├── Agent: nw-web-01
    │            ├── Agent: nw-db-01
    │            ├── Agent: nw-hv-01
    │            └── Agent: nw-monitor-01
    │
    └──► Bastion SSH (for agent deployment)
            │
            └── SSH → target host
                  └── Install wazuh-agent package
                  └── Configure manager address
                  └── Start wazuh-agent service

Key points:

• No direct browser-to-Wazuh traffic. The collector proxies all requests, so the Wazuh API never needs to be exposed to the browser or the public internet.
• Bastion SSH for deployment. Agent installation uses the same SSH path as QuoxBastion, so no additional network access is required.
• Credentials stay server-side. Wazuh API credentials are stored as environment variables on the collector, never sent to the frontend.

Setup

Prerequisites

• A running Wazuh manager (v4.x) with the API enabled on port 55000
• QuoxCORE dashboard deployed and running
• API credentials for the Wazuh manager (user and password)
• (Optional) QuoxBastion configured, if you want one-click agent deployment

Plugin Activation

1. Open the QuoxCORE dashboard
2. Navigate to Settings > Plugins
3. Find Wazuh SIEM in the plugin list
4. Toggle it to Active
5. Enter the configuration values (see Configuration section below)
6. Click Save

The plugin registers its sidebar entry, collector routes, and tool manifests on activation.

Configuration

Set these environment variables on the collector service (in your .env or docker-compose.yml):

Example docker-compose override:

services:
  collector:
    environment:
      WAZUH_HOST: 10.20.0.50
      WAZUH_API_PORT: 55000
      WAZUH_API_USER: wazuh-wui
      WAZUH_API_PASSWORD: ${WAZUH_API_PASSWORD}
      BASTION_HOST: 10.20.0.247

After setting the variables, restart the collector container.

Agent Deployment

This is the standout feature. Traditional Wazuh agent deployment requires SSH-ing into each host, adding the Wazuh repository, installing the package, editing the config, and starting the service. The plugin reduces this to a single click.

How It Works

1. You select one or more hosts from your fleet (sourced from QuoxBastion's host registry)
2. Click Deploy Agent
3. The collector sends an SSH command through the bastion to each target host
4. The deployment script on each host:
   • Detects the OS (Debian/Ubuntu, RHEL/CentOS, or SUSE)
   • Adds the Wazuh package repository
   • Installs wazuh-agent
   • Writes the manager address to /var/ossec/etc/ossec.conf
   • Starts and enables the wazuh-agent service
5. The plugin polls agent status until each host reports as connected

Bulk Deployment

For fleet-wide rollout, use the bulk deploy endpoint. It accepts an array of host IDs and deploys in parallel (respecting the bastion's SSH concurrency limit).

POST /api/v1/wazuh/deploy-bulk
{
  "hosts": [
    { "hostname": "nw-web-01", "ip": "10.20.0.101" },
    { "hostname": "nw-db-01", "ip": "10.20.0.102" }
  ]
}

Checking Agent Status

After deployment, verify agents are connected:

POST /api/v1/wazuh/agent-status
{
  "hostIp": "10.20.0.101"
}

Returns whether the Wazuh agent is installed, running, and its version for the specified host.

Features

Alert Feed

A live feed of Wazuh alerts displayed in the dashboard. Alerts are colour-coded by severity level:

Alerts can be filtered by agent, rule group, severity, and time range. Each alert links to its full details including the raw log, rule description, and MITRE ATT&CK mapping.

Vulnerability Scanning

View known vulnerabilities (CVEs) detected on each agent. The plugin pulls vulnerability data from the Wazuh API and displays:

• CVE identifier and description
• Affected package and version
• Severity (CVSS score)
• Whether a fix is available
• Detection date

File Integrity Monitoring (FIM)

Track file changes across monitored hosts. The FIM view shows:

• File path and change type (added, modified, deleted)
• Before and after checksums
• Timestamp and responsible user (where available)
• Configured monitored directories

Compliance

Wazuh maps its rules to compliance frameworks. The plugin surfaces compliance data for:

• PCI DSS
• GDPR
• HIPAA
• NIST 800-53
• CIS Benchmarks

Each compliance check shows pass/fail status, the relevant control, and the rule that triggered it.

AI Analysis

When CommanderQ is active, you can ask it to analyse Wazuh data in natural language:

• "What are the critical alerts from the last 24 hours?"
• "Which hosts have unpatched vulnerabilities?"
• "Show me file integrity changes on the production servers"
• "Are we compliant with PCI DSS requirement 10?"

CommanderQ uses the Wazuh MCP tools to query the API and returns structured, contextual answers.

API Reference

All endpoints are served by the collector service. Authentication follows the standard QuoxCORE session/token model.

Proxy Endpoint

The /api/v1/wazuh/proxy endpoint forwards arbitrary requests to the Wazuh API. This is useful for accessing endpoints not covered by the dedicated routes above.

POST /api/v1/wazuh/proxy
{
  "endpoint": "/vulnerability/001",
  "method": "GET",
  "body": {
    "limit": 10,
    "offset": 0
  }
}

The collector authenticates with the Wazuh API using the configured credentials, forwards the request, and returns the response body.

Troubleshooting

Wazuh Manager Daemons Not Running

Symptom: The manager status endpoint returns errors or shows daemons as stopped.

Fix: SSH into the Wazuh manager and check the service:

systemctl status wazuh-manager
journalctl -u wazuh-manager --since "10 minutes ago"

Common causes: disk full (Wazuh logs can grow quickly), configuration syntax error after an edit, or a failed upgrade.

Agent Not Connecting After Deployment

Symptom: Agent shows as never_connected or disconnected in the agent list.

Checks:

1. Network: Ensure the agent host can reach the Wazuh manager on port 1514 (agent communication) and 1515 (agent registration).
2. Firewall: Check iptables/nftables rules on both the agent host and the manager.
3. Manager address: Verify /var/ossec/etc/ossec.conf on the agent contains the correct manager IP.
4. Service running: Check systemctl status wazuh-agent on the target host.
5. Registration: If the agent was previously registered with a different manager, remove /var/ossec/etc/client.keys and restart the agent.

API Authentication Failures

Symptom: 401 responses from the Wazuh proxy endpoint.

Fix: Verify the WAZUH_API_USER and WAZUH_API_PASSWORD environment variables are correct. Test directly:

curl -k -u wazuh-wui:PASSWORD https://WAZUH_HOST:55000/security/user/authenticate

If the credentials are correct but authentication still fails, check that the API user has not been locked out (Wazuh locks accounts after repeated failed attempts).

Collector Cannot Reach Wazuh API

Symptom: Connection timeout or refused errors in collector logs.

Checks:

1. Verify WAZUH_HOST and WAZUH_API_PORT are set correctly.
2. Ensure the collector container can reach the Wazuh manager network. If they are on different Docker networks, you may need to add the Wazuh network to the collector's docker-compose.yml.
3. Check that the Wazuh API is listening: ss -tlnp | grep 55000 on the manager host.

Agent Deployment Fails via SSH

Symptom: Deploy endpoint returns an SSH error or the script fails partway through.

Checks:

1. Ensure BASTION_HOST is set and the bastion is reachable from the collector.
2. Verify the target host is registered in QuoxBastion's host registry.
3. Check that the SSH user on the target host has sudo privileges (agent installation requires root).
4. Review the deployment output in the collector logs for the specific error (package manager failure, network issue, permission denied).

Next Steps

• QuoxCORE - The AI command centre that hosts the Wazuh plugin
• QuoxBastion - Fleet management and SSH execution used for agent deployment
• QuoxAgent - Per-host monitoring daemon (complementary to Wazuh agents)
• Safety and Security - QuoxCORE's security model and DEFCON levels