wazuh-documentation
wazuh-documentation copied to clipboard
Integrations with external APIs improvements
-
The Integration with external APIs section could benefit from the following improvement requests:
- A clarification on what Wazuh manager node to configure the integration for cluster configurations and what effect it has. Currently it simply says The integrations are configured on the Wazuh manager ossec.conf file. You can find this file in the Wazuh installation folder /var/ossec/etc/ It's not explaining that configuring the integration on one node won't forward events happening in other Wazuh manager nodes nor on agents enrolled on those other nodes.
- Step 1 of pagerDuty integration is too vague. It says "Get your own Events API v2 integration key by creating a Pagerduty new service.". It should say that one needs to create a service and select the integration named
Events API V2
for it and copy itsIntegration key
. Without a concrete and specific explanation one might think of creating a v2 API key in Developer Tools under the Integrations menu.
-
The Configuration example in the integration section, if it's showing the
<options>
element for PagerDuty, should use a working one or none or add a hint or what it's supossed to be doing in this specific integration. Unlike the case of Slack above it, it doesn't work straightforwardly. NOTE EDIT: This is only valid for 4.7 and later.