Wazuh Indexer and CoPilot Integration

[@gabrielbozzola8711]

Hi Taylor I'm having an error, when I try to connect it gives the error "[Errno 111] Connection refused", even with admin account, we are using wazuh 4.8.1. Any tips how can we solve this issue ?

[@danilocesar3931]

same error

[@ebel7775]

@@danilocesar3931 same here also

[@cyb3rmeerk4t51]

Hi I started to created my homelab environment using your SIEM playlist. I have learned a lot and your content is really helpful. I just started to configure copilot in my environment. Works super great with dfir-iris. Thank you for this. Can you also please do an update with Wazuh 4.8.0, it has different settings under the user config and I am having an error whenever I tried to connect them

[@matematajsz2531]

Hey what are the supported Wazuh versions for copilot?

[@ovidiuroman9387]

did anyone manage to solve the verification error? Tried with different users and permissions but still nothing.

[@MrGhost-pj8lf]

Thank you Taylor, I saw all videos reguarding Copilot and it is a really great and handy tool for me at current point in time. I have one question, currently I am using wazuh in cluster form where I have 1 master, 10 workers and 3 indexers. Can Copilot is apllicable for this architecture. How can I configure multiple indexers with copilot?

[@taylorwalton_socfortress]

Thanks for watching! Copilot only needs connection to the Wazuh Manager MASTER node (this is where the wazuh api endpoint sits) and only one of your indexers

[@cyber_rus]

Hi! If I haven't got https connection for my wazuh server, I can't get verify integration? I had got mistace 101 "Failed to verify connector"

[@mrrdwchldrn5056]

Does copilot support multiple wazuh indexers / managers? Or would we have to reconfigure if the master node changes?

[@MrGhost-pj8lf]

same question

[@alkisgian757]

thank you so much. Worked like a charm