Wazuh Content Pack For Graylog - Easily Configure Your SOCFortress SIEM Stack

[@marcioguedes2072]

Awesome! Curious to see this working!

[@dhialabiedh38]

Can you give us that content pack without copilot ?

[@Momoshii]

i have problem Failed to send GET request to /api/system with error: Expecting value: line 1 column 1 (char 0) can you help me pls?

[@alkisgian757]

Another great video. Thank you so much!!!

[@titanium2348]

Hi @Taylor I know this is on the wrong post, however, I'm trying to follow the video of Yara and Whazu and am getting a PUA VUlnerability error when running the script. Do you have any idea how I can resolve that? I'm trying to create a script that can scan the server for IoC's

[@kamilinformatyka4458]

No Mitre results were found in the selected time range. :(

[@slavanba3536]

However Wazuh is still not fully compatible with Graylog. You won't be able to see events on Wazuh's dashboard when you'll connect Graylog to Wazuh stack.

[@taylorwalton_socfortress]

Stay tuned for our Grafana dashboards 🚀

[@abineshstudio565]

Facing a error on clicking deploy "Failed to send GET request to /api/system with error: Expecting value: line 1 column 1 (char 0)" any got upto this video today ,thanks and a respect for your service Taylor

[@BretMacolino]

Taylor, is this from a new Graylog setup? I have followed your guides from a while back and love the Medium posts. I have tried to run this content pack and it just fails. " Installing content pack failed with status: FetchError: There was an error fetching a resource: . Additional information: Failed to install content pack . Could not install Content Pack with ID: 261577fe-d9a2-4141-af74-635f085eee54"

[@taylorwalton_socfortress]

What graylog version are you on? It needs to be greater than or equal to 5.0.13

[@i3odoem]

@@taylorwalton_socfortress same error here with 5.013 and 5.2.6 graylog

[@shakeralkmali630]

@@i3odoem how do you solve this error

[@i3odoem]

@@shakeralkmali630 Not sure what was wrong, looks like integration to streams/indices went wrong, or may be it was problem with grafana, because even with error, copilot create new entries in graylog. I install new graylog 5.2.6 server on mongo 6.0 and create new grafana organization for copilot -> all connects like it should be.

[@aramisdelacruz8879]

Because of this error it took me more than 1 hour to discover what it was, until I analyzed the graylog log, I almost wrote to Taylor to see what it could be xD. If you have been following Taylor's videos for a while, you probably have pipelines already made in your graylog and those names are probably the same as the names of the pipelines that come with the content packet, what you should do is either delete your pipelines or rename them and then use the ones that don't do the same action.

[@boltthrower3215]

There is no valid reason to mix that, no compliance will allow it ... Why is Wazuh even working with you?

[@alihasanmogal1199]

hey please make it docker file where we can easy to FULL SIEM stack including wazuh,greylog, all other application connect with each other if possible easy to everyone

[@boltthrower3215]

If you don't understand the technic, don't touch a server!