Skip to main content
Connect your Wazuh Security Platform so Myrmex can query alerts, inspect agents and rules, and check platform state. Myrmex reaches the Wazuh Manager API (JWT auth) and the Wazuh Indexer (Basic auth) over HTTPS through a Collector on your network. Every request runs live, on demand — Myrmex returns only what you ask for and copies or stores nothing from Wazuh on its side. Credentials are resolved on your side and never pass through the model.

​
What Myrmex Can Do

Query security alerts

Search the Wazuh Indexer for alerts live and return only the matches you asked for.

Inspect the Manager

Read agent status, rules, and configuration through the Manager API.

Review findings

Pull file-integrity and vulnerability detection results to support alert triage.

Live, nothing stored

Myrmex queries Wazuh in real time and keeps no copy of your data on its side.

​
Before You Start

  • A Collector that can reach the Manager API (default port 55000) and the Indexer (default port 9200), both over HTTPS. See Collector mode.
  • A Manager API user bound to an RBAC role with read (and, if needed, write) permissions.
  • An Indexer credential with read access to the Wazuh alert indices.

​
Step 1 — Create the Credential in Wazuh

1

Create a Manager API user

In the Wazuh dashboard, go to Server management → Security and add a user, then bind it to an RBAC role/policy that grants the actions Myrmex should perform. Myrmex authenticates to the Manager API and receives a JWT.
2

Provide an Indexer credential

Myrmex also queries the Wazuh Indexer for alerts. Use the admin account or a dedicated Indexer user with read access to the alert indices.
Give the Manager API user a read-only RBAC role first. Add write actions only when you want the agents to change Wazuh, not just read it.

​
Step 2 — Add the Integration in Myrmex

From the Directory, choose Add Integration → Wazuh Security Platform, then provide the connection for each component. Manager (JWT) Indexer (Basic)

​
Connect

Click Connect to validate both components and finish. Wazuh then appears under Environment → Integrations, and you can ask about it in the Workspace or through the Integration Specialist agent.
On-prem Wazuh often uses self-signed certificates. Make sure the Collector trusts them, or the Manager and Indexer connections will fail validation.