> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Wazuh

> Connect the Wazuh Security Platform to Myrmex — create a Manager API user and an Indexer credential, then add the integration.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect your **Wazuh Security Platform** so Myrmex can query alerts, inspect agents and rules, and check platform state. Myrmex reaches the **Wazuh Manager API** (JWT auth) and the **Wazuh Indexer** (Basic auth) over HTTPS through a [Collector](/documentation/agent-endpoint-security/collector-mode) on your network. Every request runs **live, on demand** — Myrmex returns only what you ask for and copies or stores nothing from Wazuh on its side. Credentials are resolved on your side and never pass through the model.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Query security alerts" icon="magnifying-glass">
    Search the Wazuh Indexer for alerts live and return only the matches you asked for.
  </Card>

  <Card title="Inspect the Manager" icon="server">
    Read agent status, rules, and configuration through the Manager API.
  </Card>

  <Card title="Review findings" icon="shield-halved">
    Pull file-integrity and vulnerability detection results to support [alert](/documentation/detection-response/alerts) triage.
  </Card>

  <Card title="Live, nothing stored" icon="bolt">
    Myrmex queries Wazuh in real time and keeps no copy of your data on its side.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** that can reach the **Manager API** (default port `55000`) and the **Indexer** (default port `9200`), both over HTTPS. See [Collector mode](/documentation/agent-endpoint-security/collector-mode).
* A **Manager API user** bound to an RBAC role with read (and, if needed, write) permissions.
* An **Indexer credential** with read access to the Wazuh alert indices.

## Step 1 — Create the Credential in Wazuh

<Steps>
  <Step title="Create a Manager API user">
    In the Wazuh dashboard, go to **Server management → Security** and add a user, then bind it to an RBAC **role/policy** that grants the actions Myrmex should perform. Myrmex authenticates to the Manager API and receives a JWT.
  </Step>

  <Step title="Provide an Indexer credential">
    Myrmex also queries the Wazuh **Indexer** for alerts. Use the `admin` account or a dedicated Indexer user with read access to the alert indices.
  </Step>
</Steps>

<Tip>
  Give the Manager API user a read-only RBAC role first. Add write actions only when you want the agents to change Wazuh, not just read it.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Wazuh Security Platform**, then provide the connection for each component.

| Field           | Description                               |
| --------------- | ----------------------------------------- |
| **Name**        | A unique name for this Wazuh deployment.  |
| **Description** | Optional note to identify the deployment. |
| **Collector**   | Select collectors to gather Wazuh data.   |

**Manager (JWT)**

| Field             | Description                                             |
| ----------------- | ------------------------------------------------------- |
| **Protocol**      | `https` or `http` (use `https`).                        |
| **Manager Host**  | Wazuh Manager IP or hostname.                           |
| **API Port**      | Default `55000`.                                        |
| **Username**      | Manager API username.                                   |
| **Password**      | That user's password.                                   |
| **Auth Endpoint** | Token endpoint (default `/security/user/authenticate`). |

**Indexer (Basic)**

| Field               | Description                                   |
| ------------------- | --------------------------------------------- |
| **Protocol**        | `https` or `http` (use `https`).              |
| **Indexer Host**    | Wazuh Indexer IP or hostname.                 |
| **Indexer Port**    | Default `9200`.                               |
| **Username**        | Indexer username (default `admin`).           |
| **Password**        | That user's password.                         |
| **Status Endpoint** | Health endpoint (default `/_cluster/health`). |

## Connect

Click **Connect** to validate both components and finish. Wazuh then appears under **Environment → Integrations**, and you can ask about it in the Workspace or through the [Integration Specialist agent](/documentation/multi-agent-system/integration-specialist-agent).

<Note>
  On-prem Wazuh often uses self-signed certificates. Make sure the Collector trusts them, or the Manager and Indexer connections will fail validation.
</Note>