wazuh-keep-integration

Wazuh integration to forward alerts to Keep — open-source alert management and AIOps platform. Adds custom environment, url, and ticket_url fields to every alert for multi-tenant deployments.

Flow

Wazuh alert (level ≥ 11)
        │
        ▼
custom-keep integration script
        │
        ▼
Keep /alerts/event endpoint → alert enrichment, dedup, routing

Installation and Setup

1. Clone the Repository or just download custom scripts:

cd /var/ossec/integrations
wget -O custom-keep.py https://raw.githubusercontent.com/adampielak/wazuh-keep-integration/refs/heads/main/custom-wazuh-keep.py
wget -O custom-keep https://raw.githubusercontent.com/adampielak/wazuh-keep-integration/refs/heads/main/custom-wazuh-keep

2. After cloning navigate to the integration script's directory and open it:

cd /var/ossec/integrations
vi custom-keep.py

3. Modify the Script

• Adding Custom Environment Fields:

# Hardcode your environment value here
environment = "ENV"
url = "https://wazuh.siem.local"
ticket_url = "https://jira.prod.local"

4. Give it the right ownership and permissions:

chmod 750 /var/ossec/integrations/custom-keep.py /var/ossec/integrations/custom-keep
chown root:wazuh /var/ossec/integrations/custom-keep.py /var/ossec/integrations/custom-keep

5. Update the ossec.conf File. Append the following configuration to the /var/ossec/etc/ossec.conf file to enable the integration with Keep:

  <ossec_config>
    <!-- Keep integration -->
    <integration>
      <name>custom-keep</name>
      <hook_url>http://<KEEP_IP_ADDRESS>:8080/alerts/event</hook_url>
      <api_key><KEEP_API_KEY></api_key> <!-- Replace with your Keep API key -->
      <level>11</level>
      <alert_format>json</alert_format>
    </integration>
  </ossec_config>

• Replace <KEEP_IP_ADDRESS> with the IP address of the Keep server. Ensure to include the port number if Keep is not listening on the default port 8080.
• Make sure to use the /alerts/event endpoint (not /alerts/event/wazuh), as only /alerts/event supports custom labels and full payload customization.

5. Restart Wazuh Manager:

systemctl restart wazuh-manager