Skip to main content
The Wazuh manager’s Integrator module (integratord) has a built-in shuffle integration: it POSTs each Wazuh alert as JSON to the configured hook_url, with no authentication header. Set hook_url to your Flashduty push URL to send Wazuh alerts to Flashduty On-call. Each Wazuh alert becomes one Flashduty alert.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select Wazuh and click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Wazuh and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

In Wazuh

The Integrator module runs only on the Wazuh manager. The configuration file is /var/ossec/etc/ossec.conf, and you need root access on the manager.
1

Add the shuffle integration in Wazuh

Where: Wazuh manager › /var/ossec/etc/ossec.conf › <ossec_config> › <integration>Add the following to <ossec_config>:
  • A fresh manager sends a burst of level-7 SCA checks; set <level> to 7 if you want lower-level alerts, and filter them with <rule_id> or <group>
  • Do not set <api_key>. Flashduty authenticates with the integration_key in the URL
  • Do not use <options> to override the id field. Flashduty uses it to tell alerts apart
2

Restart the Wazuh manager

Where: Terminal on the Wazuh manager
For Docker deployments, restart the manager container.
3

Trigger an alert and verify

Where: Terminal on a monitored host; for troubleshooting, /var/ossec/logs/integrations.log and /var/ossec/logs/ossec.log on the manager
  1. On a monitored host, trigger an alert at or above <level>, for example several failed SSH password attempts (rule 5763, level 10)
  2. Confirm the alert arrives in Flashduty and the integration shows a Latest event time
  3. If nothing arrives, check /var/ossec/logs/integrations.log and /var/ossec/logs/ossec.log on the manager
Wazuh has no “send test notification” feature. The shuffle script skips alerts from rules 5710, 86001-86003, 87900-87904, 87924, 87928, 87929, 87932 and 80710 (triggered by Docker and SSH probes, to avoid self-alerting loops in Shuffle), so do not use those rules to test.

Events and recovery

Wazuh pushes each alert once and never sends an update or a recovery notification. Every Wazuh alert has a unique alert ID, which Flashduty uses as the Alert Key: a redelivery of the same alert merges, different alerts each open their own Flashduty alert, and none resolves automatically. Turn on the channel’s auto-resolve timeout (24 hours suggested), or close alerts by hand after handling them. When the same rule fires repeatedly on the same host, configure a noise-reduction rule on the channel to merge them into one incident.

Alert key

The Alert Key is computed from the Wazuh alert’s id field (for example 1790000101.123456). A request without id is rejected with an invalid-parameter error. This includes requests in the Slack integration format: Flashduty supports only the shuffle integration.

Status and severity

Flashduty maps all_fields.rule.level (the Wazuh rule level, 0-15): When all_fields.rule.level is missing, the shuffle script’s severity field is used: 3 (rule level 8 and above) is Warning, and 1 and 2 are Info. When both are missing, the severity is Warning.

Labels

Flashduty neither reads nor stores the raw log (text and full_log). The shuffle script still sends the whole alert to hook_url, and it can contain usernames, IP addresses, file paths and command lines. Filter with <level>, <rule_id> and <group>, and avoid forwarding raw authentication logs.

Troubleshooting

  • Flashduty returns an invalid-parameter error: make sure you use the shuffle integration with <alert_format> set to json, and check the integration_key in hook_url
  • No alerts arrive: confirm the manager was restarted, the alert level is at or above <level>, the rule is not in the skip list above, and check integrations.log
  • Too many alerts: raise <level>, or filter with <rule_id> / <group>
  • Alerts never close: Wazuh sends no recovery, so turn on the channel’s auto-resolve timeout
For more options, see the Wazuh documentation on integrating with external APIs.