saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 16:40:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/implementing-endpoint-detection-with-wazuh/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.0 KiB
Raw Blame History

API Reference: Implementing Endpoint Detection with Wazuh

Wazuh REST API Endpoints

Endpoint Method Purpose
/security/user/authenticate POST Get JWT token (Basic Auth)
/agents GET List agents with status
/agents/summary/status GET Agent status summary
/alerts GET Query security alerts
/rules GET List detection rules
/logtest PUT Test log against decoders/rules
/manager/configuration GET Manager configuration
/agents/{id}/restart PUT Restart specific agent

Authentication

import requests
from requests.auth import HTTPBasicAuth

resp = requests.post(
    "https://wazuh:55000/security/user/authenticate",
    auth=HTTPBasicAuth("wazuh-wui", "password"),
    verify=False,
)
token = resp.json()["data"]["token"]
headers = {"Authorization": f"Bearer {token}"}

Custom Rule XML Syntax

<group name="custom_rules,">
  <rule id="100001" level="12">
    <if_sid>5716</if_sid>
    <srcip>!192.168.1.0/24</srcip>
    <description>SSH login from external IP</description>
    <mitre><id>T1078</id></mitre>
  </rule>
</group>

Location: /var/ossec/etc/rules/local_rules.xml

Custom Decoder XML

<decoder name="custom_app">
  <program_name>myapp</program_name>
  <regex>^(\S+) (\S+) (\S+)</regex>
  <order>srcip,user,action</order>
</decoder>

Location: /var/ossec/etc/decoders/local_decoder.xml

Alert Query Parameters

Parameter Example Description
limit 20 Max results
sort -timestamp Sort descending
q rule.level>=10 Filter by level
search brute force Text search
select rule.id,agent.name Field selection

References