Dear Community, My 1st Post here, after I read quite a lot of Docs and Guides, still have two important issues I hope will not take too much Time of yours. I am incharge of building a SOC for several potential Customers of us, so kind as MSSP you could say. In our planned Stack: Wazuh with Wazuh…

Hello @4xekb Looking over you layout , it looks good but Graylog from version 4.3 → 5 will be using Opensearch which is a fork from Elasticsearch. I have not worked with Wazuh to see if its compatable with Graylog after 5.0. I would be curious to see this setup thou.

Thanks @gsmith for your prompt reply. As Wazuh Indexer is a Fork from OpenSearch, I am quite sure I saw somewhere the Compatability Matrix, I will look for it tomorow and post it here. If GL is not compatible with it, then we just use OpenSearch I guess. In that case - then the first 3 Machines I …

Hey, For graylog you will need to configure mongo nodes in the configruation file with the replica set name. Might want to look here for a better idea. [image] Deploy a Replica Set — MongoDB Manual

Hemm, sorry, did not get ur point. I did read this Guide before, and still dont understand, also ur comment - what is not good in my Plan. I have 3 Machines, each has GL Server + MongoDB. Then I have 3 extra Machines, with Replica Set 01,02,03 What do i miss?

Hey @4xekb Perhaps I can try to simplify it for you. [image] 4xekb: I have 3 Machines, each has GL Server + MongoDB. Then I have 3 extra Machines, with Replica Set 01,02,03 If I understand you correct, those first three /w Graylog nodes would be a replica set, you would have a primary and …

@4xekb Actually there is someone here that used/using Wazuh, perhaps he could jump in. [image] Integrating wazuh indexer with Graylog Graylog Central (peer support) Before you post: Your responses to these questions will help the community help you. Please complete thi…

Hey @4xekb it’s a little off topic… you wrote that you want to set up an MSSP with SOC. What are the use cases for WAZUH? And a hint, from TheHIVE 5 you need an MSSP license. With the introduction of version 5, StrangeBee changed the license model.

Sure why not, so far the integration looks good, I am getting what I was looking to deploy. user do message my personal message I replied with the environment that I am running if required happy to help. it also helps different views of how people look to deploy.

Hi, Sorry i missed ur msg. Wazuh is a very enriched Platform, SIEM/EDR and more. I actually used it in the past and was very happy with. The list is huge but basically deploy Wazuh on Agents, forward the Logs, FIM, Inventory, CVE Detection and much more. Regarding the Hive5, yes i know, thanks, w…

Hey, Thanks for your answer. I have built and managed a SOC in the government environment for several years and know the ups and downs :wink: I had deployed QRadar as a large distributed system. At some point I stopped having fun with a closed proprietary system. The setting consisted of QRadar, …

GrayLog Cluster with Wazuh Indexer & MongoDB

Graylog Central (peer support)

gsmith (GSmith) January 5, 2023, 1:10am 7

@4xekb

Actually there is someone here that used/using Wazuh, perhaps he could jump in.

Topic		Replies	Views
Graylog 5.0 with Wazuh Indexer Graylog Central (peer support)	11	9492	May 23, 2023
Cluster Infrastructure Graylog Central (peer support)	35	3973	April 25, 2019
Integrating wazuh indexer with Graylog Graylog Central (peer support)	9	6445	November 14, 2022
Send logs from graylog to wazuh Graylog Central (peer support)	1	1870	March 15, 2024
Graylog integration issue Graylog Central (peer support)	0	79	May 1, 2025

GrayLog Cluster with Wazuh Indexer & MongoDB

Related topics