# 08. Wazuh and SOCRadar Integration

Wazuh is a free, open-source, and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response, and compliance. \[1\]

Alarms and Threat Feed data that is provided by **SOCRadar** can be retrieved by Wazuh. We have provided sample **Python 3.7** code snippets that can be used to integrate **SOCRadar** and **Wazuh** seamlessly.

### **Supported Output Formats**

There are 2 different code snippets for every supported API, each producing 2 different output formats:

* **JSON**
    
* **CSV**
    

For the **Alarms data**, there is an additional code snippet that produces the following format:

* **CEF** (Common Event Format)
    

For the **Threat Feed data**, there are additional code snippets that produce the following formats:

* **TXT**
    
* **XLSX**
    

Depending on your SOC workflow, you can select one of these output formats for the SOCRadar API output and feed it to **Wazuh** for correlation and monitoring.

\[1\] [https://wazuh.com/](https://wazuh.com/)

---

### **External Libraries**

For this integration, the Python library **requests** is required. Install it with:

```plaintext
sudo pip install requests
```

### **Demonstration: SOCRadar Alarms → Wazuh (CSV)**

SOCRadar’s Alarms integration with Wazuh using the Python 3.7 script (CSV output) is demonstrated as follows:

1. **Check script in :** [Wazuh/Integrations/SOCRadar at main · hawkteam404/Wazuh](https://github.com/hawkteam404/Wazuh/tree/main/Integrations/SOCRadar)
    
2. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1754230627113/e8661fe0-03b0-433d-9663-5831339435e2.png align="center")
    
3. [The script will:](https://github.com/hawkteam404/Wazuh/tree/main/Integrations/SOCRadar)
    
    * [Authenticate with SOCRadar A](https://github.com/hawkteam404/Wazuh/tree/main/Integrations/SOCRadar)PI.
        
    * Pull the latest Alarms data.
        
    * Convert it into CSV format.
        
    * Save or forward the CSV to Wazuh ingestion path (e.g., /var/ossec/logs/alerts/).
        
    
    ---
    
    ### **Security Considerations**
    
    * **API Keys**: Store SOCRadar API keys securely, avoid hardcoding in scripts. Use environment variables or .env files.
        
    * **Scheduled Jobs**: For continuous monitoring, configure the script to run via **cron** or **systemd**.
        
    * **Data Validation**: Ensure that data retrieved from SOCRadar is correctly formatted before ingestion to Wazuh to prevent false positives.
        
    
    ---
    
    Paste it into a **.py** file, for instance **socradar\_**[**alarms-wazuh.py**](http://alarms-wazuh.py)**.**
    
    Set the necessary environment variable:
    
    * **SOCRADAR\_ALARMS\_INTEGRATION\_FOLDER**
        
4. After you set your environment variables successfully, you can proceed to execute the script that you have copied before.
    
    ```plaintext
    python3 socradar_alarms-wazuh.py
    ```
    
    This script will continuously collect data from SOCRadar API by sending GET requests in every 60 seconds and will create log files under the **SOCRADAR\_ALARMS\_INTEGRATION\_FOLDER** until there will be any exceptions/keyboard interruptions. Log files will be created in an interval of 1 day. You can provide this folder to Wazuh and it can track down the log files consist of the SOCRadar alarms in CSV format. The interval of the log files creation and 60 seconds period of SOCRadar API requests can be changed to longer/shorter periods.
    
    **Scripts should run in VM Crontab.**
    
    Crontab\_working\_frequency cd Path\_of\_File && path\_of\_python file\_[name.py](http://name.py)
    
    E.g.: 5 6 \* cd /home/socradar && /usr/bin/python file\_[name.py](http://name.py) For feed
    
    E.g.: 0 1 \* cd /home/socradar && /usr/bin/python file\_[name.py](http://name.py) For Alarm