n8n-nodes-wazuh

Custom n8n community nodes for interacting with the Wazuh Manager API and Wazuh Indexer API.

Nodes

Wazuh Manager

Interacts with the Wazuh Manager REST API (port 55000). Uses JWT authentication (obtained automatically from user/password).

Resources:

• Agent – Get All, Get, Restart, Delete, Get Config, Get Key, Get Summary, Upgrade
• Manager – Get Status, Get Info, Get Logs, Get Stats, Get Configuration, Restart
• Cluster – Get Status, Get Nodes, Get Health, Restart
• Security – Get Users, Create User, Update User, Delete User, Get Roles, Get Rules, Get Policies
• Rule – Get All, Get File, Get Groups
• Decoder – Get All, Get File
• Vulnerability – Get Agent Vulnerabilities
• MITRE – Get All
• Active Response – Run Command
• Syscheck – Run, Get Results
• Syscollector – Get OS, Get Hardware, Get Packages, Get Processes, Get Ports, Get Netaddr
• Group – Get All, Get Agents, Create, Delete, Add Agent, Remove Agent, Get Configuration

Wazuh Indexer

Interacts with the Wazuh Indexer API (port 9200). Compatible with OpenSearch 2.19. Uses Basic Auth.

Resources:

• Document – Create, Delete, Get, Search (Query DSL), Update
• Index – Create, Delete, Get, Get All, Get Mapping, Refresh
• Cluster – Get Health, Get Stats, Get Settings, Get Allocation
• Node – Get All, Get Stats, Get Hot Threads
• Template – Get, Create, Delete, Get All
• Alias – Get, Create, Delete
• ISM (Index State Management) – Get Policy, Create Policy, Delete Policy, Explain Index, Retry
• Snapshot – Get Repository, Create Repository, Get Snapshot, Create Snapshot, Restore

Installation

Local Development

cd n8n-nodes-wazuh
npm install
npm run build
npm link

# In your n8n custom directory
cd ~/.n8n/custom
npm link n8n-nodes-wazuh

Restart n8n and the nodes will appear in the node panel.

Docker

Mount or copy the built package into your n8n container's custom nodes directory.

Credentials Setup

Wazuh Manager API

• Base URL: https://your-wazuh-manager (without port)
• Port: 55000 (default)
• Username: wazuh-wui (default API user)
• Password: Your API password
• Allow Unauthorized Certs: Enable for self-signed certificates

Wazuh Indexer API

• Base URL: https://your-wazuh-indexer (without port)
• Port: 9200 (default)
• Username: admin (default)
• Password: Your indexer password
• Allow Unauthorized Certs: Enable for self-signed certificates

License

MIT