Technical Reference

Wazuh Integration

Review Wazuh decoder and rule examples for joining endpoint signals with FortiGate events.

IP, user, device, and license values on this page are anonymized.

<decoder name="bivoxy-fortigate-anon">
  <prematch>devname=</prematch>
  <regex>srcip=(\S+) .* dstip=(\S+) .* action="(\w+)"</regex>
  <order>srcip,dstip,action</order>
</decoder>

<rule id="110042" level="8">
  <decoded_as>bivoxy-fortigate-anon</decoded_as>
  <mitre><id>T1110</id></mitre>
</rule>

Let us design your deployment plan

Let’s plan the right architecture for your FortiGate, Wazuh, and log pipelines together.

Contact us
Wazuh Integration | Documentation | Bivoxy