Cybatar Security Hub · Governance · Risk Management · Threat Resilience · Compliance & Audit
Unified enterprise security operations for modern organisations
Security Hub
Client login Open portal
Cybatar / Connectors / Wazuh
Connector guide

Wazuh security event source

Use Wazuh as an upstream telemetry source while keeping source health and ingestion boundaries visible.

Published 2026-08-17 Reviewed 2026-08-17
What this page establishes

How Wazuh can be represented as a Cybatar event source for downstream event handling, investigation and security operations when an ingestion path is configured.

What Cybatar can represent

Wazuh is named in the Cybatar Event Sources interface as a system that can feed the platform. Cybatar event-source records can store source identity, vendor/product information, status, health and last-seen context. The SIEM pipeline provides receiver, parser, raw-batch and normalized-event workflow surfaces for deployments that connect source data into it.

What is not claimed

A Wazuh-maintained or Wazuh-certified integration. Automatic compatibility with every Wazuh version, deployment or event format. Guaranteed parity with Wazuh-native dashboards or detection logic.

Implementation questions

VerifyWhich Wazuh events or alerts should be forwarded?
VerifyWhich transport and authentication mechanism will be used?
VerifyWhich fields need normalization or enrichment in Cybatar?
VerifyWhich events should trigger correlation, alert or incident workflows?
SIEM Event Pipelinehttps://cybatar.co/platform/siem-event-pipeline Correlation & Security Orchestrationhttps://cybatar.co/platform/orchestration-correlation SIEM guidehttps://cybatar.co/cybersecurity/siem

Frequently asked questions

Is Wazuh listed as a Cybatar event source?

Yes. The current Event Sources interface names Wazuh as one of the systems that can feed Cybatar.

Is this a claim of an official Wazuh integration?

No. It documents a supported source pattern and does not claim official vendor certification.

Can Wazuh events enter the Cybatar SIEM workflow?

They can when a suitable ingestion path, parser and normalization mapping are configured for the deployment.

Connector claim boundary

Connector availability depends on deployment configuration, credentials, source APIs, data formats and enabled modules. Public connector pages do not claim vendor certification, marketplace approval, complete field coverage, real-time delivery guarantees, universal API support or a successful connection to a third-party service unless that is verified in the specific deployment.