{"id":48159679,"url":"https://github.com/jnthans/wazuh-cortex-xdr","last_synced_at":"2026-04-04T17:23:20.908Z","repository":{"id":346946997,"uuid":"1170129192","full_name":"jnthans/wazuh-cortex-xdr","owner":"jnthans","description":"Wazuh SIEM wodle that ingests alerts and incidents from Palo Alto's Cortex XDR via the Cortex XDR REST API.","archived":false,"fork":false,"pushed_at":"2026-03-26T15:59:46.000Z","size":310,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2026-03-27T00:51:31.628Z","etag":null,"topics":["cortex-xdr","security","siem","wazuh","xdr"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jnthans.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-01T18:37:57.000Z","updated_at":"2026-03-26T16:00:18.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/jnthans/wazuh-cortex-xdr","commit_stats":null,"previous_names":["jnthans/wazuh-cortex-xdr"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/jnthans/wazuh-cortex-xdr","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jnthans%2Fwazuh-cortex-xdr","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jnthans%2Fwazuh-cortex-xdr/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jnthans%2Fwazuh-cortex-xdr/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jnthans%2Fwazuh-cortex-xdr/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jnthans","download_url":"https://codeload.github.com/jnthans/wazuh-cortex-xdr/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jnthans%2Fwazuh-cortex-xdr/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31407644,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-04T10:20:44.708Z","status":"ssl_error","status_checked_at":"2026-04-04T10:20:06.846Z","response_time":60,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cortex-xdr","security","siem","wazuh","xdr"],"created_at":"2026-04-04T17:23:20.401Z","updated_at":"2026-04-04T17:23:20.903Z","avatar_url":"https://github.com/jnthans.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cortex XDR - Wazuh Integration\n\nWazuh wodle that ingests **alerts** and **incidents** from Palo Alto Networks Cortex XDR into Wazuh SIEM via the Cortex XDR REST API.\n\n---\n\n## Dashboard\n\n![Cortex XDR dashboard](artifacts/images/wazuh_cortex_xdr_dash_pv.png)\n\n*Custom Cortex XDR dashboard showing alert counts by severity, event type word cloud, category breakdown, top endpoints, MITRE tactic mappings, and other metrics.*\n\n![Wazuh Threat Hunting dashboard with Cortex XDR incidents](artifacts/images/wazuh_xdr_th_pv.png)\n\n*Wazuh Threat Hunting dashboard filtered by integration `cortex-xdr`, showing ingested incidents with severity levels, rule IDs, and descriptions.*\n\n---\n\n## Features\n\n- **Single wodle block** — one scheduled command captures both alerts and incidents, including the full incident lifecycle: new, under investigation, and closed.\n- **Stateful** — bookmarks last-seen timestamps per data stream. Each run only pulls what changed.\n- **Long-term archival** — Cortex does not retain data indefinitely. This integration persists all events in OpenSearch for compliance, forensics, and historical investigation.\n- **MITRE ATT\u0026CK tactic tagging** — incidents with tactic mappings are tagged with `mitre_*` groups for custom dashboard filtering.\n- **Closed incident tracking** — resolved incidents are ingested as level 3 archival records.\n- **Secure credential management** — FQDN, API key, and key ID stored in a restricted secrets file or systemd encrypted credentials.\n- **Multi-tenant** — deploy a separate directory and `run.sh` per tenant.\n- **Zero external Python dependencies** — stdlib only.\n\n---\n\n## Installation\n\n1. Copy `wodle/*` to `/var/ossec/wodles/cortex-xdr/` on the Wazuh manager (or agent host).\n2. Create `.secrets` from `.secrets.example` — set `XDR_FQDN`, `XDR_API_KEY`, `XDR_API_KEY_ID`. Set permissions `chmod 640, chown root:wazuh`.\n3. Copy `rules/cortex_xdr_rules.xml` to `/var/ossec/etc/rules/` and `rules/cortex_xdr_decoder.xml` to `/var/ossec/etc/decoders/`.\n4. Add a wodle stanza to `/var/ossec/etc/ossec.conf` using the example in [artifacts/configs/ossec_cortex_xdr.conf](artifacts/configs/ossec_cortex_xdr.conf).\n5. Restart Wazuh manager.\n\nSee [artifacts/configs/](artifacts/configs/) for ossec.conf examples and systemd credential configuration.\n\n---\n\n## Repository structure\n\n```\nwazuh-cortex-xdr/\n├── wodle/\n│   ├── cortex_xdr.py            ← Entry point, CLI, orchestration\n│   ├── cortex_xdr_alerts.py     ← Alert fetch and pagination\n│   ├── cortex_xdr_incidents.py  ← Incident fetch and pagination\n│   ├── cortex_xdr_utils.py      ← Auth, HTTP, atomic state, emit, logging, secrets\n│   ├── run.sh                   ← Runtime config wrapper (ossec.conf \u003ccommand\u003e target)\n│   └── .secrets.example         ← Credentials template (copy to .secrets)\n├── rules/\n│   ├── cortex_xdr_rules.xml     ← Custom Wazuh rules (IDs 100500–100599)\n│   └── cortex_xdr_decoder.xml   ← JSON decoder registration\n├── artifacts/\n│   ├── configs/\n│   │   ├── ossec_cortex_xdr.conf               ← ossec.conf wodle stanza examples\n│   │   └── cortex-xdr-credentials.conf         ← systemd drop-in for encrypted credentials\n│   ├── guides/\n│   │   ├── configuration.md                    ← All env vars, CLI flags, multi-tenant\n│   │   ├── rules-reference.md                  ← Rule families, severity mapping, MITRE, compliance\n│   │   └── troubleshooting.md                  ← Test commands, common errors, reset / backfill\n│   ├── images/\n│   │   ├── wazuh_cortex_xdr_dash_pv.png        ← Cortex XDR dashboard screenshot\n│   │   └── wazuh_xdr_th_pv.png                 ← Wazuh Threat Hunting dashboard screenshot\n│   └── objects/\n│       └── Cortex XDR.ndjson                    ← OpenSearch Dashboards saved object (importable)\n├── .gitignore\n└── README.md\n```\n\n---\n\n## How it works\n\n```\nossec.conf \u003cwodle command\u003e\n    └─► run.sh  (sets runtime config; execs cortex_xdr.py)\n            └─► cortex_xdr.py  (parses args, loads state, orchestrates fetchers)\n                    ├─► cortex_xdr_alerts.py     → xdr_api_post() → emit() → stdout\n                    └─► cortex_xdr_incidents.py  → xdr_api_post() → emit() → stdout\n                                                      ↑\n                                          cortex_xdr_utils.py\n                              (auth headers, HTTP, atomic state, emit, secrets)\n                                          ↑\n                          Secret priority chain (first match wins):\n                          [systemd $CREDENTIALS_DIRECTORY]\n                                    \u003e [.secrets file]\n                                    \u003e [environment variable]\n\nstdout ──► Wazuh wodle manager ──► cortex_xdr_decoder.xml ──► cortex_xdr_rules.xml\n                                                                       ↓\n                                                           OpenSearch / Dashboard\n```\n\nEach event is emitted as a single JSON line. All XDR API fields are nested under the `xdr` key to avoid collisions with Wazuh's reserved field names. Wazuh's JSON decoder maps nested fields as `xdr.field_name` for rule matching and `data.xdr.field_name` in OpenSearch.\n\nEpoch-millisecond timestamp fields returned by the Cortex XDR API are converted to ISO 8601 strings before emission (e.g. `1706540499609` → `\"2024-01-29T18:41:39.609Z\"`). This causes OpenSearch's dynamic field mapping to detect them as date fields automatically — no custom index template is required.\n\n### Deployment topology\n\nThe wodle can run on three different hosts — the choice does not affect the wodle code itself:\n\n- **Manager / master node** (default) — simplest to deploy.\n- **Dedicated Wazuh agent host** — credentials never touch the manager; polling is independent of manager restarts and cluster failovers.\n- **Existing agent on a connected host** — any agent host with network access to the Cortex XDR API can run the wodle with no additional infrastructure.\n\n---\n\n## Reference docs\n\n- [Configuration reference](artifacts/guides/configuration.md) — all environment variables, CLI flags, multi-tenant setup\n- [Rules reference](artifacts/guides/rules-reference.md) — rule families, severity mapping, MITRE ATT\u0026CK, compliance groups\n- [Troubleshooting](artifacts/guides/troubleshooting.md) — test commands, common errors, state reset, backfill\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjnthans%2Fwazuh-cortex-xdr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjnthans%2Fwazuh-cortex-xdr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjnthans%2Fwazuh-cortex-xdr/lists"}