Do you know the way to send event to the Wazuh server without wazuh agent.

[JayJay-K]

Question

Hello.

Now I'm gathering security events with json format from the Tetragon solution.
And I deployed Vector and its source is tetragon event file.

Now I hope to send them to Wazuh server without Wazuh agent.
I know Wazuh solution introduces SSH connection from Wazuh server to endpoint to get an events.
But it's not a proper solution to get Tetragon events from endpoint.

Additionally, Wazuh solution recommand using Wazuh agent to get Tetragon events with following connections
endpoint:[Tetragon event log file --> Wazuh agent] ------> server:[Wazuh server]
But I hope to use vector to send Tetragon event to Wazuh server without Wazuh agent.

Do you happen to have a good idea for it?
Thanks.

Vector Config

No response

Vector Logs

No response

[agrovr]

Yes. For a self-managed Wazuh manager, the supported agentless path is its remote syslog listener. Vector should send syslog to that listener; it should not try to imitate the encrypted Wazuh agent protocol on port 1514.

On the Wazuh manager, add a listener inside ossec_config (use the real Vector source IP/CIDR):

<remote>
  <connection>syslog</connection>
  <port>514</port>
  <protocol>tcp</protocol>
  <allowed-ips>VECTOR_SOURCE_IP_OR_CIDR</allowed-ips>
</remote>

Then restart wazuh-manager. allowed-ips is mandatory for a syslog connection, and the firewall/security policy must also permit TCP 514 from the Vector host/pod network.

Since the file source places each Tetragon JSON line in the event's message field, a Vector socket sink can wrap that message in standard syslog framing:

sinks:
  wazuh:
    type: socket
    inputs:
      - tet_in
    address: wazuh-manager.example:514
    mode: tcp
    framing:
      method: newline_delimited
    encoding:
      codec: syslog
      syslog:
        rfc: rfc5424

Before sending production traffic, copy one emitted line and run /var/ossec/bin/wazuh-logtest on the manager. Wazuh has a built-in JSON decoder, so it can extract fields from single-line JSON, but you will probably still need custom Wazuh rules (and possibly a small decoder adjustment) to turn the Tetragon fields you care about into alerts. wazuh-logtest will show exactly which decoder/rules match instead of leaving that to guesswork.

Two operational caveats:

1. Wazuh's direct syslog input is not equivalent to the secure agent channel: source-IP allowlisting is not authentication, and plain TCP syslog is not encrypted. Keep it on a private network and tightly firewall it, or place a TLS-capable relay/VPN in front if the traffic crosses an untrusted network.
2. Vector documents the socket sink as best-effort delivery. If temporary Wazuh outages must not lose events, configure a disk buffer on this sink, but there still is no Wazuh application-level acknowledgement on the direct syslog route.

Relevant docs: Wazuh remote syslog setup, Wazuh JSON decoder and wazuh-logtest, and Vector socket/syslog sink.