How to Push Wazuh Alerts to Your Discord Server

In this episode, we will cover how to push Wazuh alerts to your Discord server! This integration is extremely useful because most of us already use Discord. Why monitor a Wazuh dashboard when you can monitor your network directly through Discord?

Example of Discord Alerts

Here is an example of what we’ll create in this episode:

Create a Discord Webhook

Open Discord.
Go to the server you want to use for Wazuh alerts.
Create a new text channel.

Right-click your server.
Open server settings.
Choose “Integrations.”

Click “Create a Webhook.”

Click “New Webhook.”
Name it something like “WazuhAlerts.”
Choose the channel created earlier.
Copy the webhook URL and save it; we’ll use it soon.

Configure Wazuh Dashboard Integration

(Server Management / Settings)

Click “Edit Configuration” in the top right corner.

Paste the code below after the <global></global> section:

 <integration>
     <name>custom-discord</name>
     <hook_url>https://discord.com/api/webhooks/XXXXXXXXXXX</hook_url>
     <alert_format>json</alert_format>
 </integration>

Then paste your Discords Webhook in the tags.

Click Save.
Restart the Wazuh Manager.

SSH into your Wazuh Dashboard Machine

Next we need to SSH into your Wazuh Dashboard Machine/VM (etc.) to configure the following settings.

ssh username@ip_address

After logging in, run:

sudo su

Then move to the integrations directory:

cd /var/ossec/integrations

List existing files:

ls -l

Download the custom Discord integrations:

wget https://raw.githubusercontent.com/maikroservice/wazuh-integrations/main/discord/custom-discord
wget https://raw.githubusercontent.com/maikroservice/wazuh-integrations/main/discord/custom-discord.py

To verify downloads:

ls -l

If files appear white, they lack execution permissions. Apply the correct ones:

sudo chmod 750 /var/ossec/integrations/custom-*
sudo chown root:wazuh /var/ossec/integrations/custom-*

Check again:

ls -l

Install pip dependencies (ignore the “running as root” warning):

# Debian / Ubuntu
sudo apt-get install python3-pip
pip3 install requests

Restart Wazuh controls:

/var/ossec/bin/wazuh-control restart

Verify Discord Alerts

Go to your Discord channel and verify that Wazuh restarted successfully with a confirmation alert.

Test the alert by attempting to SSH into one of your Wazuh-monitored machines with incorrect credentials. You should see a Discord notification within seconds.