convert Wazuh json logs to STIX format

[Srinivas0rch]

Hi,

as a requirement for Wazuh json logs to STIX format, i came across your project. However, i could not understand the sample example and now wondering if there is a way to convert json logs to STIX format using this tool mentioned in this project. Any suggestions/help on this is highly appreciated!

[clenk]

Hi, do you know if you need STIX 1 or STIX 2? This repository is for the old STIX 1 format - the Python API for the newer STIX 2 format can be found here: https://github.com/oasis-open/cti-python-stix2/

If you had a mapping of Wazuh log fields to their corresponding fields in STIX, you could use Python and one of these libraries to convert them. If you use OpenCTI (which uses STIX) it looks like you might be able to use this to import Wazuh logs and then export as STIX? https://github.com/juaromu/wazuh-opencti I have not used it myself though.

[Srinivas0rch]

@clenk, I want STIX2 (2.1 to be precise). Thank you for your inputs. However, am not using OpenCTI. I have integrated Wazuh and MISP. and now, i'm looking to convert the Wazuh logs to STIX2.1 format.

[clenk]

MISP does have a STIX converter: https://github.com/MISP/misp-stix - I am not sure if that will fill your need or not.

I will close this issue now as this repository is only for STIX 1 and you need STIX 2.1.