Integrating Fibratus with Wazuh: supported approach for forwarding alerts/events?

[jibcnc]

Hi Fibratus team, and thanks for the great project!

I'm evaluating Fibratus as a source of Windows endpoint telemetry and would like to
know whether it can work together with Wazuh (agent + manager),
and what the recommended way to do so is.

Setup

• Fibratus version: 3.1.1
• OS: Windows 11
• Wazuh version: 4.14 (agent on the same Windows host)

What I'd like to achieve
Have Fibratus detections (rule matches) show up in Wazuh as alerts, so they can be
searched and correlated in the Wazuh dashboard.

Questions

1. Is there an officially supported or recommended way to send Fibratus alerts/events
   to Wazuh?
2. Can Fibratus write alerts to the Windows Event Log so the Wazuh agent can collect
   them via <localfile> with eventchannel? If yes, which channel/source name and
   Event IDs are used?
3. Is there a way to output alerts as JSON to a file that the Wazuh agent can read
   (log_format: json)? If so, what is the schema/field structure?
4. Are there known issues running both agents on the same host (CPU/memory overhead,
   ETW session conflicts, overlapping with Sysmon if present)?
5. Does anyone have example Wazuh decoders/rules for Fibratus events, or MITRE ATT&CK
   field mapping that I could reuse?

I've gone through the docs but couldn't find a dedicated section on this.
If there is an existing guide or issue, a link would be much appreciated.

Thank you!

[rabbitstack]

Hi @jibcnc

Answering your questions:

1. What folks typically do is consume Fibratus alerts from the EventLog. You'd likely want to override the alert format to JSON by modifying the configuration file under alertsenders.eventlog.format=json
2. Yes, as per above. You'll find Fibratus events in the Application channel under the Fibratus event source.
3. It is currently not possible, but you can write the alerts to EventLog instead, using the JSON format.
4. As far as we know, there are no conflicts with the Wazuh Agent
5. @NovaSky0x1 came up with Wazuh decoders/rules, so maybe he can share them here? 🙏

Kind regards

[jibcnc]

Thanks a lot for the quick and detailed answers! This is exactly what I needed.

I'll set up alertsenders.eventlog.format=json and have the Wazuh agent collect
from the Application channel with the Fibratus source.

@NovaSky0x1, if you're able to share your Wazuh decoders/rules, that would be
really appreciated. Happy to test them and report back.