Integrations

    Send Wazuh Alerts to Slack (Webhook Integration)

    Forward Wazuh alerts to a Slack channel using the built-in Slack integration. Covers webhook setup, severity filtering and rule filtering.

    WazuGuardix Team June 16, 2026 5 min read

    Wazuh ships with a Slack integration script that POSTs alerts to an incoming webhook. You can filter by alert level, rule ID or rule group so only what matters reaches the channel.

    1. Create a Slack incoming webhook

    In Slack go to Apps -> Incoming Webhooks -> Add to channel and copy the webhook URL.

    2. Add the integration to ossec.conf

    <integration>
  <name>slack</name>
  <hook_url>https://hooks.slack.com/services/XXX/YYY/ZZZ</hook_url>
  <level>10</level>
  <alert_format>json</alert_format>
</integration>

    3. Restart the manager

    systemctl restart wazuh-manager

    Note: Use <rule_id> or <group> to send specific alerts (e.g. authentication_failed) to dedicated channels.

    We design Slack/Teams routing tied to on-call rotations, contact us.

    Official reference

    Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:

    WazuhSlackAlerting

    Need help running Wazuh in production?

    Our team designs, deploys and operates Wazuh end to end, from indexer sizing to custom rules and 24/7 SOC monitoring.

    Related guides

    Integrations

    Integrate Wazuh with VirusTotal for Malware Detection

    Auto-scan every new file Wazuh sees against 70+ AV engines using the VirusTotal API.

    Read guide
    Integrations

    Wazuh + TheHive Integration for SOC Case Management

    Turn Wazuh alerts into TheHive cases. Get a full SOC workflow with observables, tasks and Cortex analyzers.

    Read guide
    Integrations

    Monitor Docker Containers with Wazuh

    See every docker exec, image pull and container start in Wazuh, using the built-in docker-listener wodle.

    Read guide