Bash script for Wazuh vulnerability ingestion via syslog

wazuh-vulnerability-ingestion.sh

#!/bin/bash
# Wazuh Vulnerability Ingestion Script
# Source: https://williamzujkowski.github.io/posts/2025-10-06-automated-security-scanning-pipeline/
# Purpose: Send vulnerability scan results to Wazuh SIEM via syslog
# Usage: ./send-scans-to-wazuh.sh

WAZUH_MANAGER="10.0.10.5"
WAZUH_PORT="1514"

# Scan with Grype
grype registry.internal/myapp:latest -o json > /tmp/grype-scan.json

# Convert to Wazuh format
cat /tmp/grype-scan.json | jq -c '.matches[] | {
  "vulnerability_id": .vulnerability.id,
  "severity": .vulnerability.severity,
  "package": .artifact.name,
  "version": .artifact.version,
  "fixed_version": .vulnerability.fix.versions[0],
  "description": .vulnerability.description
}' | while read -r line; do
  echo "<134>vulnerability: $line" | nc -w1 $WAZUH_MANAGER $WAZUH_PORT
done