Wazuh → Shuffle SOARAutomationAutomation

A Shuffle workflow that receives Wazuh alerts over a webhook, filters them by severity, and automatically sends an email notification for anything serious enough to warrant one, instead of relying on someone watching the Wazuh dashboard.

Workflow

Wazuh Alert
    │
    ▼
Receive Webhook
    │
    ▼
Extract Rule ID
    │
    ▼
Extract Alert Level
    │
    ▼
IF Alert Level >= 10
    │
 ┌──┴──┐
Yes    No
 │      │
 ▼      ▼
Send   Ignore
Email
 │
 ▼
Log Result

The webhook receives the alert as raw JSON from Wazuh. rule.id and rule.level are pulled out of that payload and passed into an IF/ELSE routing node, which checks whether the level is >= 10. If it is, the workflow sends an email through the Gmail SMTP connector and logs the result. If not, the alert is dropped: this keeps low-severity noise from generating an email every time.

Test case used

Wazuh's default rule 5710 logs at severity level 5. Since this workflow only forwards level >= 10, a small local rule override was added on the Wazuh side (local_rules.xml) to raise this specific rule to level 10, so repeated SSH attempts against a non-existent username would actually reach the email step.

Setting it up

1. Import workflow-export.json into Shuffle (Workflows → Import).
2. Point Wazuh's <integration> block (in ossec.conf) at the webhook URL Shuffle generates for the trigger node.
3. Configure the email node with a Gmail account and an App Password: Gmail rejects plain account-password SMTP auth for most accounts, so a normal password will fail silently here.
4. Trigger a test alert (see the SSH command below) and confirm the execution log shows all nodes completed.

# Generates Wazuh rule 5710 on the target host
ssh nonexistentuser123@<target-host>

Email notification

Once an alert crosses the severity threshold, Shuffle sends an email containing the rule ID, alert name, and severity to the configured address: usually within a few seconds of the SSH attempt.

Screenshots of the workflow, the IF/ELSE condition, the received email, and the execution log are in ../screenshots/shuffle-automation/.

Notes · things that tripped me up

• The workflow executed successfully end-to-end with no errors, but no email arrived. Testing the SMTP credentials outside of Shuffle with a short Python script (smtplib.SMTP_SSL) isolated the problem to Gmail rejecting the plain account password: switching to an App Password fixed it in both the script and Shuffle's email node.