Wazuh

Create a wazuh security source. In ossec.conf on the manager, use the integrator with a custom integration that POSTs the alert JSON, or the stock webhook form:

<integration>
  <name>custom-watchtower</name>
  <hook_url>https://&lt;edge&gt;/v1/security/&lt;source_id&gt;</hook_url>
  <api_key>&lt;secret&gt;</api_key>
  <alert_format>json</alert_format>
</integration>

The integration script must send Authorization: Bearer <api_key>.

Mapping: rule.description is security.rule (the numeric rule.id is kept as security.rule_id), rule.groups are the tags, full_log is the log body, timestamp the record time, agent.name/id/ip are host.name/host.id/host.ip. rule.level maps to a priority: 13 and up critical, 10 to 12 error, 7 to 9 warning, 4 to 6 notice, below that info.