← All integrations
Endpoints & servers · integration
Wazuh
Host & endpoint evidence from Wazuh — hardening (SCA), file integrity and vulnerabilities that cloud posture cannot reach.
ISO 27001SOC 2PCI DSSRBIDPDPA
What ProofLayer proves
Read-only evidence, evaluated against versioned rules.
- Each host meets its CIS/hardening benchmark score (SCA), with no failed checks over the limit
- File-integrity monitoring is active and scanning each host recently
- No detected critical CVEs, and high-severity CVEs within the limit
- Host names are stored only as a hash on the manifest — never in the clear (DPDPA minimisation)
Configure in ProofLayer
Live in minutes.
- Connections → New connection → pick this provider and name the account.
- Enter the Wazuh manager node name (shown on every manifest), the Manager REST API URL, and a read-only API user. The password is stored write-only and sealed.
- Click Test connection — ProofLayer verifies read access from the control plane and reports a clear reason if anything is off.
- Set the scan schedule; every run appends to the evidence chain for this account.
- Choose the framework mapping(s) and, optionally, a push target (CISO Assistant, a Jira/ServiceNow ticket on failure, or a scheduled auditor pack).
Grant access from your side
Read-only, least-privilege, revocable.
You create the access in your own console and paste a credential ProofLayer stores sealed — it never writes to your systems.
- In the Wazuh dashboard (Server management → Security), create a read-only API user with the agent:read and sca:read permissions.
- ProofLayer exchanges the user’s basic credentials for a short-lived JWT and reads only the SCA assessment endpoints — never the raw alert stream, and nothing is written back.
In-account agent option. Run the agent with WAZUH_URL, WAZUH_USER and WAZUH_PASSWORD on your host (WAZUH_INSECURE_SKIP_VERIFY=true only for a self-signed manager cert) — the common shape, since Wazuh usually lives inside your network. The collector posts evidence outbound-only, so ProofLayer holds no credential into your environment.