Network SIEM: Wazuh Syslog Collector & Automated IP Containment

Back to all nuggets
Python python

Published on July 25, 2026

Code Snippet

# Network SIEM Automated Containment Handler
import sys
import json
import subprocess

def handle_wazuh_alert(alert_data):
    rule_id = alert_data.get("rule", {}).get("id")
    src_ip = alert_data.get("data", {}).get("srcip")
    
    # Rule 5712: SSH Brute force attack detected
    if rule_id in [5710, 5712, 31108] and src_ip:
        print(f"[ALERT] Blocking malicious IP: {src_ip}")
        subprocess.run(["iptables", "-A", "INPUT", "-s", src_ip, "-j", "DROP"], check=True)
        return True
    return False

if __name__ == "__main__":
    alert = json.loads(sys.stdin.read())
    handle_wazuh_alert(alert)

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

Premium Content Locked

Subscribe to unlock the full article, detailed explanations, and downloadable resources.

Subscribe to Read Full

Love this nugget?

Support our work to get exclusive premium nuggets and early access via a personal activation link.

Support Now & Unlock Exclusive Content