What Happened
We submitted a pull request to the Wazuh integrations repository adding a complete Flowtriq DDoS detection integration. It was reviewed and merged on July 6, 2026. The integration includes a CEF syslog decoder, 20+ alert rules with MITRE ATT&CK mapping, and sample log lines for testing.
This is not a webhook or a one-way notification. It is a full SIEM integration: Flowtriq sends structured CEF syslog events to your Wazuh manager, Wazuh decodes and parses every field, and the rules engine generates alerts with proper severity levels and MITRE technique IDs. DDoS events show up in the Wazuh dashboard alongside your other security alerts, correlated by time, source, and target.
How to Set It Up
The integration works via CEF-formatted syslog. Configure Flowtriq to forward DDoS events to your Wazuh manager's syslog listener, then install the decoder and rules files.
- Copy the decoder file to your Wazuh manager:
/var/ossec/etc/decoders/flowtriq_decoders.xml - Copy the rules file:
/var/ossec/etc/rules/flowtriq_rules.xml - Configure Flowtriq to send CEF syslog to your Wazuh manager's IP and port.
- Restart the Wazuh manager:
systemctl restart wazuh-manager
You can verify the decoder works immediately by feeding a sample log line through wazuh-logtest:
/var/ossec/bin/wazuh-logtest
Paste one of the included sample log lines and confirm that all fields are extracted correctly.
What Gets Decoded
The decoder parses all CEF extension fields from Flowtriq's syslog output. Every field that matters during a DDoS investigation is extracted and indexed:
| Field | Description |
|---|---|
dstip |
Target IP address under attack |
attack_family |
Attack classification: UDP flood, SYN flood, ICMP flood, DNS amplification, etc. |
severity |
Attack severity from Flowtriq's classification engine |
peak_pps |
Peak packets per second observed during the attack |
peak_bps |
Peak bits per second |
source_count |
Number of unique source IPs contributing to the attack |
incident_id |
Flowtriq incident identifier for cross-referencing |
message |
Human-readable event description |
Alert Rules and MITRE Mapping
The integration includes alert rules covering two event types (attack detected, attack resolved) across all attack families, with severity levels mapped to Wazuh alert levels 5 through 14:
- Level 10-12: Active DDoS attacks detected, severity varies by attack family and volume
- Level 13-14: Critical or high-severity attacks requiring immediate response
- Level 5: Attack resolved events (informational)
Every attack rule is mapped to the relevant MITRE ATT&CK techniques:
- T1498 (Network Denial of Service) for volumetric and amplification attacks
- T1499 (Endpoint Denial of Service) for application-layer and resource exhaustion attacks
This means DDoS events appear correctly in Wazuh's MITRE ATT&CK dashboard. Security teams can see DDoS attacks alongside other mapped threats and track coverage across the ATT&CK framework.
Why This Matters
Wazuh is the most widely deployed open-source SIEM/XDR platform. Security teams use it for log analysis, intrusion detection, file integrity monitoring, and compliance reporting. Adding DDoS detection events to Wazuh means security teams see network-layer attacks in the same dashboard where they already track host-level threats.
Before this integration, DDoS events lived in a separate system. If your SOC team was investigating an incident in Wazuh and needed to check whether a DDoS attack was happening concurrently, they had to open a second dashboard. With native Wazuh rules, DDoS alerts appear alongside everything else, correlated by timestamp and target IP. The SOC analyst does not need to context-switch.
The MITRE ATT&CK mapping is particularly useful for compliance and reporting. Organizations that track ATT&CK coverage can now include network-layer DoS techniques in their detection matrix without building custom rules.
The Contribution
The PR added four files to the Wazuh integrations repository:
integrations/flowtriq/ruleset/flowtriq_decoders.xml- CEF syslog decoder with full field extractionintegrations/flowtriq/ruleset/flowtriq_rules.xml- 20+ alert rules (IDs 100900-100920) with MITRE mappingintegrations/flowtriq/sample_logs.txt- 11 sample log lines covering all attack families and event typesintegrations/flowtriq/README.md- Setup and configuration guide
The decoder uses Wazuh's standard regex-based field extraction to parse CEF format. The rules use decoded fields for conditional matching, so each attack family can trigger at the appropriate alert level without overly broad pattern matching.
Flowtriq detects. Wazuh correlates. Get DDoS detection events in your SIEM with native decoders and MITRE ATT&CK mapping. $9.99/node/month, 14-day free trial. Start your trial.