# Help Integrating Wazuh, MISP, and Logstash into a Preventive Security Analysis Module **URL:** \ **Category:** Logstash\ **Tags:** docker\ **Created:** [April 24, 2025, 2:34pm UTC](https://discuss.elastic.co/t/help-integrating-wazuh-misp-and-logstash-into-a-preventive-security-analysis-module/377493 "2025-04-24T14:34:57Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Nouaman\_Ahmamcha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nouaman_ahmamcha/32/142824_2.png) [@Nouaman\_Ahmamcha](https://discuss.elastic.co/u/Nouaman_Ahmamcha)\ **Post date:** [April 24, 2025, 2:34pm UTC](https://discuss.elastic.co/t/help-integrating-wazuh-misp-and-logstash-into-a-preventive-security-analysis-module/377493/1 "2025-04-24T14:34:57Z")
Hi everyone, I'm currently working on a preventive security analysis module as part of a project, and I'm integrating the following components: - **Wazuh** for SIEM and endpoint monitoring (running via Docker) - **MISP** for threat intelligence feeds (also Dockerized) - **Logstash** for parsing and enriching log data My objective is to: 1. Collect endpoint logs via Wazuh. 2. Forward relevant events to Logstash for processing. 3. Enrich or correlate this data using threat intel from **MISP**. 4. Optionally forward enriched logs to **OpenSearch or Elasticsearch** for visualization in Kibana or Dashboards. I’ve already got each service up and running in Docker containers. My questions are: - What is the recommended way to **pull MISP data into Logstash**? Is it best to use the MISP JSON API with the http\_poller plugin? - How can I ensure **Logstash and Wazuh** are efficiently integrated while keeping performance optimized in Docker? - Should enrichment happen directly in Logstash, or is it more efficient to do correlation in Wazuh before shipping logs? - Any sample pipelines or community plugins that could help with this kind of setup? Any guidance, examples, or links to similar use cases would be really appreciated! Thanks in advance!