Network SIEM: Wazuh Syslog Collector & Automated IP Containment

# Network SIEM Automated Containment Handler
import sys
import json
import subprocess

def handle_wazuh_alert(alert_data):
    rule_id = alert_data.get("rule", {}).get("id")
    src_ip = alert_data.get("data", {}).get("srcip")
    
    # Rule 5712: SSH Brute force attack detected
    if rule_id in [5710, 5712, 31108] and src_ip:
        print(f"[ALERT] Blocking malicious IP: {src_ip}")
        subprocess.run(["iptables", "-A", "INPUT", "-s", src_ip, "-j", "DROP"], check=True)
        return True
    return False

if __name__ == "__main__":
    alert = json.loads(sys.stdin.read())
    handle_wazuh_alert(alert)