Hands-on with Wazuh SIEM: A Comprehensive Guide

By /

Listen to this Post

This post will upskill your Security career with hands-on experience on Wazuh, covering Security Monitoring, Log Analysis, Incident Response, and Threat Hunting.

🔰 Basics of Wazuh

🔰 Lab Setup

🔰 Log Analysis with Wazuh

🔰 Threat Detection

🔰 Incident Response

🔰 Threat Hunting

🔰 Additional Resources

You Should Know: Practical Wazuh Commands & Configurations

1. Installing Wazuh (Linux)

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && sudo chmod 644 /usr/share/keyrings/wazuh.gpg 
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee -a /etc/apt/sources.list.d/wazuh.list 
sudo apt update 
sudo apt install wazuh-manager 
sudo systemctl enable wazuh-manager 
sudo systemctl start wazuh-manager

2. Checking Wazuh Service Status

sudo systemctl status wazuh-manager

3. Blocking an IP for SSH Brute-Force (Linux)

sudo iptables -A INPUT -s <ATTACKER_IP> -j DROP

4. Disabling a Linux User Account

sudo usermod --expiredate 1 <username>

5. Monitoring File Integrity (FIM) in Wazuh

Edit `/var/ossec/etc/ossec.conf`:

<syscheck> 
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> 
</syscheck>

Then restart Wazuh:

sudo systemctl restart wazuh-manager

6. Integrating VirusTotal with Wazuh

Edit `/var/ossec/etc/ossec.conf`:

<integration> 
<name>virustotal</name> 
<api_key>YOUR_VIRUSTOTAL_API_KEY</api_key> 
</integration>

7. Suricata IDS Rule Example

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

What Undercode Say

Wazuh is a powerful open-source SIEM and XDR solution for threat detection, compliance, and incident response. Mastering Wazuh requires hands-on practice with log analysis, FIM, threat hunting, and automated response rules.

Key Linux Security Commands to Complement Wazuh:

  • Check open ports: `ss -tulnp`
  • Analyze logs in real-time: `journalctl -f`
  • Check user login attempts: `lastb`
  • Scan for rootkits: `chkrootkit`
  • Analyze network traffic: `tcpdump -i eth0 -w capture.pcap`
  • Check running processes: `ps aux | grep suspicious_process`

Windows Commands for Security Analysis:

  • Check active connections: `netstat -ano`
  • List scheduled tasks: `schtasks /query /fo LIST /v`
  • Check Windows Event Logs: `Get-WinEvent -LogName Security`
  • Scan for malware with Windows Defender: `mpcmdrun -Scan -ScanType 2`

Wazuh’s flexibility allows integration with Suricata, VirusTotal, and Graylog, making it a must-learn tool for cybersecurity professionals.

Expected Output:

A fully configured Wazuh SIEM system with:

✔ Log ingestion from multiple sources

✔ Active threat detection rules

✔ Automated incident response

✔ Integrated threat intelligence (VirusTotal, Suricata)

✔ Custom dashboards for real-time monitoring

For deeper learning, explore the provided Wazuh courses and book. 🚀

References:

Reported By: Ouardi Mohamed – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 TelegramFeatured Image

Related Posts: