SIEM with Wazuh: agents, rules, active response
You connect Linux and Windows agents to a Wazuh manager, write decoders and rules, enable integrity and vulnerability modules and block an attacking IP automatically with active response.
Level 201 · 16 lessons · 18 practice labs
Lessons
Setup and agents
- Wazuh components and data flow
- Agent enrolment and agent groups
- Collecting logs with ossec.conf
- Navigating the dashboard and searching events
- Short task: add a Linux and a Windows agent to a group and see their logs
Decoders and rules
- Decoders: parsing a custom application log
- Rule structure: level, match, group
- Correlated rules: frequency and time window
- Testing rules with wazuh-logtest
- Short task: write a high-level alert for ten failed logins in five minutes
Modules
- The file integrity monitoring module
- Security configuration assessment (SCA)
- The vulnerability detection module
- Active response: blocking an attacking IP automatically
- Short task: set up active response so a false positive can’t lock you out
Capstone
- Capstone: build a small company’s SIEM with Wazuh and catch the first attack
Practice labs
- Enrol a new Linux agent in a group and see its logs: Enrol the agent, assign it to the web servers group and show the first event arrive in the dashboard.
- Find why an agent is disconnected: Review agent and manager logs, fix the key or port problem and bring the agent back to active.
- Collect a custom app log through ossec.conf: Add a localfile entry to the group configuration and show the application lines reach the manager.
- See which rule a line hits with wazuh-logtest: Test the given log line and note the decoder, rule ID and level.
- Write a decoder for a custom log format: Write a decoder extracting user and source address from a shipment tracking app’s log and verify it with logtest.
- Find the event this rule misses and fix the rule: Find the line that fails to match because of letter case, fix the rule and show both lines are caught.
- Write a correlated rule for eight failed logins in ten minutes: Write a rule with frequency and timeframe, trigger it with attempts from one source and check its level.
- Write a child rule lowering the level for admin work: Add a child rule that lowers the level for events from the known admin server without changing the parent rule.
- Turn on file integrity monitoring for a folder: Put the web root under real-time monitoring, change a file and find the alert in the dashboard.
- Fix the failed items in the configuration assessment: Pick three failed items from the SCA results, fix them on the server and show they pass in the next scan.
- Set up active response without locking yourself out: Set up a response blocking an attacking address for ten minutes, add the allow list and test with two addresses.
- Verify and prioritise the vulnerability module’s findings: Compare the package version on the agent with the finding, set aside the false positive and patch the real one.
- Filter one agent’s events from the last hour in the dashboard: Filter by agent name and time range, open the highest-level event and read its fields.
- Resolve an agent that enrolled twice under the same name: Find in the manager log that a rebuilt server clashes with its old agent record, remove the old entry, re-enrol with a new key and show its group is kept.
- Collect a multi-line application log as single events: Collect a log containing Java stack traces with a multi-line setting, write a decoder and show each error arrives as one alert.
- Find the five rules that fire the most alerts: Pull from the dashboard the five rules that fired most in the last 24 hours with their counts and mark the likely noise source.
- View one agent’s vulnerability inventory in the dashboard: List the selected agent’s critical and high vulnerabilities with package name and version.
- Enable the vulnerability detection module and verify the first results: Turn the module on in the manager, check the agent’s package inventory arrives and compare one finding with the version on the host.
About this course
You connect Linux and Windows agents to a Wazuh manager, write decoders and rules, enable integrity and vulnerability modules and block an attacking IP automatically with active response.
What you will learn
- Setup and agents
- Decoders and rules
- Modules
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.