Wazuh SIEM Setup: Security Information and Event Management

Wazuh is an open-source security platform. It provides comprehensive security features including SIEM (Security Information and Event Management), IDS (Intrusion Detection System), vulnerability scanning, file integrity monitoring, and compliance auditing in a single platform.

What is Wazuh?

Core components and features:

Wazuh Server: Central management and analysis server
Wazuh Indexer: OpenSearch-based log indexing and search
Wazuh Dashboard: Kibana-based web interface
Wazuh Agent: Lightweight agent running on endpoints
Log Analysis: Real-time log collection and analysis
FIM (File Integrity Monitoring): File integrity monitoring
Vulnerability Detection: Vulnerability scanning
Compliance: PCI DSS, GDPR, HIPAA compliance auditing
Active Response: Automated threat response
Cloud Security: AWS, Azure, GCP security monitoring

Docker Installation

One-Command Installation

hljs bash

git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0
cd wazuh-docker/single-node

# Generate SSL certificates
docker compose -f generate-indexer-certs.yml run --rm generator

# Start Wazuh stack
docker compose up -d

Dashboard access:

https://SERVER_IP:443
Username: admin
Password: SecretPassword

Docker Compose Configuration

hljs yaml

version: '3.7'
services:
  wazuh.manager:
    image: wazuh/wazuh-manager:4.9.0
    container_name: wazuh-manager
    hostname: wazuh.manager
    restart: always
    ports:
      - "1514:1514"     # Agent connection
      - "1515:1515"     # Agent registration
      - "514:514/udp"   # Syslog
      - "55000:55000"   # API
    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
      - wazuh_etc:/var/ossec/etc
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
    environment:
      - INDEXER_URL=https://wazuh.indexer:9200
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword

  wazuh.indexer:
    image: wazuh/wazuh-indexer:4.9.0
    container_name: wazuh-indexer
    hostname: wazuh.indexer
    restart: always
    ports:
      - "9200:9200"
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"

  wazuh.dashboard:
    image: wazuh/wazuh-dashboard:4.9.0
    container_name: wazuh-dashboard
    hostname: wazuh.dashboard
    restart: always
    ports:
      - "443:5601"
    environment:
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - WAZUH_API_URL=https://wazuh.manager
    depends_on:
      - wazuh.indexer

Agent Installation

Linux Agent

hljs bash

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

sudo apt update
sudo WAZUH_MANAGER='WAZUH_SERVER_IP' apt install wazuh-agent -y

sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

Windows Agent

hljs powershell

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi -OutFile wazuh-agent.msi
msiexec.exe /i wazuh-agent.msi /q WAZUH_MANAGER='WAZUH_SERVER_IP'
NET START WazuhSvc

Agent Management

hljs bash

sudo /var/ossec/bin/agent_control -l
sudo /var/ossec/bin/agent_control -i AGENT_ID
sudo /var/ossec/bin/agent_control -R AGENT_ID

Log Analysis

Syslog Collection

hljs xml

<ossec_config>
  <remote>
    <connection>syslog</connection>
    <port>514</port>
    <protocol>udp</protocol>
    <allowed-ips>192.168.1.0/24</allowed-ips>
  </remote>
</ossec_config>

Custom Log File Monitoring

hljs xml

<ossec_config>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/myapp/app.log</location>
  </localfile>

  <localfile>
    <log_format>json</log_format>
    <location>/var/log/myapp/access.json</location>
  </localfile>
</ossec_config>

Custom Decoder and Rules

hljs xml

<!-- /var/ossec/etc/decoders/local_decoder.xml -->
<decoder name="myapp">
  <program_name>myapp</program_name>
</decoder>

<decoder name="myapp-auth">
  <parent>myapp</parent>
  <regex>Authentication (\S+) for user (\S+) from (\S+)</regex>
  <order>status, user, srcip</order>
</decoder>

hljs xml

<!-- /var/ossec/etc/rules/local_rules.xml -->
<group name="myapp,">
  <rule id="100001" level="5">
    <decoded_as>myapp-auth</decoded_as>
    <match>Authentication failed</match>
    <description>MyApp: Failed login attempt</description>
  </rule>

  <rule id="100002" level="10" frequency="5" timeframe="120">
    <if_matched_sid>100001</if_matched_sid>
    <same_source_ip />
    <description>MyApp: Brute force attack detected</description>
  </rule>
</group>

File Integrity Monitoring (FIM)

hljs xml

<ossec_config>
  <syscheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
    <scan_on_start>yes</scan_on_start>
    <directories check_all="yes" realtime="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes" realtime="yes">/var/www/html</directories>
    <directories check_all="yes" report_changes="yes">/etc/nginx</directories>
    <ignore>/etc/mtab</ignore>
    <ignore type="sregex">.log$|.swp$</ignore>
  </syscheck>
</ossec_config>

Vulnerability Detection

hljs xml

<ossec_config>
  <vulnerability-detector>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <run_on_start>yes</run_on_start>
    <provider name="canonical">
      <enabled>yes</enabled>
      <os>focal</os>
      <os>jammy</os>
      <update_interval>1h</update_interval>
    </provider>
    <provider name="nvd">
      <enabled>yes</enabled>
      <update_interval>1h</update_interval>
    </provider>
  </vulnerability-detector>
</ossec_config>

Active Response

hljs xml

<ossec_config>
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>100002</rules_id>
    <timeout>3600</timeout>
  </active-response>
</ossec_config>

Compliance Auditing

Wazuh provides compliance auditing for various security standards:

PCI DSS: Payment Card Industry Data Security Standard
GDPR: General Data Protection Regulation
HIPAA: Health Insurance Portability and Accountability Act
NIST 800-53: Federal Information Systems Security Controls
TSC SOC2: Service Organization Controls

Wazuh API

hljs bash

TOKEN=$(curl -k -X POST 'https://localhost:55000/security/user/authenticate' \
  -u wazuh-wui:MyS3cr37P450r.*- | jq -r '.data.token')

curl -k -X GET "https://localhost:55000/agents?pretty=true" \
  -H "Authorization: Bearer $TOKEN"

curl -k -X GET "https://localhost:55000/vulnerability/AGENT_ID?pretty=true" \
  -H "Authorization: Bearer $TOKEN"

Update

hljs bash

cd wazuh-docker/single-node
docker compose down
docker compose pull
docker compose up -d

Backup

hljs bash

docker exec wazuh-manager tar -czf /tmp/wazuh-backup.tar.gz /var/ossec/etc /var/ossec/logs /var/ossec/queue
docker cp wazuh-manager:/tmp/wazuh-backup.tar.gz ./wazuh-backup-$(date +%Y%m%d).tar.gz

By setting up Wazuh SIEM on your REXE servers, you can perform comprehensive security monitoring, log analysis, vulnerability scanning, and compliance auditing. The agent-based architecture allows you to manage all your servers from a centralized dashboard.

Wazuh SIEM Setup: Security Information and Event Management

Table of Contents