Skip to main content
Back to Category

Wazuh SIEM Setup: Security Information and Event Management

Wazuh Docker installation, agent deployment, log analysis, file integrity monitoring, vulnerability scanning, compliance auditing and dashboard.

Read time: 20 min Monitoring
wazuhsiemsecuritylog analysisidscompliancedocker
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Wazuh SIEM Setup: Security Information and Event Management

Wazuh is an open-source security platform. It provides comprehensive security features including SIEM (Security Information and Event Management), IDS (Intrusion Detection System), vulnerability scanning, file integrity monitoring, and compliance auditing in a single platform.

What is Wazuh?

Core components and features:

  • Wazuh Server: Central management and analysis server
  • Wazuh Indexer: OpenSearch-based log indexing and search
  • Wazuh Dashboard: Kibana-based web interface
  • Wazuh Agent: Lightweight agent running on endpoints
  • Log Analysis: Real-time log collection and analysis
  • FIM (File Integrity Monitoring): File integrity monitoring
  • Vulnerability Detection: Vulnerability scanning
  • Compliance: PCI DSS, GDPR, HIPAA compliance auditing
  • Active Response: Automated threat response
  • Cloud Security: AWS, Azure, GCP security monitoring

Docker Installation

One-Command Installation

hljs bash
git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0
cd wazuh-docker/single-node

# Generate SSL certificates
docker compose -f generate-indexer-certs.yml run --rm generator

# Start Wazuh stack
docker compose up -d

Dashboard access:

https://SERVER_IP:443
Username: admin
Password: SecretPassword

Docker Compose Configuration

hljs yaml
version: '3.7'
services:
  wazuh.manager:
    image: wazuh/wazuh-manager:4.9.0
    container_name: wazuh-manager
    hostname: wazuh.manager
    restart: always
    ports:
      - "1514:1514"     # Agent connection
      - "1515:1515"     # Agent registration
      - "514:514/udp"   # Syslog
      - "55000:55000"   # API
    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
      - wazuh_etc:/var/ossec/etc
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
    environment:
      - INDEXER_URL=https://wazuh.indexer:9200
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword

  wazuh.indexer:
    image: wazuh/wazuh-indexer:4.9.0
    container_name: wazuh-indexer
    hostname: wazuh.indexer
    restart: always
    ports:
      - "9200:9200"
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"

  wazuh.dashboard:
    image: wazuh/wazuh-dashboard:4.9.0
    container_name: wazuh-dashboard
    hostname: wazuh.dashboard
    restart: always
    ports:
      - "443:5601"
    environment:
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - WAZUH_API_URL=https://wazuh.manager
    depends_on:
      - wazuh.indexer

Agent Installation

Linux Agent

hljs bash
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

sudo apt update
sudo WAZUH_MANAGER='WAZUH_SERVER_IP' apt install wazuh-agent -y

sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

Windows Agent

hljs powershell
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi -OutFile wazuh-agent.msi
msiexec.exe /i wazuh-agent.msi /q WAZUH_MANAGER='WAZUH_SERVER_IP'
NET START WazuhSvc

Agent Management

hljs bash
sudo /var/ossec/bin/agent_control -l
sudo /var/ossec/bin/agent_control -i AGENT_ID
sudo /var/ossec/bin/agent_control -R AGENT_ID

Log Analysis

Syslog Collection

hljs xml
<ossec_config>
  <remote>
    <connection>syslog</connection>
    <port>514</port>
    <protocol>udp</protocol>
    <allowed-ips>192.168.1.0/24</allowed-ips>
  </remote>
</ossec_config>

Custom Log File Monitoring

hljs xml
<ossec_config>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/myapp/app.log</location>
  </localfile>

  <localfile>
    <log_format>json</log_format>
    <location>/var/log/myapp/access.json</location>
  </localfile>
</ossec_config>

Custom Decoder and Rules

hljs xml
<!-- /var/ossec/etc/decoders/local_decoder.xml -->
<decoder name="myapp">
  <program_name>myapp</program_name>
</decoder>

<decoder name="myapp-auth">
  <parent>myapp</parent>
  <regex>Authentication (\S+) for user (\S+) from (\S+)</regex>
  <order>status, user, srcip</order>
</decoder>
hljs xml
<!-- /var/ossec/etc/rules/local_rules.xml -->
<group name="myapp,">
  <rule id="100001" level="5">
    <decoded_as>myapp-auth</decoded_as>
    <match>Authentication failed</match>
    <description>MyApp: Failed login attempt</description>
  </rule>

  <rule id="100002" level="10" frequency="5" timeframe="120">
    <if_matched_sid>100001</if_matched_sid>
    <same_source_ip />
    <description>MyApp: Brute force attack detected</description>
  </rule>
</group>

File Integrity Monitoring (FIM)

hljs xml
<ossec_config>
  <syscheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
    <scan_on_start>yes</scan_on_start>
    <directories check_all="yes" realtime="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes" realtime="yes">/var/www/html</directories>
    <directories check_all="yes" report_changes="yes">/etc/nginx</directories>
    <ignore>/etc/mtab</ignore>
    <ignore type="sregex">.log$|.swp$</ignore>
  </syscheck>
</ossec_config>

Vulnerability Detection

hljs xml
<ossec_config>
  <vulnerability-detector>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <run_on_start>yes</run_on_start>
    <provider name="canonical">
      <enabled>yes</enabled>
      <os>focal</os>
      <os>jammy</os>
      <update_interval>1h</update_interval>
    </provider>
    <provider name="nvd">
      <enabled>yes</enabled>
      <update_interval>1h</update_interval>
    </provider>
  </vulnerability-detector>
</ossec_config>

Active Response

hljs xml
<ossec_config>
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>100002</rules_id>
    <timeout>3600</timeout>
  </active-response>
</ossec_config>

Compliance Auditing

Wazuh provides compliance auditing for various security standards:

  • PCI DSS: Payment Card Industry Data Security Standard
  • GDPR: General Data Protection Regulation
  • HIPAA: Health Insurance Portability and Accountability Act
  • NIST 800-53: Federal Information Systems Security Controls
  • TSC SOC2: Service Organization Controls

Wazuh API

hljs bash
TOKEN=$(curl -k -X POST 'https://localhost:55000/security/user/authenticate' \
  -u wazuh-wui:MyS3cr37P450r.*- | jq -r '.data.token')

curl -k -X GET "https://localhost:55000/agents?pretty=true" \
  -H "Authorization: Bearer $TOKEN"

curl -k -X GET "https://localhost:55000/vulnerability/AGENT_ID?pretty=true" \
  -H "Authorization: Bearer $TOKEN"

Update

hljs bash
cd wazuh-docker/single-node
docker compose down
docker compose pull
docker compose up -d

Backup

hljs bash
docker exec wazuh-manager tar -czf /tmp/wazuh-backup.tar.gz /var/ossec/etc /var/ossec/logs /var/ossec/queue
docker cp wazuh-manager:/tmp/wazuh-backup.tar.gz ./wazuh-backup-$(date +%Y%m%d).tar.gz

By setting up Wazuh SIEM on your REXE servers, you can perform comprehensive security monitoring, log analysis, vulnerability scanning, and compliance auditing. The agent-based architecture allows you to manage all your servers from a centralized dashboard.

Frequently Asked Questions

I cannot access the Wazuh Dashboard.

Check that containers are running: 'docker ps'. Wait for the Wazuh indexer to be ready (may take a few minutes on first start). Verify port 443 is open in the firewall. Check dashboard logs: 'docker logs wazuh-dashboard'. Make sure you're using HTTPS (not HTTP).

Agent cannot connect to the server.

Verify the Wazuh manager is running. Check that ports 1514 and 1515 are open in the firewall. Verify the WAZUH_MANAGER IP address is correct in the agent configuration. Check agent logs: '/var/ossec/logs/ossec.log'. Verify SSL certificates are correctly configured.

Wazuh is using too much RAM.

Wazuh Indexer (OpenSearch) uses 1GB heap by default. Adjust OPENSEARCH_JAVA_OPTS in docker-compose.yml. Minimum 4GB RAM is recommended (Indexer: 1GB, Manager: 1GB, Dashboard: 1GB, OS: 1GB). Clean old indices or set up a retention policy.

How do I monitor custom log files?

Add a localfile block to the agent's ossec.conf. You can use syslog, json, or multi-line as log_format. Write custom decoders and rules to parse logs and create alerts. Restart the agent after changes.

Vulnerability scan results are not showing.

Check that the vulnerability-detector module is enabled in ossec.conf. Verify providers are correctly configured. The first scan may take several hours. Ensure the agent's syscollector module is active. Check manager logs: '/var/ossec/logs/ossec.log'.

How do I set up Telegram notifications with Wazuh?

Create a custom script in the Wazuh integrations directory. Add an integration block in ossec.conf with the Telegram API URL and your bot token. Set the alert level threshold. Make sure the script is executable.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps