Exploring Wazuh

Wazuh has come a long way since its early days as a basic intrusion detection system. Over the years, it has grown into a unified security platform that SOC analysts, sysadmins, and GRC teams can effectively use. In this room, you will learn what Wazuh is, and how to use it for all kinds of compliance and security monitoring tasks.

Prerequisites

• Elastic Stack: The Basics room will make it easier for you to use the lab machine
• GRC and SOC knowledge will help you understand the problems Wazuh solves

What Is Wazuh

Firstly, let's understand what Wazuh actually is. While it started as an EDR/HIDS-focused tool, Wazuh has grown into a unified security platform that combines endpoint detection and response, event management, vulnerability assessment, and cloud security monitoring under one roof. It goes well beyond traditional EDR by:

• Auditing devices for common vulnerabilities
• Monitoring for suspicious activity on the endpoints
• Visualizing complex events into neat dashboards and graphs
• Providing compliance reporting for frameworks like GDPR, HIPAA, and NIST

Wazuh Architecture

Founded in 2015, Wazuh (opens in new tab) is used across organizations of all sizes - from small businesses to large enterprises and government institutions. Wazuh operates on a manager and agent model. Simply put, there is one Wazuh server (manager) that stores and processes the data, and many hosts (agents) that send data to the manager. Let's look at this model in the diagram below:

We can see logs from four Agents being sent to the Wazuh server

In more technical terms, the Wazuh server is a complex deployment consisting of multiple components: an indexer built on top of OpenSearch (a fork of Elasticsearch), a custom-built orchestrator (manager), Filebeat that sends data from the manager to the indexer, and a GUI built on top of OpenSearch dashboards. In this room, all components are installed on a single VM.

Lab Setup

Deploy the Wazuh management server attached to this task and wait 4-5 minutes before visiting the Wazuh server. Once it has started, log in using the following credentials:

• URL: https://LAB_WEB_URL.p.thmlabs.com:8443
• Username: thmuser
• Password: TryHackMe!

Once you log in, you should see the Overview page with two agents installed. Please note that the agents will be in the disconnected state in your lab; this is expected.

Wazuh Agents

Agents monitor the events that take place on the device, such as authentication and OS activities; they also audit the device for misconfigurations and much more. Let's analyze the two existing agents: one Linux and one Windows device. From the Overview page, click on the "Disconnected" keyword in the Agents Summary panel:

You should now see the main Agents menu. Feel free to explore the agents' details by using the Actions menu (2), or see the instructions for deploying new agents (3). Wazuh agents support Windows, Linux, and MacOS, and are fairly easy to install by following the documentation.

Agent Groups

If you would deploy an agent, you'd need to specify the IP address of your Wazuh server, the agent name (typically the same as the hostname), and the group. The agents can be organized into groups, each of which can contain specific audit policies and logging settings. For example, a group named CORP for corporate servers and desktops, and BYOD for personal laptops.

Wazuh and IT Hygiene

Once the agent is installed, Wazuh runs lots of security checks and collects a ton of information about the host. One of the most useful categories for IT is the IT Hygiene checks. Select the WIN-SERVER agent, click More, and open the IT Hygiene section. Once you are there, you will see multiple tabs, such as:

• System: Hardware, hostname, network interfaces, and OS version
• Software: Installed programs, OS patches, and even browser extensions
• Network: Listening ports (e.g., RDP), vital for the Exposure Management
• Identity: Local users present on the device, including their privileges

Wazuh and CIS Benchmarks

Wazuh is capable of auditing and monitoring an agent's configuration with CIS benchmarks or even custom checklists. Take a look at the image below. When the Wazuh agent is installed on the Windows machine, it runs 347 CIS security checks (typically PowerShell commands) and verifies the results. You can use it to audit your devices for misconfigurations and prepare them for audit. Select the WIN-SERVER agent and open its Configuration Assessment panel to get started:

Wazuh and Vulnerability Detection

Wazuh's Vulnerability Detection module is another powerful tool that can be used to periodically scan an agent for vulnerable applications. However, out of the box, it is arguably sensitive. Take, for example, the fresh Ubuntu server named linux-server. During the latest scan, Wazuh reported 1293 vulnerabilities, 3 of which are critical (you might see even more in your lab). While the information is technically correct, just a few of the reported vulnerabilities can be exploited, and IT administrators would need to decide what to patch on their own.

Wazuh reevaluates vulnerabilities from time to time and every time a new package is installed. You can sort and filter vulnerabilities based on various factors such as timestamp, CVE number, package, or description. For example, to filter for Linux kernel vulnerabilities, you should select the linux-server agent, go to the Inventory subtab, and filter for package.name IS linux-aws:

Logging With Wazuh

The core Wazuh capability is to collect and parse security logs from the agents. With some tweaks, Wazuh becomes a powerful SIEM, similar to Elasticsearch and Kibana. Let's start by checking the authentication logs from the linux-server. First, open the top-left menu > Explore dropdown > Discover page. This is the panel where all raw logs can be viewed, including the configuration assessment and vulnerability detection results:

Next, let's explore the Discover menu:

1. Index pattern selector and field search. Useful to learn which fields are present in the events.
2. Search query input and time selector. To view SSH logins, please apply these settings:
   Search query: decoder.name: sshd
   Time range: Last 5 years
3. The actual events. You can expand each event by clicking the toggle near the timestamp.

Logs vs Rules vs Alerts

In Wazuh, there is no concept of traditional SIEM logs. Instead, you define what logs will become alerts using Wazuh rules, and all non-matching events will be discarded. For example, the two SSH events you saw earlier were Wazuh alerts, generated by rule ID 5715. Wazuh has hundreds of prebuilt rules for different OS data sources, each having a level from 1 to 15, where 15 is the most critical alert possible. We will explore the rules in the next room.

Dashboards and Reports

While Wazuh has tons of prebuilt dashboards for routine tasks, you might want to create a custom one at some point. To begin with, you can open the top-left menu > Explore > Visualize > Create Visualization. From there, select Pie, choose the wazuh-alerts-* source, add the Split slices bucket, and aggregate by agent.name, as shown in the image below. Then, click Update. Don't forget to set the global time range to Last 5 years.

Building custom visualizations

You can combine multiple visualization panels into a single dashboard. You can explore the prepared Demo Dashboard by navigating to the top-left menu > Explore > Dashboards menu. The menu might be overwhelming at first, but overall, Wazuh has very powerful reporting capabilities.

Agent Configuration

Wazuh collects basic system logs by default, but that's usually not enough for mature SOC teams. To collect custom logs, you need to specify the requirements in the Groups menu, and they will automatically propagate to all active agents. We have already added two custom settings to the default group to collect /var/log/auth.log from Linux and MS Defender event logs from Windows agents. Check it out by going to Agents management > Groups and clicking the pencil icon:

        <localfile os="Windows">
  <location>Microsoft-Windows-Sysmon/Operational</location>
  <log_format>eventchannel</log_format>
</localfile>
        

        <decoder name="Sysmon-EventID#1">
    <parent>windows</parent>
    <type>windows</type>
    <prematch>INFORMATION\(1\)\.+HashType</prematch>
    <regex>Image: (\.*) \s*CommandLine: \.* \s*User: (\.*) \s*LogonGuid: \S* \s*LogonId: \S* \s*TerminalSessionId: \S* \s*IntegrityLevel: \.*HashType: \S* \s*Hash: (\S*) \s*ParentProcessGuid: \S* \s*ParentProcessID: \S* \s*ParentImage: (\.*) \s*ParentCommandLine:</regex>
    <order>sysmon.image,srcuser,sysmon.hash,sysmon.parentImage</order>
</decoder>  
        

           <group name="sysmon,">
  <rule id="184665" level="0">
    <if_sid>18100</if_sid>
    <match>Microsoft-Windows-Sysmon/Operational: INFORMATION(1)</match>
    <description>Sysmon - Event Code 1</description>
    <group>sysmon_event1,</group>
  </rule>
  <rule id="255000" level="12">
    <if_group>sysmon_event1</if_group>
    <field name="sysmon.image">\\powershell.exe</field>
    <description>Sysmon Alert - PowerShell Launch</description>
    <group>sysmon_event1,powershell_execution,</group>
  </rule>
</group>
        

Alert Notifications

Finally, you can configure notifications if some of your rules are triggered. In the simplest case, you can write a query rule.level >= 12, create an alert from it in Explore > Alerting menu, and then set up a notification channel (e.g., Slack message or email). You will receive a notification every time your query matches new events.

Explored Features

Let's summarize the Wazuh features we have explored. For IT and GRC, it's:

• Vulnerability Detection to track software vulnerabilities on the agents
• Configuration Assessment to track security misconfigurations on the agents
• IT Hygiene to view agent details and list installed apps and browser extensions 

There are also a few great features to make Wazuh a SIEM, such as:

• Decoders and Rules to ingest and monitor OS and application logs
• Discover and Dashboards to search and visualize the ingested logs

Now, let's explore less popular Wazuh features that you should definitely test yourself!

Wazuh Active Response

In response to received events, Wazuh can send a response command (Active Response (opens in new tab)) to the agent: run a script, delete a file, block a network connection, and more. Just keep in mind that the response is executed with a delay (up to a few minutes), and therefore can't fully replace EDR features like real-time process kill or malware quarantine. Still, Active Response can be used as an RMM/MDM for mass software deployment or to support the existing AV/EDR solution.

File Integrity Monitoring

Many government regulations require organizations to monitor critical files for unauthorized changes, including OS configurations, application settings, and VPN profiles. Beyond compliance, companies may also need to enforce strict access controls on sensitive files such as SSH keys. Wazuh addresses both needs through its File Integrity Monitoring (FIM (opens in new tab)) module, which logs every modification to selected files and directories (as well as registry keys on Windows). Explore it yourself under Endpoint Security > File Integrity Monitoring!

FIM and Malware Detection

Wazuh goes beyond basic file monitoring with two built-in malware detection features: YARA and VirusTotal integration. Whenever a monitored file is created or modified, Wazuh automatically scans it using your YARA rules and checks its hash against VirusTotal. A match triggers an alert and, optionally, an Active Response action to contain the threat. Note that you must bring your own YARA rules and VirusTotal key to make the features work.

Even More Features!

Wazuh is a universal security solution that can fit different needs and be used by different teams. Try installing Wazuh in your home lab, that's pretty fun! Also, if you want to play with Wazuh without ingesting real logs, try ingesting the demo data via Indexer management > Sample Data. Just note that some datasets may require an Internet connection to be downloaded. Hope you enjoyed the room!