Lab 3.2 Wazuh

Thomsen Tech Journal

Stated Goal of the Assignment

You've seen what a centralized syslog server can do in terms of receipt and organization of log files from across the enterprise. In this new lab, we are going to experiment with a far more modern logging system called Wazuh. Wazuh is one of several ELK based SIEMs. We are using this one because of the relatively ease of installation as well as functionality. Unlike a traditionally syslog client and server, Wazuh allows us to install agents on supported systems. Agents can refine that information sent to their SIEM for streamlined analysis.

Useful Commands

List out any commands that were used or found to be helpful during the process.

• curl -sO https://packages.wazuh.com/4.3/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

installs Wazuh

• Wazuh Quickstart

Steps from the Process

Document any notes that were taken while working on the assignment.

1. Install and show Wazuh Running

2. Register web01 to be an Agent running on Wazuh

3. Show an invalid user login being flagged in the Security events

Additional Notes

Include any additional notes or observations made while working on the assignment.

N/A

Troubles Encountered

**List out any issues that were encountered while working on the assignment. **

N/A

Resolutions

If any issues were solved, list out the resolutions for each problem.

N/A

Further Questions

List out any questions that arose while working on the assignment.

N/A