{"id":3964,"date":"2024-03-17T10:15:44","date_gmt":"2024-03-17T14:15:44","guid":{"rendered":"https:\/\/dft.wiki\/?p=3964"},"modified":"2026-06-08T10:58:02","modified_gmt":"2026-06-08T14:58:02","slug":"xdr-siem-endpoint-monitoring-with-wazuh","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=3964","title":{"rendered":"XDR + SIEM Endpoint Monitoring with Wazuh"},"content":{"rendered":"<p><strong>Wazuh<\/strong> is a security platform that combines XDR and SIEM for monitoring and protecting endpoints and cloud workloads [<a href=\"https:\/\/wazuh.com\/install\/\">Link<\/a>]. Agents are available for virtually any platform: Linux, Windows, MacOS, Solaris, HPUX, and AIX.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4710 size-medium aligncenter\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/Screenshot-from-2025-02-25-17-54-51-300x102.png\" alt=\"\" width=\"300\" height=\"102\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/Screenshot-from-2025-02-25-17-54-51-300x102.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/Screenshot-from-2025-02-25-17-54-51.png 764w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/p>\n<p><span style=\"text-decoration: underline;\">Bare minimum<\/span> requirements (start small and expand as needed):<\/p>\n<ul>\n<li>2 vCPU<\/li>\n<li>4 GB of RAM<\/li>\n<li>50 GB of Storage<\/li>\n<\/ul>\n<p>These requirements are half of what the official documentation recommends, yet I managed to monitor over 50 endpoints at 2.5% average CPU utilization and 65 to 85% RAM usage. The key factor in my case is that I only monitor Linux servers with no interactive users, just automated workloads. This keeps the event volume to a minimum.<\/p>\n<hr \/>\n<p><strong>INSTALLATION<\/strong><\/p>\n<pre>curl -sO https:\/\/packages.wazuh.com\/<strong>4.11<\/strong>\/wazuh-install.sh &amp;&amp; sudo bash .\/wazuh-install.sh -a<\/pre>\n<p>The installation takes a few minutes. Once complete, it will print the generated Admin password:<\/p>\n<pre>INFO: Starting Wazuh installation assistant. Wazuh version: 4.11.0\r\nINFO: Verbose logging redirected to \/var\/log\/wazuh-install.log\r\n(...)\r\nINFO: --- Summary ---\r\nINFO: You can access the web interface https:\/\/<strong>&lt;wazuh-dashboard-ip&gt;<\/strong>:443\r\n    User: <strong>admin<\/strong>\r\n    Password: <strong>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<\/strong>\r\n24\/03\/2024 14:23:29 INFO: Installation finished.<\/pre>\n<p>Navigate to the URL and log in with the generated credentials.<\/p>\n<hr \/>\n<p><strong>SETTING UP AGENTS<\/strong><\/p>\n<p>After logging in to the Dashboard, click on <strong>Add Agent<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3972\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0001.png\" alt=\"\" width=\"1669\" height=\"1109\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0001.png 1669w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0001-300x199.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0001-1024x680.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0001-768x510.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0001-1536x1021.png 1536w\" sizes=\"auto, (max-width: 1669px) 100vw, 1669px\" \/><\/p>\n<p>Select the platform and architecture of the endpoint to be monitored, provide the server address (ideally a local hostname rather than an IP, in case the IP changes), and assign a group (I left the default).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3973\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0002.png\" alt=\"\" width=\"982\" height=\"1894\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0002.png 982w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0002-156x300.png 156w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0002-531x1024.png 531w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0002-768x1481.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0002-796x1536.png 796w\" sizes=\"auto, (max-width: 982px) 100vw, 982px\" \/><\/p>\n<p>This step only generates a command to copy and run on the target host. It does not install anything automatically.<\/p>\n<pre>wget https:\/\/packages.wazuh.com\/4.x\/apt\/pool\/main\/w\/wazuh-agent\/wazuh-agent_<strong>4.11.0-1<\/strong>_amd64.deb &amp;&amp; sudo WAZUH_MANAGER='<strong>192.168.1.10<\/strong>' WAZUH_AGENT_GROUP='default' dpkg -i .\/wazuh-agent_<strong>4.11.0-1<\/strong>_amd64.deb<\/pre>\n<p>The agent does not start or enable itself on boot automatically after installation. Run the following command as well:<\/p>\n<pre>sudo systemctl daemon-reload &amp;&amp; sudo systemctl enable wazuh-agent &amp;&amp; sudo systemctl start wazuh-agent<\/pre>\n<p>It may take a few seconds to appear under <strong>Active Agents<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3975\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0003.png\" alt=\"\" width=\"1675\" height=\"162\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0003.png 1675w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0003-300x29.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0003-1024x99.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0003-768x74.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0003-1536x149.png 1536w\" sizes=\"auto, (max-width: 1675px) 100vw, 1675px\" \/><\/p>\n<p>All good!<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3976\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0004.png\" alt=\"\" width=\"1675\" height=\"166\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0004.png 1675w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0004-300x30.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0004-1024x101.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0004-768x76.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0004-1536x152.png 1536w\" sizes=\"auto, (max-width: 1675px) 100vw, 1675px\" \/><\/p>\n<hr \/>\n<p>If the agent does not connect to the server, check the logs for clues:<\/p>\n<pre>sudo tail -f \/var\/ossec\/logs\/ossec.log | grep -i -E \"error|warn\"<\/pre>\n<p><strong>MONITORING ENDPOINTS<\/strong><\/p>\n<p>Click on any agent to view its events. A series of checks will run shortly after the agent joins (these are not resource-intensive).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3981\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0006.png\" alt=\"\" width=\"823\" height=\"427\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0006.png 823w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0006-300x156.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0006-768x398.png 768w\" sizes=\"auto, (max-width: 823px) 100vw, 823px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3980\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0005.png\" alt=\"\" width=\"823\" height=\"428\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0005.png 823w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0005-300x156.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0005-768x399.png 768w\" sizes=\"auto, (max-width: 823px) 100vw, 823px\" \/><\/p>\n<p>New events will continue to appear as they occur on the server.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3982\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0007.png\" alt=\"\" width=\"823\" height=\"294\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0007.png 823w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0007-300x107.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0007-768x274.png 768w\" sizes=\"auto, (max-width: 823px) 100vw, 823px\" \/><\/p>\n<p>The agent summary classifies each event with a MITRE ATT&#038;CK TTP (Tactic, Technique, and Procedure) and maps it to relevant compliance frameworks.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3983\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0008.png\" alt=\"\" width=\"823\" height=\"294\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0008.png 823w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0008-300x107.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0008-768x274.png 768w\" sizes=\"auto, (max-width: 823px) 100vw, 823px\" \/><\/p>\n<p>See example:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3984\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0009.png\" alt=\"\" width=\"933\" height=\"329\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0009.png 933w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0009-300x106.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0009-768x271.png 768w\" sizes=\"auto, (max-width: 933px) 100vw, 933px\" \/><\/p>\n<p><strong>Note:<\/strong> Expect a lot of false positives. Distinguishing normal operation from genuine issues requires a solid understanding of the system and its applications. For example, user logins and system patches will each generate a large number of events.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3989\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0010.png\" alt=\"\" width=\"1664\" height=\"614\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0010.png 1664w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0010-300x111.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0010-1024x378.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0010-768x283.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2024\/03\/0010-1536x567.png 1536w\" sizes=\"auto, (max-width: 1664px) 100vw, 1664px\" \/><\/p>\n<p><strong>This is where the real work starts!<\/strong><\/p>\n<hr \/>\n<p><strong>BONUS<\/strong><\/p>\n<p><strong>Wazuh<\/strong> started as a fork of <strong>OSSEC<\/strong>. OSSEC is under slower development but remains popular and relevant in the cybersecurity space [<a href=\"https:\/\/github.com\/ossec\/ossec-hids\">Link<\/a>].<\/p>\n<pre>git clone https:\/\/github.com\/ossec\/ossec-hids.git\r\ncd ossec-hids\r\nsudo apt update\r\nsudo apt install libz-dev libssl-dev libpcre2-dev build-essential libsystemd-dev -y\r\n.\/install.sh<\/pre>\n<p>Or via APT [<a href=\"https:\/\/www.ossec.net\/download-ossec\/\">Link<\/a>]:<\/p>\n<pre>wget -q -O - https:\/\/www.atomicorp.com\/RPM-GPG-KEY.atomicorp.txt | sudo apt-key add -\r\necho \"deb https:\/\/updates.atomicorp.com\/channels\/atomic\/ubuntu $DISTRIB_CODENAME main\" &gt;&gt; \/etc\/apt\/sources.list.d\/atomic.list\r\nsudo apt update\r\nsudo apt install ossec-hids-server -y<\/pre>\n<hr \/>\n<p>For <strong>MS Windows<\/strong> endpoints, check out <strong>BLUESPAWN<\/strong> [<a href=\"https:\/\/github.com\/ION28\/BLUESPAWN\">Link<\/a>], another open-source EDR.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Wazuh is a security platform that combines XDR and SIEM for monitoring and protecting endpoints [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3964","post","type-post","status-publish","format-standard","hentry","category-ccna"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3964"}],"version-history":[{"count":21,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3964\/revisions"}],"predecessor-version":[{"id":5630,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3964\/revisions\/5630"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}