0 views
Read
#0
Learn Wazuh - Pre-Requisites Skill & Setup Environment
Opening episode of the Learn Wazuh series: the essential skills you must master before touching the world of SIEM and XDR. Complete with a guide to preparing a VM lab for the Wazuh server and target agents, checking RAM and virtualization, and accessing the official Wazuh 4.x package repository.
August 3, 2026
00
Read
#1
Learn Wazuh - History, Background & Why You Need It
Tracing Wazuh's journey from OSSEC HIDS in 2004 through Wazuh 5.0, and the reasons organizations need an affordable open source SIEM. Including the problems it solves: endpoint visibility, FIM, vulnerability scanning, and regulatory compliance.
August 3, 2026
00
Read
#2
Learn Wazuh - Core Concepts & Main Architecture
Understanding Wazuh's core concepts: the differences between SIEM, EDR, and XDR, the five main platform components — manager, indexer, dashboard, agent, and RESTful API — plus the data flow from endpoint to dashboard, along with service verification in the lab.
August 3, 2026
00
Read
#3
Learn Wazuh - All-in-One Installation (Quickstart)
A practical guide to installing single-node Wazuh 4.x with wazuh-install.sh: system preparation, running the installer, verifying the status of the manager, indexer, and dashboard, plus the first login to the dashboard with a self-signed certificate.
August 3, 2026
00
Read
#4
Learn Wazuh - Agent Deployment & Enrollment
Installing the Wazuh Agent on Linux, Windows, and macOS, enrolling it to the manager, configuring ossec.conf, taking advantage of centralized agent.conf management, and verifying the active agent status from the dashboard and command line.
August 3, 2026
00
Read
#5
Learn Wazuh - Log Monitoring & Analysis
Exploring how Wazuh reads and analyzes logs: logcollector for local logs and remote syslog, localfile configuration in ossec.conf, the decoder-to-rules-to-alert flow, and viewing events and queries in the Wazuh dashboard.
August 3, 2026
00
Read
#6
Learn Wazuh - Rules & Decoders
Getting to know Wazuh decoders and rules: the structure of local_decoder and local_rules, syslog and JSON log formats, how to create custom decoders and custom rules, the match, filter, syscheck, vulnerability, and scan rule types, plus the level scale from 0 to 15 for prioritizing alerts.
August 3, 2026
00
Read
#7
Learn Wazuh - File Integrity Monitoring (FIM)
Diving into Wazuh's File Integrity Monitoring: the syscheck module for watching important files, comparing realtime and scheduled monitoring, whitelisting directories and Windows registry, plus configuring intervals, checksums, and added, modified, and deleted file change reports.
August 3, 2026
00
Read
#8
Learn Wazuh - Active Response & Malware Detection
Bringing automation to life in Wazuh: active response to block IPs, kill processes, and quarantine files via agent commands, complete with timeout and frequency, plus malware detection through rootcheck, YARA integration, and the newest agent malware scan module in Wazuh 4.10.
August 3, 2026
00
Read
#9
Learn Wazuh - Vulnerability Detection
Exploring Wazuh's Vulnerability Detection module: the vulnerability inventory on agents, CVE feeds from NVD and OSV based on CPE, comparing installed packages against the CVE database, vulnerability detector configuration, scan schedules, the Vulnerabilities dashboard, and Windows patch management.
August 3, 2026
00