Wazuh

What is Wazuh?

Wazuh is a free, open-source enterprise Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platform. Originally derived from the OSSEC project, Wazuh has evolved into a comprehensive security operations solution that serves as an open-source alternative to commercial platforms like Splunk Enterprise Security, Datadog Cloud SIEM, and Rapid7 InsightIDR.

Wazuh protects endpoints (Linux, Windows, macOS, Solaris, AIX), cloud workloads (AWS, Azure, GCP), and container environments (Docker, Kubernetes). It combines endpoint security agents with a central indexing cluster that analyzes security telemetry in real time.

Who Is It For?

• Security Operations Center (SOC) Teams: Monitoring security alerts, investigating incident forensics, and tracking adversary tactics using the MITRE ATT&CK framework.
• Compliance & Audit Officers: Generating automated compliance audit reports for PCI DSS, HIPAA, GDPR, NIST 800-53, and CIS Benchmarks.
• Enterprise System Administrators: Tracking unauthorized file modifications, detecting unpatched CVE software vulnerabilities, and automating active response threat blocking.

Key Features

• Real-time Endpoint Detection & Response (EDR): Monitor processes, network connections, and system call anomalies across servers.
• File Integrity Monitoring (FIM): Detect unauthorized file modifications, permission changes, and malware tampering in critical system files.
• Automated Vulnerability Detection: Scan installed software against official CVE vulnerability databases in real time.
• Regulatory Compliance Auditing: Pre-mapped compliance dashboards for PCI DSS, HIPAA, GDPR, and CIS configuration benchmarks.
• Active Response engine: Automatically execute scripts to ban offending IPs, terminate rogue processes, or isolate compromised hosts.

Deploying Wazuh Central Server with Docker

Clone the official Wazuh Docker deployment repository:

Generate secure SSL certificates and start the central stack (Wazuh Manager, Wazuh Indexer, Wazuh Dashboard):

Access the web dashboard at https://localhost in your browser, and log in with default credentials admin / SecretPassword.

Enrolling an Endpoint Agent

Install the lightweight Wazuh Agent on any server or workstation:

Practical Use Cases

1. MITRE ATT&CK Threat Detection

A SOC analyst investigates an alert where Wazuh correlates anomalous PowerShell execution with MITRE ATT&CK technique T1059 (Command and Scripting Interpreter).

2. File Integrity Monitoring (FIM) for PCI-DSS Compliance

An e-commerce company monitors /etc/nginx/ and /etc/pam.d/; any unauthorized modification to web server configurations triggers an immediate high-priority audit alert.

3. Automated Vulnerability Scanning

Wazuh scans 500 Linux endpoints, detecting servers running outdated OpenSSL packages vulnerable to critical CVEs and generating remediation action tickets.

Troubleshooting and Limitations

• System Memory Allocation: Wazuh Indexer (built on OpenSearch) requires at least 4 GB of dedicated RAM; ensure the host server has adequate memory and configure vm.max_map_count=262144.
• Certificate Verification: Wazuh agents communicate over TLS with the manager; ensure manager certificates and agent configuration match the manager's hostname.

Official Resources

• Official Website: https://wazuh.com
• GitHub Repository: https://github.com/wazuh/wazuh
• Documentation: https://documentation.wazuh.com