SIEM Wazuh Setup
Wazuh
Wazuh is an open-source Security Information and Event Management (SIEM) platform designed to detect and monitor security incidents across IT infrastructures. It provides features such as threat detection, vulnerability management, and compliance monitoring to help organizations strengthen their cybersecurity posture.
Setting Up Wazuh Components
This guide provides step-by-step instructions to set up the three main components of Wazuh: Wazuh Manager, Wazuh Indexer, and Wazuh Dashboard. These components are deployed on separate virtual machines. This guide uses Debian 12 as the operating system. Official Wazuh documentation recommends Ubuntu with a 64-bit Intel or AMD Linux processor. This article is based on Wazuh version 4.9.
Prerequisites
Before proceeding with the installation, ensure the following prerequisites are met:
- VLANs and firewall rules have been configured to control communication between the servers and clients.
- Virtual machines (VMs) have been properly set up in Hyper-V with the following minimum specifications:
| Component | vCPUs | RAM | Storage |
|---|---|---|---|
| Wazuh Manager | 2 | 2 GB | 15 GB |
| Wazuh Indexer | 2 | 4 GB | 150 GB |
| Wazuh Dashboard | 2 | 4 GB | 15 GB |
Wazuh Indexer Setup
1. Download the installation script and configuration file:
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh curl -sO https://packages.wazuh.com/4.9/config.yml
2. Edit the config.yml file to include the appropriate DNS names and IP addresses.
3. Generate the configuration files:
sudo bash wazuh-install.sh --generate-config-files
4. Copy the generated .tar file to the Wazuh Manager and Dashboard machines:
scp wazuh-install-files.tar <user>@<manager-ip>:~/wazuh/ scp wazuh-install-files.tar <user>@<dashboard-ip>:~/wazuh/
5. Allow necessary ports on the Indexer:
sudo ufw allow 9200 sudo ufw allow 9300 sudo ufw allow 55000
6. Install and start the Indexer cluster:
sudo bash wazuh-install.sh --wazuh-indexer wazuh-indexer sudo bash wazuh-install.sh --start-cluster
7. Get username and password for Dashboard:
tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O | grep -P "\'admin\'" -A 1
Wazuh Manager Setup
1. Download the installation script:
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
2. Install the Wazuh Manager:
sudo bash wazuh-install.sh --wazuh-server wazuh-manager
3. Allow the required ports:
sudo ufw allow 55000 # Wazuh API sudo ufw allow 1514/tcp # Event log sudo ufw allow from <firewall-ip> proto tcp to any port 514 # Syslog sudo ufw allow 1515 # Endpoint deployment
Wazuh Dashboard Setup
1. Download the installation script:
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
2. Install the Wazuh Dashboard:
sudo bash wazuh-install.sh --wazuh-dashboard wazuh
3. Allow port 443 for secure access:
sudo ufw allow 443
4. Access the Dashboard via its IP address or DNS name in a web browser
Testing the installation
To verify that the setup is successful, use the following command on each component:
curl -k -u admin:<password> https://<component-ip>:9200
Configuration
The configuration of Wazuh is managed centrally through the /var/ossec/etc/ossec.conf file on the Wazuh Manager. This file defines key settings for agents, alerts, and integrations.
Rules
To create new rules or override existing ones, the desired rules should be added to the local_rules.xml file located in /var/ossec/etc/rules/. When overriding a rule, the overwrite attribute must be set to "yes." For example, to change the priority of a specific rule, the rule can be copied, modified, and saved in this file:
1. Open /var/ossec/etc/rules/local_rules.xml in editor:
nano /var/ossec/etc/rules/local_rules.xml
2. Create the custom rule in xml format and set rule id between 100000 and 120000
<group name="custom_rules_example,">
<rule id="100010" level="3">
<program_name>example</program_name>
<description>User logged</description>
</rule>
</group>
3. Restart the Wazuh-manager service
sudo systemctl restart wazuh-manager
To overwrite rules add the overwrite=yes tag to the first line:
<rule id="100010" level="0" overwrite="yes"> <program_name>example</program_name> <description>User logged</description> </rule>
Syslog
To integrate routers or firewalls with Wazuh, Syslog can be used for log forwarding.
1. Open /var/ossec/etc/ossec.conf in editor:
nano /var/ossec/etc/ossec.conf
2. Add another <remote> to the configuration and enter the device ip and the manager ip into the <allowed-ips> tag
<remote> <connection>syslog</connection> <port>514</port> <protocol>udp</protocol> <allowed-ips><DEVICE-IP></allowed-ips> <allowed-ips><MANAGER-IP></allowed-ips> </remote>
3. Restart the Wazuh-manager service
sudo systemctl restart wazuh-manager
4. Configure syslog on the device
5. Test configuration:
tail -f /var/ossec/logs/archives/archives.log
Endpoint deployment
Wazuh Agents are lightweight components installed on endpoints to collect security-related data, such as logs, file integrity monitoring, and intrusion detection events. They communicate with the Wazuh Manager, enabling centralized analysis and real-time response to potential threats.
1. Login to the Dashboard
2. Go to Agent Management -> Summary -> Deploy new agent
3. Choose your operating system and enter the Wazuh-Manager IP
4. Choose endpoint groups
5. Run the given script on the endpoint