How to Deploy Wazuh SIEM/XDR for Unified Security Monitoring

# Update the system
sudo apt-get update && sudo apt-get upgrade -y
 
# Set a proper hostname (important for certificate generation)
sudo hostnamectl set-hostname wazuh-server
echo "127.0.0.1 wazuh-server" | sudo tee -a /etc/hosts
 
# Disable swap (required for Wazuh Indexer/OpenSearch)
sudo swapoff -a
sudo sed -i '/swap/d' /etc/fstab
 
# Increase virtual memory map count
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Download the installation assistant
curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
curl -sO https://packages.wazuh.com/4.x/config.yml

nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: "<YOUR_SERVER_IP>"
 
  # Wazuh server nodes
  server:
    - name: wazuh-1
      ip: "<YOUR_SERVER_IP>"
 
  # Wazuh dashboard nodes
  dashboard:
    - name: dashboard
      ip: "<YOUR_SERVER_IP>"

# Generate certificates
sudo bash wazuh-install.sh --generate-config-files
 
# Install the Wazuh Indexer
sudo bash wazuh-install.sh --wazuh-indexer node-1
 
# Initialize the indexer cluster
sudo bash wazuh-install.sh --start-cluster
 
# Install the Wazuh Server (manager + filebeat)
sudo bash wazuh-install.sh --wazuh-server wazuh-1
 
# Install the Wazuh Dashboard
sudo bash wazuh-install.sh --wazuh-dashboard dashboard

# Change the admin password via the API
sudo /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p '<NEW_STRONG_PASSWORD>'

<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>yes</alerts_log>
    <logall>no</logall>
    <logall_json>no</logall_json>
    <email_notification>no</email_notification>
    <smtp_server>localhost</smtp_server>
    <email_from>wazuh@localhost</email_from>
    <email_to>admin@yourdomain.com</email_to>
    <email_maxperhour>12</email_maxperhour>
    <queue_size>131072</queue_size>
  </global>
 
  <!-- Enforce agent authentication with certificates -->
  <auth>
    <disabled>no</disabled>
    <port>1515</port>
    <use_source_ip>no</use_source_ip>
    <force>
      <enabled>yes</enabled>
      <key_mismatch>yes</key_mismatch>
      <disconnected_time enabled="yes">1h</disconnected_time>
      <after_registration_time>1h</after_registration_time>
    </force>
    <purge>yes</purge>
    <use_password>yes</use_password>
    <ssl_agent_ca></ssl_agent_ca>
    <ssl_verify_host>no</ssl_verify_host>
    <ssl_manager_cert>/var/ossec/etc/sslmanager.cert</ssl_manager_cert>
    <ssl_manager_key>/var/ossec/etc/sslmanager.key</ssl_manager_key>
    <ssl_auto_negotiate>no</ssl_auto_negotiate>
  </auth>
</ossec_config>

# Create the enrollment password file
echo '<YOUR_ENROLLMENT_PASSWORD>' | sudo tee /var/ossec/etc/authd.pass
sudo chmod 640 /var/ossec/etc/authd.pass
sudo chown root:wazuh /var/ossec/etc/authd.pass
 
# Restart the manager to apply changes
sudo systemctl restart wazuh-manager

# Create a 90-day retention policy via the Indexer API
curl -k -u admin:<PASSWORD> -X PUT "https://localhost:9200/_plugins/_ism/policies/wazuh-retention" \
  -H "Content-Type: application/json" \
  -d '{
    "policy": {
      "description": "Wazuh 90-day alert retention",
      "default_state": "hot",
      "states": [
        {
          "name": "hot",
          "actions": [],
          "transitions": [{"state_name": "delete", "conditions": {"min_index_age": "90d"}}]
        },
        {
          "name": "delete",
          "actions": [{"delete": {}}],
          "transitions": []
        }
      ],
      "ism_template": [{"index_patterns": ["wazuh-alerts-*"], "priority": 100}]
    }
  }'

# Add the Wazuh repository
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring \
  --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
chmod 644 /usr/share/keyrings/wazuh.gpg
 
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \
  | tee /etc/apt/sources.list.d/wazuh.list
 
apt-get update
 
# Install the agent
WAZUH_MANAGER="<MANAGER_IP>" WAZUH_AGENT_NAME="$(hostname)" apt-get install wazuh-agent -y
 
# Enable and start the agent
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent

# Download the installer
$WazuhVersion = "4.10.1"
$InstallerUrl = "https://packages.wazuh.com/4.x/windows/wazuh-agent-$WazuhVersion-1.msi"
$InstallerPath = "$env:TEMP\wazuh-agent.msi"
 
Invoke-WebRequest -Uri $InstallerUrl -OutFile $InstallerPath
 
# Install silently, pointing to your manager
$ManagerIP = "<MANAGER_IP>"
$AgentName = $env:COMPUTERNAME
$EnrollPass = "<YOUR_ENROLLMENT_PASSWORD>"
 
Start-Process msiexec.exe -ArgumentList @(
    "/i", $InstallerPath,
    "/q",
    "WAZUH_MANAGER=$ManagerIP",
    "WAZUH_AGENT_NAME=$AgentName",
    "WAZUH_REGISTRATION_PASSWORD=$EnrollPass"
) -Wait
 
# Start the Wazuh service
Start-Service -Name WazuhSvc
Set-Service -Name WazuhSvc -StartupType Automatic
 
Write-Host "Wazuh agent installed and started on $AgentName"

# deploy-wazuh-agents.ps1 — run from a management host with admin rights to targets
param(
    [string[]]$Computers,
    [string]$ManagerIP,
    [string]$EnrollPassword,
    [string]$WazuhVersion = "4.10.1"
)
 
$InstallerUrl = "https://packages.wazuh.com/4.x/windows/wazuh-agent-$WazuhVersion-1.msi"
$LocalInstaller = "\\<FILE_SHARE>\wazuh-agent.msi"
 
# Pre-download installer to a share accessible by targets
Invoke-WebRequest -Uri $InstallerUrl -OutFile $LocalInstaller
 
foreach ($Computer in $Computers) {
    Write-Host "Deploying to $Computer..."
 
    Invoke-Command -ComputerName $Computer -ScriptBlock {
        param($Installer, $Manager, $Pass, $Name)
 
        if (Get-Service -Name WazuhSvc -ErrorAction SilentlyContinue) {
            Write-Host "Wazuh already installed on $env:COMPUTERNAME, skipping."
            return
        }
 
        Start-Process msiexec.exe -ArgumentList @(
            "/i", $Installer, "/q",
            "WAZUH_MANAGER=$Manager",
            "WAZUH_AGENT_NAME=$Name",
            "WAZUH_REGISTRATION_PASSWORD=$Pass"
        ) -Wait
 
        Start-Service -Name WazuhSvc
        Set-Service -Name WazuhSvc -StartupType Automatic
        Write-Host "Done: $env:COMPUTERNAME"
 
    } -ArgumentList $LocalInstaller, $ManagerIP, $EnrollPassword, $Computer
}

<!-- /var/ossec/etc/rules/local_rules.xml -->
<group name="local,custom">
 
  <!-- Alert on failed SSH logins exceeding threshold -->
  <rule id="100001" level="10" frequency="5" timeframe="120">
    <if_matched_sid>5716</if_matched_sid>
    <description>SSH brute force: 5+ failed logins in 120 seconds</description>
    <group>authentication_failures,pci_dss_10.2.4,pci_dss_10.2.5</group>
  </rule>
 
  <!-- Detect PowerShell encoded command execution -->
  <rule id="100002" level="12">
    <if_group>windows</if_group>
    <field name="win.eventdata.commandLine" type="pcre2">(?i)-enc(odedcommand)?[\s]+[A-Za-z0-9+/=]{20,}</field>
    <description>PowerShell encoded command execution detected</description>
    <mitre>
      <id>T1059.001</id>
    </mitre>
    <group>attack,execution</group>
  </rule>
 
  <!-- Alert on new local admin account creation -->
  <rule id="100003" level="14">
    <if_sid>18152</if_sid>
    <field name="win.eventdata.targetUserName" negate="yes">\.+\$</field>
    <description>New local administrator account created: $(win.eventdata.targetUserName)</description>
    <mitre>
      <id>T1136.001</id>
    </mitre>
    <group>attack,persistence,pci_dss_8.1</group>
  </rule>
 
  <!-- Detect large outbound data transfers (potential exfiltration) -->
  <rule id="100004" level="10">
    <if_group>firewall</if_group>
    <field name="data.bytes_out" compare="greater_than">104857600</field>
    <description>Large outbound data transfer: $(data.bytes_out) bytes to $(data.dstip)</description>
    <mitre>
      <id>T1048</id>
    </mitre>
    <group>attack,exfiltration</group>
  </rule>
 
</group>

sudo /var/ossec/bin/wazuh-logtest   # Test rules interactively
sudo systemctl reload wazuh-manager # Apply without full restart

<syscheck>
  <disabled>no</disabled>
  <frequency>43200</frequency>  <!-- Full scan every 12 hours -->
  <scan_on_start>yes</scan_on_start>
 
  <!-- Monitor critical Linux paths -->
  <directories realtime="yes" check_all="yes" report_changes="yes">/etc</directories>
  <directories realtime="yes" check_all="yes">/usr/bin,/usr/sbin</directories>
  <directories realtime="yes" check_all="yes">/bin,/sbin</directories>
 
  <!-- Monitor critical Windows paths -->
  <directories realtime="yes" check_all="yes" report_changes="yes">%WINDIR%\System32\drivers\etc</directories>
  <directories realtime="yes" check_all="yes">%WINDIR%\System32</directories>
 
  <!-- Windows Registry monitoring -->
  <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry>
  <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>
  <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</windows_registry>
 
  <!-- Exclusions -->
  <ignore>/etc/mtab</ignore>
  <ignore>/etc/hosts.deny</ignore>
  <ignore type="sregex">^/proc</ignore>
  <ignore type="sregex">\.log$|\.tmp$|\.swp$</ignore>
</syscheck>

<ossec_config>
  <!-- Block an IP using iptables when a brute force alert fires -->
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>100001</rules_id>  <!-- Our SSH brute force rule -->
    <timeout>3600</timeout>       <!-- Block for 1 hour -->
  </active-response>
 
  <!-- Kill a process when malware is detected (rule level 15+) -->
  <active-response>
    <command>kill-process</command>
    <location>local</location>
    <level>15</level>
    <timeout>0</timeout>  <!-- No auto-unblock for process kill -->
  </active-response>
</ossec_config>

#!/bin/bash
# /var/ossec/active-response/bin/block-and-notify.sh
# Blocks an attacker IP and sends a Slack webhook notification
 
ACTION=$1
USER=$2
IP=$3
ALERT_ID=$4
RULE_ID=$5
 
SLACK_WEBHOOK="https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
 
if [ "$ACTION" = "add" ]; then
    # Block the IP
    iptables -I INPUT -s "$IP" -j DROP
    iptables -I FORWARD -s "$IP" -j DROP
 
    # Send Slack notification
    curl -s -X POST "$SLACK_WEBHOOK" \
      -H "Content-Type: application/json" \
      -d "{\"text\": \":shield: *Wazuh Active Response Triggered*\nRule ID: $RULE_ID\nAlert ID: $ALERT_ID\nBlocked IP: \`$IP\`\nAction: Blocked via iptables for 1 hour\"}"
 
    echo "$(date) - Blocked IP $IP for rule $RULE_ID" >> /var/ossec/logs/active-responses.log
 
elif [ "$ACTION" = "delete" ]; then
    # Unblock after timeout
    iptables -D INPUT -s "$IP" -j DROP
    iptables -D FORWARD -s "$IP" -j DROP
    echo "$(date) - Unblocked IP $IP" >> /var/ossec/logs/active-responses.log
fi

sudo chmod 750 /var/ossec/active-response/bin/block-and-notify.sh
sudo chown root:wazuh /var/ossec/active-response/bin/block-and-notify.sh

<!-- Add to /var/ossec/etc/ossec.conf on the manager -->
<ossec_config>
  <remote>
    <connection>syslog</connection>
    <port>514</port>
    <protocol>udp</protocol>
    <allowed-ips>192.168.1.0/24</allowed-ips>  <!-- Your network range -->
  </remote>
 
  <!-- Also listen on TCP 514 for reliable delivery -->
  <remote>
    <connection>syslog</connection>
    <port>514</port>
    <protocol>tcp</protocol>
    <allowed-ips>192.168.1.0/24</allowed-ips>
  </remote>
</ossec_config>

<ossec_config>
  <localfile>
    <location>Security</location>
    <log_format>eventchannel</log_format>
    <query>Event/System[EventID != 4688 or (EventID = 4688 and Event/EventData/Data[@Name='SubjectUserName'] != 'SYSTEM')]</query>
  </localfile>
 
  <localfile>
    <location>System</location>
    <log_format>eventchannel</log_format>
  </localfile>
 
  <localfile>
    <location>Application</location>
    <log_format>eventchannel</log_format>
  </localfile>
 
  <!-- PowerShell Operational — critical for detecting script-based attacks -->
  <localfile>
    <location>Microsoft-Windows-PowerShell/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>
 
  <!-- Windows Defender events -->
  <localfile>
    <location>Microsoft-Windows-Windows Defender/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>
 
  <!-- Sysmon — if deployed -->
  <localfile>
    <location>Microsoft-Windows-Sysmon/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>
</ossec_config>

<!-- Add to ossec.conf on the manager -->
<wodle name="azure-logs">
  <disabled>no</disabled>
  <interval>10m</interval>
  <run_on_start>yes</run_on_start>
  <log_analytics>
    <application_id>YOUR_APP_ID</application_id>
    <application_key>YOUR_APP_SECRET</application_key>
    <tenantdomain>yourtenant.onmicrosoft.com</tenantdomain>
    <workspace>YOUR_LOG_ANALYTICS_WORKSPACE_ID</workspace>
    <workspace_key>YOUR_WORKSPACE_KEY</workspace_key>
    <request>
      <tag>azure-activity</tag>
      <query>AzureActivity | where TimeGenerated > ago(10m)</query>
      <time_offset>10m</time_offset>
    </request>
  </log_analytics>
</wodle>

# List all connected agents and their status
sudo /var/ossec/bin/agent_control -lc
 
# Example output:
# ID: 001, Name: web-server-01, IP: 192.168.1.10, Status: Active
# ID: 002, Name: WIN-DC01, IP: 192.168.1.5, Status: Active
# ID: 003, Name: db-server-02, IP: 192.168.1.20, Status: Disconnected

sudo /var/ossec/bin/wazuh-logtest
 
# When prompted, paste a sample log line, e.g.:
# Mar 13 10:22:15 web01 sshd[1234]: Failed password for invalid user admin from 1.2.3.4 port 55123 ssh2
 
# Expected output will show matched rule, level, and groups

# Manually trigger firewall-drop for a test IP (use a non-production IP)
sudo /var/ossec/bin/agent_control -b 198.51.100.1 -f firewall-drop0 -u 001
 
# Verify the block was applied on the agent
sudo iptables -L INPUT -n | grep 198.51.100.1
 
# Remove the test block
sudo iptables -D INPUT -s 198.51.100.1 -j DROP

#!/bin/bash
# wazuh-health-check.sh — run daily via cron
 
echo "=== Wazuh Health Check: $(date) ==="
 
# Manager service status
echo -n "Manager: "
systemctl is-active wazuh-manager && echo "OK" || echo "FAILED"
 
# Indexer status
echo -n "Indexer: "
systemctl is-active wazuh-indexer && echo "OK" || echo "FAILED"
 
# Dashboard status
echo -n "Dashboard: "
systemctl is-active wazuh-dashboard && echo "OK" || echo "FAILED"
 
# Active agent count
ACTIVE=$(sudo /var/ossec/bin/agent_control -lc 2>/dev/null | grep -c "Status: Active")
TOTAL=$(sudo /var/ossec/bin/agent_control -l 2>/dev/null | grep -c "^ID:")
echo "Agents: $ACTIVE/$TOTAL active"
 
# Disk usage on log partition
echo -n "Log disk usage: "
df -h /var/ossec/logs | awk 'NR==2{print $5" used ("$4" free)"}'
 
# Recent alert count (last hour)
ALERTS=$(find /var/ossec/logs/alerts/ -name "*.json" -newer /tmp/.wazuh-check-marker 2>/dev/null | wc -l)
touch /tmp/.wazuh-check-marker
echo "Alerts (last run): $ALERTS alert files"
 
echo "=== End Health Check ==="

sudo chmod +x /usr/local/bin/wazuh-health-check.sh
 
# Run daily at 6am
echo "0 6 * * * root /usr/local/bin/wazuh-health-check.sh >> /var/log/wazuh-health.log 2>&1" \
  | sudo tee /etc/cron.d/wazuh-health