Wazuh SIEM(SOC 1 of 3)

 Get Wazuh

• # project: https://github.com/wazuh/wazuh-docker
• git clone https://github.com/wazuh/wazuh-docker.git -b v4.12.0

Cert

• sudo docker-compose -f generate-indexer-certs.yml run --rm generator

Run

• Set ufw 9200/tcp,1514-1516/tcp/udp,443/tcp
• sudo docker-compose up -d
• open https://ip:your_port or space(443) check status
  use default account admin and password SecretPassword to login

Agent

• Windows:install Agent and modify ip point to wazuh ip before start service
• Linux: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html
• sudo -s
• check curl be install
• GPG Key
  curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
• REPO
  echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
• sudo apt-get update
• CONFIG
  sudo apt-get install gnupg apt-transport-https
  curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
• WAZUH_MANAGER="<wazuh_ip>
• apt-get install wazuh-agent
• SERVICE
  sudo systemctl daemon-reload
  sudo systemctl enable wazuh-agent
  sudo systemctl start wazuh-agent
• STOP UPDATE: agent update use manager control panel
  sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list
  sudo apt-get update

Wazuh SIEM (SOC Level 1 of 3) Update

Down

• cd $HOME/wazuh-docker/single-node
• sudo docker compose down

New Version # https://github.com/wazuh/wazuh-docker

• cd $HOME/wazuh-docker/
• git fetch --all --tags
• git reset --hard
• git checkout v4.14.5

Cert

• sudo docker-compose -f generate-indexer-certs.yml run --rm generator

Run

• sudo docker-compose up -d
• login and upgrade agent

Wazuh

•  git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.2

• cd wazuh-docker/single-node/
• modify docker-compose.yml
• #change 443 to your port
• #modify memory or  CPU limit
• docker-compose -f generate-indexer-certs.yml run --rm generator
• docker-compose up -d

• open https://ip:your_port or space(443) to check is running
• admin:SecretPassword
• modify default password

• Agent
• https://wazuh.com/install/
• docker ps
• docker exec -it single-node-wazuh.manager-1 or com-id /bin/bash
• bash-5.2# /var/ossec/bin/manage_agents
• ****************************************
• * Wazuh v4.9.2 Agent manager.          *
• * The following options are available: *
• ****************************************
•    (A)dd an agent (A).
•    (E)xtract key for an agent (E).
•    (L)ist already added agents (L).
•    (R)emove an agent (R).
•    (Q)uit.
• Choose your action: A,E,L,R or Q:
• 1.Press (A) to set a new agent with name (Computer's name), IP (any)
• 2.Press (L) to find ID 00x
• 3.Press (E) to create auth key
• get the auth key to keyin agent on win or linux
• check wazuh run on services.msc