Wazuh: Setup, Configuration, and Best Practices

Introduction to Wazuh

Wazuh is a free, open-source security platform that unifies Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) capabilities. It provides comprehensive threat detection, vulnerability detection, incident response, and compliance monitoring for endpoints, cloud environments, and on-premises infrastructure.

Why Wazuh Matters

In today's complex threat landscape, relying on perimeter firewalls is no longer sufficient. Wazuh matters because it provides deep visibility into system activities, allowing developers and security teams to detect anomalies, investigate incidents, and respond to threats in real-time. By analyzing log data and monitoring file integrity, Wazuh helps organizations meet compliance standards like PCI-DSS, HIPAA, and GDPR while protecting critical assets.

Architecture Overview

The Wazuh ecosystem consists of three main components:

Wazuh Indexer: A highly scalable search and analytics engine based on Elasticsearch. It stores and indexes security events and alerts.
Wazuh Server: The core of the platform. It analyzes data received from agents, applies rules, and triggers alerts.
Wazuh Dashboard: A web user interface based on OpenSearch Dashboards used for visualizing data, managing agents, and monitoring system health.
Wazuh Agents: Lightweight software installed on monitored endpoints (Linux, Windows, macOS) that collects logs, monitors file integrity, and executes active responses.

Setting Up Wazuh

For development and testing environments, an all-in-one deployment is the fastest way to get started. This installs the Wazuh Server, Indexer, and Dashboard on a single host.

Prerequisites

Ensure your server meets the minimum requirements (at least 4GB of RAM, 2 CPU cores, and a supported Linux distribution like Ubuntu 22.04 or RHEL 8). Update your system and install the necessary tools:

sudo apt-get update
sudo apt-get install curl gnupg apt-transport-https

Installing the Wazuh Server (All-In-One)

Wazuh provides an automated installation script to simplify the deployment process. Download and execute the script to install all components on a single machine:

curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh
sudo bash ./wazuh-install.sh --all-in-one

Once the installation completes, the script will output the auto-generated admin credentials. You will need these to log into the Wazuh Dashboard. Access the dashboard by navigating to https://<your-server-ip> in your web browser.

Configuring Wazuh

After setting up the server, the next step is to enroll agents on the endpoints you want to monitor and configure custom rules.

Enrolling Agents

To install and enroll a Wazuh agent on a Linux endpoint, you can use the Wazuh repository. Replace WAZUH_MANAGER_IP with the IP address of your Wazuh server.

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee -a /etc/apt/sources.list.d/wazuh.list
sudo apt-get update

sudo WAZUH_MANAGER="WAZUH_MANAGER_IP" WAZUH_REGISTRATION_PASSWORD="your_registration_password" apt-get install wazuh-agent

sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Configuring Rules and Decoders

Wazuh comes with thousands of built-in rules, but you will often need to write custom rules to monitor application-specific logs. Custom rules should be added to /var/ossec/etc/rules/local_rules.xml on the Wazuh Server.

For example, if you want to trigger an alert when the /etc/passwd file is modified, you can create a custom rule based on the File Integrity Monitoring (FIM) rule ID 550:

<group name="custom_rules,">
  <rule id="100100" level="10">
    <if_sid>550</if_sid>
    <field name="file">/etc/passwd</field>
    <description>CRITICAL: The /etc/passwd file has been modified.</description>
    <group>authentication,syscheck,</group>
  </rule>
</group>

After saving the file, restart the Wazuh manager to apply the changes:

sudo systemctl restart wazuh-manager

Best Practices for Wazuh

To get the most out of Wazuh and ensure your environment remains secure and performant, follow these best practices:

Tune Your Rules: Avoid alert fatigue by tuning default rules. Disable rules that do not apply to your environment and adjust severity levels appropriately.
Secure the Dashboard: Always use HTTPS for the Wazuh Dashboard. Implement Role-Based Access Control (RBAC) to ensure users only have access to the data and features necessary for their roles.
Keep Components Updated: Regularly update the Wazuh server, indexer, dashboard, and agents to patch vulnerabilities and benefit from new detection capabilities.
Scale Horizontally for Production: The all-in-one deployment is great for testing, but production environments should separate the Indexer, Server, and Dashboard across multiple nodes to ensure high availability and performance.
Implement Active Responses: Configure active responses to automatically block malicious IP addresses or kill suspicious processes when specific high-severity rules are triggered.
Monitor Agent Connectivity: Set up alerts for agents that go offline. An offline agent is a blind spot in your security posture.

Conclusion

Wazuh is a powerful, flexible security platform that provides deep visibility into your infrastructure. By understanding its architecture, properly setting up the server and agents, and writing custom rules tailored to your applications, you can significantly enhance your threat detection and incident response capabilities. Adhering to best practices, such as tuning rules and scaling horizontally for production, will ensure that your Wazuh deployment remains robust, manageable, and highly effective in protecting your digital assets.