HowTo: Wazuh SIEM/XDR from scratch

Wazuh is an open-source detection (XDR) and log management (SIEM) platform: agents on endpoints, file integrity, log collection, vulnerability detection and automated response. This guide takes you from install to custom rules and integrations.

Install (all-in-one or separate components)

Wazuh has three components: manager (analysis), indexer (storage/search, based on OpenSearch) and dashboard. To start, all-in-one:

curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
bash ./wazuh-install.sh -a               # manager + indexer + dashboard
# prints the 'admin' password for https://server (dashboard)
tar -xf wazuh-install-files.tar          # generated certificates
systemctl status wazuh-manager wazuh-indexer wazuh-dashboard

For large scale you install the components separately (multiple indexer nodes). The official docs have the -wi / -ws / -wd steps.

Enroll agents + groups

The agent registers with the manager (authd) and gets a key. You put it in a group to inherit a shared configuration.

# Linux
WAZUH_MANAGER='wazuh.example.com' apt install wazuh-agent
systemctl enable --now wazuh-agent
# Windows
msiexec /i wazuh-agent-4.9.0.msi /q WAZUH_MANAGER='wazuh.example.com'
Net Start WazuhSvc
# on the manager: list agents + put them in a group
/var/ossec/bin/agent_control -l
/var/ossec/bin/agent_groups -a -i 003 -g web-servers

FIM: file integrity (realtime + whodata)

Syscheck monitors directories; with whodata (audit) you also learn who made the change, not just that it happened.

<!-- /var/ossec/etc/shared/web-servers/agent.conf -->
<syscheck>
  <disabled>no</disabled>
  <directories check_all="yes" realtime="yes" whodata="yes">/var/www,/etc</directories>
  <alert_new_files>yes</alert_new_files>
  <frequency>43200</frequency>
</syscheck>
# restart and check on the agent:
/var/ossec/bin/wazuh-control restart

Log collection + rootcheck

Collect any log (auth, nginx, application, Windows Event) and run policy/rootkit checks.

<!-- localfile in agent.conf -->
<localfile><log_format>syslog</log_format><location>/var/log/auth.log</location></localfile>
<localfile><log_format>json</log_format><location>/var/log/nginx/access.json</location></localfile>
<localfile><log_format>eventchannel</log_format><location>Security</location></localfile>
# rootcheck + SCA (Security Configuration Assessment) are on by default

Custom rules and decoders

When you want alerts on your own app, you write a decoder (extracts fields) and a rule (decides severity). Test with wazuh-logtest.

<!-- /var/ossec/etc/rules/local_rules.xml -->
<group name="local,syslog,">
  <rule id="100100" level="12">
    <if_sid>5716</if_sid>         <!-- SSH login failed -->
    <srcip>!192.168.0.0/16</srcip>
    <description>SSH failure from outside</description>
  </rule>
</group>
# quick test:
echo 'Failed password for root from 1.2.3.4' | /var/ossec/bin/wazuh-logtest

Active response: automatic blocking

On serious rules, the manager tells the agent to react — e.g. block the IP in the firewall for 10 minutes.

<!-- ossec.conf on the manager -->
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>5710,5712,100100</rules_id>
  <timeout>600</timeout>
</active-response>
# see actions in /var/ossec/logs/active-responses.log

Vulnerability detection + integrations

Wazuh correlates the package inventory with CVE feeds and integrates with VirusTotal (FIM hashes) and Suricata (eve.json).

<!-- ossec.conf on the manager -->
<vulnerability-detection><enabled>yes</enabled></vulnerability-detection>
<integration>
  <name>virustotal</name>
  <api_key>***</api_key>
  <rule_id>100200,554</rule_id>
</integration>
# Suricata: collect /var/log/suricata/eve.json as a json localfile

Operations: index maintenance and visualization

The indexer is OpenSearch; you use ISM (Index State Management) so it doesn't grow forever, and the dashboard for investigations.

# indexer state
curl -k -u admin:*** https://localhost:9200/_cat/indices?v
# ISM policy: rollover at 30 GB / delete after 90 days (dashboard: Index Management)
# live alerts: dashboard > Threat Hunting / Security events