Case study: detection and compliance with Wazuh (XDR/SIEM)

A company wanted to know what happens on its endpoints and servers: who modifies files, which security logs appear, what vulnerabilities exist, and to react automatically to attacks. We deployed Wazuh — the open-source XDR/SIEM platform — with an agent on every machine. Here is the configuration.

The requirement: detection + integrity + compliance

Three needs in one: detection (attacks, malware, suspicious behavior), file integrity (who changed what, when — an audit requirement) and compliance (centralized logs for ISO 27001 / PCI). An antivirus covers none of these in a correlated way.

In short: you see who touched important files, which attacks were attempted, and you get the evidence for the audit — from a single place.

Architecture

A Wazuh agent on each endpoint and server sends events to the Wazuh manager, which analyzes them with rules and decoders, indexes them and shows them in the dashboard. On serious alerts, the agent can react on its own (block IP, kill process).

Install Wazuh (all-in-one)

For a medium environment, the combined install (manager + indexer + dashboard) is fastest.

# Debian/Ubuntu/RHEL — official installer
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
bash ./wazuh-install.sh -a          # all-in-one
# at the end it prints the 'admin' user + password for the dashboard (https://server)
tar -xf wazuh-install-files.tar     # keep the certificates
systemctl status wazuh-manager wazuh-indexer wazuh-dashboard

Enroll agents (Linux + Windows)

The agent registers with the manager and sends data encrypted.

# Linux
curl -sO https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.0-1_amd64.deb
WAZUH_MANAGER='wazuh.cymmunity.ro' dpkg -i ./wazuh-agent_4.9.0-1_amd64.deb
systemctl enable --now wazuh-agent
# Windows (PowerShell)
msiexec /i wazuh-agent-4.9.0.msi /q WAZUH_MANAGER='wazuh.cymmunity.ro'
Net Start WazuhSvc
# on the manager confirm the agent is active:
/var/ossec/bin/agent_control -l

FIM, log collection, custom rules

You configure which folders to watch (syscheck) and which logs to collect in ossec.conf. Alerts are tuned with your own rules.

<!-- /var/ossec/etc/ossec.conf on the agent -->
<syscheck>
  <directories check_all="yes" realtime="yes">/etc,/usr/bin,/var/www</directories>
  <directories check_all="yes" realtime="yes">C:\inetpub\wwwroot</directories>
</syscheck>
<localfile><log_format>syslog</log_format><location>/var/log/auth.log</location></localfile>

A custom rule on the manager (e.g. alert on changes in /var/www):

<!-- /var/ossec/etc/rules/local_rules.xml -->
<group name="web,">
  <rule id="100200" level="10">
    <if_sid>550</if_sid>
    <field name="file">/var/www</field>
    <description>File changed in the web root</description>
  </rule>
</group>
systemctl restart wazuh-manager

Vulnerabilities + automated response + integrations

Wazuh correlates installed packages with CVE databases and can react on its own to attacks (active response), plus integrations with VirusTotal and Suricata.

# vulnerability detection (in ossec.conf on manager): <vulnerability-detection enabled="yes">
# active response: block IP on brute-force (firewall-drop)
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>5710,5712</rules_id>   <!-- SSH brute-force -->
  <timeout>600</timeout>
</active-response>
# VirusTotal integration on FIM hashes + Suricata eve.json

Result

The company now sees, from one dashboard, who modifies critical files, which attacks are attempted, what vulnerabilities each machine has, and has centralized logs for audit. Brute-force attacks are blocked automatically. We write the rules, reduce false positives and keep the platform under 24/7 monitoring.