Installing and Using Wazuh: A Comprehensive Guide

Wazuh is an open-source security monitoring platform that provides intrusion detection, compliance checking, log analysis, and more. It’s a powerful tool for managing security alerts and incidents across diverse IT environments. Wazuh integrates with the Elastic Stack (Elasticsearch, Logstash, and Kibana) to enable advanced data processing and visualization capabilities. This comprehensive guide will walk you through the process of installing and using Wazuh for enhancing your organization’s security posture.

Understanding Wazuh

Wazuh is built on the foundation of OSSEC (Open Source HIDS Security), extending its functionality with more features and integrations. It consists of two main components:

• Wazuh Server: Collects and analyzes data from deployed agents.
• Wazuh Agent: Installed on monitored systems, collects system data and reports it to the server.

Wazuh can detect intrusions, system misconfigurations, malware, rootkits, and malicious activities. It’s highly scalable, making it suitable for small to large deployments.

Prerequisites

Before installing Wazuh, ensure you have the following:

• A Linux server for the Wazuh server (Ubuntu, CentOS, or another distribution). This guide will use Ubuntu as an example.
• One or more target systems for the Wazuh agent (Linux, Windows, macOS).
• Sufficient privileges to install packages and configure services on the server and agents.

Installing Wazuh Server

The Wazuh server installation involves setting up the Wazuh manager and the Elastic Stack. Here, we’ll cover the installation on an Ubuntu server.

Step 1: Install Wazuh Manager

1. Add the Wazuh repository:

   curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --dearmor > /usr/share/keyrings/wazuh-archive-keyring.gpg
   echo "deb [signed-by=/usr/share/keyrings/wazuh-archive-keyring.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list
   

2. Update the package information and install the Wazuh manager:

   apt-get update
   apt-get install wazuh-manager
   

Step 2: Install Wazuh API (Now Integrated into the Wazuh Manager)

Starting with Wazuh 4.x, the API is integrated into the Wazuh manager, simplifying the installation process.

Step 3: Install and Configure the Elastic Stack

1. Install Elasticsearch:

   Elasticsearch is a search and analytics engine used by Wazuh for advanced data processing.

   • Add the Elastic Stack repository and install Elasticsearch:

     curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | gpg --dearmor > /usr/share/keyrings/elasticsearch-keyring.gpg
     echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/7.x/apt stable main" | tee /etc/apt/sources.list.d/elastic-7.x.list
     apt-get update
     apt-get install elasticsearch
     

   • Configure Elasticsearch by editing /etc/elasticsearch/elasticsearch.yml (adjust configurations as needed for your environment).

   • Start and enable Elasticsearch:

     systemctl daemon-reload
     systemctl enable elasticsearch.service
     systemctl start elasticsearch.service
     

2. Install Kibana:

   Kibana provides visualization capabilities for data stored in Elasticsearch.

   • Install Kibana:

     apt-get install kibana
     

   • Configure Kibana by editing /etc/kibana/kibana.yml (set the Elasticsearch URL and adjust other settings as necessary).

   • Start and enable Kibana:

     systemctl daemon-reload
     systemctl enable kibana.service
     systemctl start kibana.service
     

3. Install Wazuh plugin for Kibana:

   • Use the Wazuh Kibana plugin to integrate Wazuh UI into Kibana:

     sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-<WAZUH_VERSION>-<KIBANA_VERSION>.zip
     

   Replace <WAZUH_VERSION> and <KIBANA_VERSION> with the appropriate version numbers.

Installing Wazuh Agent

Install Wazuh agents on the systems you want to monitor. The agent communicates with the Wazuh server to report system data.

On Linux

1. Add the Wazuh repository (if not added):

   Follow the same steps as for the Wazuh manager to add the repository.

2. Install the Wazuh agent:

   apt-get install wazuh-agent
   

3. Configure the Wazuh agent:

   Edit /var/ossec/etc/ossec.conf to set the Wazuh manager’s IP address.

4. Start the Wazuh agent:

   systemctl daemon-reload
   systemctl enable wazuh-agent
   systemctl start wazuh-agent
   

On Windows and macOS

Wazuh provides installers for Windows and packages for macOS. Download the appropriate installer from the Wazuh website and follow the installation instructions.

Using Wazuh

After installing the Wazuh server and agents, you can start monitoring and managing your IT environment’s security.

• Access the Wazuh Web UI: Open Kibana in your web browser and navigate to the Wazuh app to view dashboards, alerts, and manage configurations.
• Rule Management: Customize Wazuh rules to define specific conditions for generating alerts.
• Log Analysis: Use Wazuh to analyze system and application logs for suspicious activities.
• Compliance Checking: Configure compliance policies to ensure your systems adhere to standards like PCI DSS, HIPAA, and more.

Conclusion

Wazuh is a comprehensive security monitoring solution that can significantly enhance your organization’s ability to detect and respond to security threats. By following this guide, you’ve learned how to install the Wazuh server and agents, integrate with the Elastic Stack for data processing and visualization, and begin using Wazuh for security monitoring. Remember, ongoing management and tuning of Wazuh and its components are crucial for maintaining an effective security posture.