Hi, my name's Zach Roof, and welcome to the cybersecurity course featuring Wazuh.
The Wazuh wolf, also known as the Wazuh logo.
As you might know, wolves are skilled hunters.
Additionally, if you've ever heard a wolf howl,
awooo, you will know that wolves are very social animals.
In my view, the wolf perfectly symbolizes the Wazuh project.
Similar to the wolf, the Wazuh team is social in that they are community driven.
Complementary to a wolf, Wazuh is a fine hunter,
and no, it doesn't hunt caribou, it hunts endpoint threats.
But a wolf pack is nothing without a fearless leader.
Wazuh was created by Santiago Bassett, and at the time of this recording,
Wazuh has over 80 employees on LinkedIn.
I wanted to take a brief moment to thank Santiago and his team for
their contributions to the security community.
If you check out Wazuh's GitHub issues,
you will notice the Wazuh team will spend significant
amounts of time to help you use their product,
even if you don't have a support plan.
This project is truly community driven,
and I aspire to run a project with this ethos into the future.
This quote helps us understand the mission of the Wazuh project.
Wazuh is a free and open source platform used for threat prevention,
detection, and response.
Wazuh is capable of protecting workloads across on‑prem,
virtualized, containerized, and cloud‑based environments.
Phewf, that wolf is no joke.
All right, let's dive into these areas a little bit more.
At a high level, Wazuh is composed of an agent,
a manager, and an ELK stack for visualizing alerts and threat hunting.
In the next slide, we'll dive deeper into a few areas of the Wazuh agent.
I know, there's a lot on the slide, but to make this digestible,
I'll highlight the areas that are key to understanding
the concepts outlined in this course.
First off is malware detection.
Wazuh can detect hidden files, visible processes,
as well as inconsistencies and system call responses.
Next up is the log collector.
Wazuh reads operating system and application logs.
Not only does Wazuh read the logs, but it also has a vast rule set,
which the manager can use to generate alerts.
There are rules for MySQL, the Docker daemon,
NGINX, even cloud providers, such as AWS.
The list goes on and on.
And also, as a little aside, you can view the rule set at course notes number 1.
While we're on the topic of the course notes,
all of the course notes can be found at this link.
Additionally, the repo contains the Docker‑based simulation environment,
as we'll soon see.
Okay, let's continue.
Next up is file integrity monitoring, also known as FIM.
In many cases, the file system houses clues of compromise,
which is just juicy information for blue teamers,
such as yourself.
Wazuh monitors the file system by identifying changes in file content,
file permissions, and file ownership.
We'll dive into FIM heavily in this course.
As I said, this is huge for you, the blue teamer.
Next, is active response.
Wazuh's active response functionality allows you to trigger
custom scripts whenever Wazuh detects an event.
Due to time constraints, I can't review all of the areas in this slide.
However, if you'd like to learn more, please visit course notes number 2.
While the manager needs to run on Linux,
the Wazuh agents can monitor pretty much everything under the sun.
There's support for Mac, Windows, Linux,
as well as some not‑so‑common operating systems,
such a Solaris.
In this course,
we'll use a Docker‑based simulation environment that is heavily
influenced by Wazuh's Docker configuration.
If you're creating an environment from scratch,
I'd use this Docker configuration as your starting point.
This link can be seen at course notes number 3.
Additionally, if you're launching Wazuh in a real environment,
and you want to use Docker, I recommend reading the documentation at this link.
As you can tell via the URL, were using Wazuh version 4.0.
This can be seen at course notes number 4.
In general, Wazuh's documentation is very thorough.
I recommend looking through all of the sections.
Here's the documentation for deploying the agents.
If you're looking to make the registration between the
Wazuh agent and server as easy as possible,
I recommend using the deployment variables.
All of this information can be seen within the Wazuh agent installation section.
Check out course notes number 5.