Behold, the behemoth that is called the NIST Cybersecurity Framework.
This framework is divided into three parts, core, profile, and tiers.
The framework core that is currently on the screen contains high‑level best
practices for cybersecurity and risk management, in general. Wazuh primarily
sits within the detect and respond functions.
Let's dive into this a little bit more. The NIST Framework defines
categories for every function. Wazuh primarily sits within two
categories, Anomalies and Events and Mitigation.
As they say, it's turtles all the way down.
So let's dig into specific subcategories for Wazuh. As we've seen,
Wazuh has multiple attack detection capabilities.
Even more, many Wazuh rules have mappings to various compliance standards
such as HIPPA and PCI DSS. As far as event correlation, Wazuh's definitely
got you covered. In this course, we will also write a rule that leverages
Wazuh's event correlation engine.
Last,
but certainly not least is Wazuh's ability to mitigate
attacks by running custom scripts.
We'll explore this in the last section.
As a brief aside,
the items highlighted here isn't a comprehensive depiction of Wazuh, rather
these are areas that I'll be focusing on in this course.
Okay,
I've got a little more framework action for you before
moving on to the demo. MITRE ATT&CK. So,
given that Wazuh has strengths in many areas, MITRE ATT&CK coverage for
Wazuh is going to be quite broad. For purposes of this course, we'll focus
our defenses on three MITRE ATT&CK techniques.
First off is scheduled task or job, hijack execution
flow, and exfiltration over C2 channel.
Here, we see a MITRE ATT&CK technique and a mapping to the MITRE Shield
active defense. In this course, we'll use Wazuh to monitor the file system
for a scheduled task that might go unnoticed.
Next, we'll use Wazuh's active response functionality to
block malware on the victim's machine.
Last, we'll create an escalation rule that quarantines a
host and prevents data exfiltration.
We'll do all of this within the Docker‑based
simulation environment that you can run.
Let's zoom out a little bit and see how Wazuh fits into a generic network.
Then we'll expand on the simulation environment.