In a typical deployment,
the Wazuh agent inspects a server or an employee's
laptop for malicious activity.
Wazuh also has the ability to inspect devices that
don't have the agent installed.
This is called agentless monitoring,
and it's pretty dang sweet. Agentless monitoring allows
Wazuh to monitor devices via SSH.
This would include firewalls and routers. In particular, file integrity
monitoring, or FIM, can be accomplished via this feature. Regardless of the
agent or agentless configuration, all information is streamed to the Wazuh
server within a security suite for rule‑based analysis.
At this point,
let's look at our Docker‑based simulation environment
that we'll be leveraging in this course.
First off is the victim container.
As expected,
the victim container will contain the Wazuh agent for monitoring purposes. In
this course, we'll be using Merlin to simulate the red team.
Merlin is a command and control framework,
and we'll assume that the Merlin agent has somehow
ended up on the victim's machine.
Perhaps the victim clicked on a phishing link. As we
can see, those HR people never learn.
Anyhow, going back to the Wazuh agent, the Wazuh agent
will send telemetry to the Wazuh server.
The blue team containers compose the Wazuh server and an ELK stack for
visualizing and persisting the alerts. Wazuh actually has its own
Cabana application for this visualization.
And to be candid,
I have a little bit of a crush on this application,
it's so beautiful! Crushes aside,
let's move on to the Merlin server container. Through this
container, we'll deploy malware onto the victim's machine
and see how Wazuh responds.
Alright, while these diagrams were needed to lay our foundation,
I'm starting to get some PowerPoint fatigue.
From here on out, we'll be in the simulation
environment getting some hands‑on experience.
Next up is installing the simulation environment.