You just completed the course. Wahooo! Before I let you go,
let's check out some additional information to take your
Wazuh skills to the next level.
First, we're going to dive into some additional Wazuh capabilities.
In my opinion,
this blog post can take your FIM skills to the next level. As a blue teamer,
you probably have an understanding of VirusTotal. If you'd like an example
of how to integrate Wazuh's FIM and VirusTotal, definitely check out this
link. To note, all of these links can be viewed within the additional
resources section within the course notes.
Much of the power of Wazuh is within its integrations.
This blog post gives a great example of how to use AuditD and
Wazuh to monitor root account actions in Linux.
The Proof of Concept Guide highlights different Wazuh configurations.
Examples include osquery integration,
monitoring AWS infrastructure, and a bunch of other situations
that should get your creative juices flowing. While we covered
Linux‑based attacks in this course,
Wazuh is equally effective on Windows machines.
For more information, please check out this blog post.
Let's turn our focus onto some broader topics.
The main attack in this course, the preload attack, is a classic
example of the hijack execution flow MITRE technique.
For more information on this attack and defenses, check out the MITRE link.
I'm going to provide a few links to the technology that
enables Wazuh to be so effective.
Kibana is obviously one of the go‑to platforms for threat hunting.
I'm providing a Kibana version 7.9 link because that is
the version that we used in this course.
Next up is Elasticsearch. Wazuh integrates with the Open Distro for
Elasticsearch. To get more information on this flavor of Elasticsearch,
please check out the link.
Well, that's a wrap.
I hope this course was useful and allowed you to see the power
of Wazuh within your blue team workflow.
As always, I'd love to stay in contact.
If you'd like to contact me personally,
please go to my website, zachroofsec.com, and also
feel free to follow me on Twitter.
I look forward to interacting with you.