Wazuh SIEM

# Add Wazuh repository
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list

# Install agent
apt update
WAZUH_MANAGER="YOUR_WAZUH_SERVER_IP" apt install -y wazuh-agent

# Enable and start agent
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent

# Check status
systemctl status wazuh-agent

# Add Wazuh repository
rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=Wazuh repository
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

# Install agent
WAZUH_MANAGER="YOUR_WAZUH_SERVER_IP" yum install -y wazuh-agent

# Enable and start
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent

# On the WAZUH SERVER, list connected agents
docker exec -it single-node-wazuh.manager-1 /var/ossec/bin/agent_control -l

# You should see something like:
# ID: 001, Name: ubuntu-server, IP: 192.168.1.50, Active

# Or check in the Dashboard:
# Agents → Summary

# Edit manager config
docker exec -it single-node-wazuh.manager-1 nano /var/ossec/etc/ossec.conf

# Add/modify email settings:
<global>
  <email_notification>yes</email_notification>
  <smtp_server>smtp.gmail.com</smtp_server>
  <email_from>wazuh@yourdomain.com</email_from>
  <email_to>security@yourdomain.com</email_to>
  <email_maxperhour>12</email_maxperhour>
</global>

<!-- Alert on level 10+ -->
<alerts>
  <email_alert_level>10</email_alert_level>
</alerts>

# Restart manager
docker exec single-node-wazuh.manager-1 /var/ossec/bin/wazuh-control restart

# Create Slack integration script
docker exec -it single-node-wazuh.manager-1 bash -c 'cat > /var/ossec/integrations/custom-slack << "EOF"
#!/bin/bash
# Slack Webhook Integration for Wazuh

WEBHOOK_URL="YOUR_SLACK_WEBHOOK_URL"

read -r INPUT
ALERT_LEVEL=$(echo $INPUT | jq -r ".alert_level")
RULE_DESC=$(echo $INPUT | jq -r ".rule_description")
AGENT_NAME=$(echo $INPUT | jq -r ".agent_name")
TIMESTAMP=$(echo $INPUT | jq -r ".timestamp")

# Color based on severity
if [ "$ALERT_LEVEL" -ge 12 ]; then
  COLOR="danger"
elif [ "$ALERT_LEVEL" -ge 8 ]; then
  COLOR="warning"
else
  COLOR="good"
fi

curl -X POST -H "Content-type: application/json" \
  --data "{
    \"attachments\": [{
      \"color\": \"$COLOR\",
      \"title\": \"Wazuh Alert - Level $ALERT_LEVEL\",
      \"text\": \"$RULE_DESC\",
      \"fields\": [
        {\"title\": \"Agent\", \"value\": \"$AGENT_NAME\", \"short\": true},
        {\"title\": \"Time\", \"value\": \"$TIMESTAMP\", \"short\": true}
      ]
    }]
  }" $WEBHOOK_URL
EOF
chmod +x /var/ossec/integrations/custom-slack'

# Add to manager ossec.conf:

<!-- Active Response - Block attacking IPs -->
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>100001</rules_id>  <!-- Our brute force rule -->
  <timeout>600</timeout>        <!-- Block for 10 minutes -->
</active-response>

# This will automatically block any IP that triggers
# 5+ failed SSH logins in 2 minutes

# From any machine, try failed SSH logins
# (Use wrong password intentionally)

for i in {1..6}; do
  ssh fakeuser@YOUR_MONITORED_SERVER
done

# Press Ctrl+C after each password prompt
# Check Wazuh Dashboard → Security Events
# You should see brute force alerts!

# On a monitored server, modify a watched file
sudo touch /etc/test-fim-alert

# Or add a comment to hosts file
echo "# test" | sudo tee -a /etc/hosts

# Wait for FIM scan (up to 5 minutes)
# Check Dashboard → Integrity Monitoring

# Clean up
sudo rm /etc/test-fim-alert
sudo sed -i '/# test/d' /etc/hosts