Wazuh SIEM/XDR Install & Evaluation
Budget: $15 – $25 CAD
Assignment Steps
Activity Steps
1. Install the latest version of Ubuntu Server supported by the Wazuh Open Source SIEM/XDR platform (wazuh.com) in a new virtual machine with 8GB RAM minimum.
2. Use putty.exe on your Windows 11 host to connect to your Ubuntu Server using SSH. Paste the command within the Quickstart guide on the Wazuh website to install Wazuh (this process will take some time). At the end of the installation, copy the admin password displayed to a text file on your Windows 11 host for reference.
3. Next, access https://UbuntuIP and log in as admin. Explore the interface. Note from the Dashboard events that Wazuh automatically monitors the Ubuntu Server system.
4. Follow the instructions to deploy the Wazuh agent to your Windows 11 host (endpoint) and start the service. Ensure that the endpoint is given the description YournameEndpoint.
5. In your Wazuh console, access the Configuration Assessment for your Windows 11 endpoint and take a screenshot of the Dashboard results (2 marks).
6. In your Wazuh console, access File Integrity Monitoring > Inventory and take a screenshot of the files shown for your Windows 11 endpoint (2 marks).
7. In your Wazuh console, access Vulnerability Detection and take a screenshot of the Dashboard results for your Windows 11 endpoint (2 marks). Next, peruse any Critical and High severity results, researching the CVEs noted.
8. Submit your three (3) screenshots alongside answers for the following questions to your instructor:
• What types of devices can Wazuh monitor? (3 marks)
• Is it agent-based or agentless or both? (1 mark)
• What are the differences between the free and paid version? (2 marks)
• List 3 other SIEM products on the market that provide similar functionality to Wazuh.
(3 marks)
9. Challenge: Another common alternative to Wazuh is Security Onion. Download and install Security Onion in a virtual machine. Next, compare/contrast Security Onion with Wazuh.
Activity Steps
1. Install the latest version of Ubuntu Server supported by the Wazuh Open Source SIEM/XDR platform (wazuh.com) in a new virtual machine with 8GB RAM minimum.
2. Use putty.exe on your Windows 11 host to connect to your Ubuntu Server using SSH. Paste the command within the Quickstart guide on the Wazuh website to install Wazuh (this process will take some time). At the end of the installation, copy the admin password displayed to a text file on your Windows 11 host for reference.
3. Next, access https://UbuntuIP and log in as admin. Explore the interface. Note from the Dashboard events that Wazuh automatically monitors the Ubuntu Server system.
4. Follow the instructions to deploy the Wazuh agent to your Windows 11 host (endpoint) and start the service. Ensure that the endpoint is given the description YournameEndpoint.
5. In your Wazuh console, access the Configuration Assessment for your Windows 11 endpoint and take a screenshot of the Dashboard results (2 marks).
6. In your Wazuh console, access File Integrity Monitoring > Inventory and take a screenshot of the files shown for your Windows 11 endpoint (2 marks).
7. In your Wazuh console, access Vulnerability Detection and take a screenshot of the Dashboard results for your Windows 11 endpoint (2 marks). Next, peruse any Critical and High severity results, researching the CVEs noted.
8. Submit your three (3) screenshots alongside answers for the following questions to your instructor:
• What types of devices can Wazuh monitor? (3 marks)
• Is it agent-based or agentless or both? (1 mark)
• What are the differences between the free and paid version? (2 marks)
• List 3 other SIEM products on the market that provide similar functionality to Wazuh.
(3 marks)
9. Challenge: Another common alternative to Wazuh is Security Onion. Download and install Security Onion in a virtual machine. Next, compare/contrast Security Onion with Wazuh.