Has anyone tried Wazuh?

manu

I just happened to stumble upon https://wazuh.com/ which is the Open Source Security Platform. Was curious to know if anyone has tried it and if so can through some light on how the experience is

TIA

netzen

manu I'm currently testing it and trying it out, I'm new to it. So far I have managed to get the RAM, CPU, HDD resource monitoring working. I also have Crowsec, through which I block SSH Brute Force + send logging blocks from UFW to Crowsec. Now I'm trying to connect it to Wazuh.

https://community.enhance.com/d/2204-testing-wazuh-integration-with-enhance-seeking-advice-and-experiences

JohnB

netzen be curious to know what you find if you feel like sharing here

gmakhs

Interesting ...

netzen

https://zaferbalkan.com/2024/06/19/crowdsec-wazuh-integration.html

Here is an interesting article about CrowdSec + Wazuh integration.

Since I want to use it for different alerts than the Apache and ModSecurity mentioned in the article. So it's still difficult to understand. When I have something working, I'll be happy to share.

So far collecting UFW logs of blocked IP addresses works for me.

So far, collecting UFW logs of blocked IP addresses into CrowdSec works for me. I'd like to get it on Wazuh.

@cPFence Have you ever tried linking your logs and such with Wazuh?

cPFence

netzen Have you ever tried linking your logs and such with Wazuh?

No, we haven’t tried that yet, but it sounds interesting. Feel free to give it a try and let us know how it works for you.

Rich

My curiosity has been piqued, but it seems a PITA to setup simple linux resource monitoring... Shame. If we can get OLS log watching too that would be amazing.

*might of just deleted my fresh zabbix server in interest of watching this development. 😉

netzen

Yes, setting up Wazuh isn’t exactly straightforward, but I’m slowly starting to get the hang of it—slowly. Here’s my humble dashboard so far, monitoring resource usage like RAM, CPU, Disk I/O, as well as processed logs from UFW block events and logs from OpenLiteSpeed (OLS). I’m still working on it.

My next step is to configure Wazuh to automatically block IPs from the OLS logs using the firewall. After that, I plan to create a dashboard for cPFence, but I know that will be quite a challenge. 🙂 @cPFence

Rich

netzen Amazing work!

Is it possible to have an overview of the cluster that shows cpu/mem/storage/io like a minimal bar chart of all the servers? Likewise maybe a patch and/or threat level next too each? (Just wondering if you think it's doable)

A bit like top hosts in this image:

netzen

Rich
You mean like this?

I think it might work. I'll play around with it. I'm starting to enjoy it.

Rich

netzen Yes, something that gives a really quick overview of the whole cluster. Thanks for sharing it's really interesting!

netzen

Rich When I'm more confident in what I'm doing, I'll share the procedures. 🙂

Rich

netzen Thank you sir, that's awesome!

kyzoeadmin

netzen that would be awesome, also love to know more about the crowdsec integration with Enhance en Wazuh

gmakhs

I am considering to start using it too, keep us updated!

netzen

Thank you all for your interest! Since I’m basically a beginner with Wazuh, I’ve been experimenting, which has brought up new topics for me to explore. Currently, I’m focusing on monitoring metrics for individual website containers. To gather this data and convert it into JSON, I’ve started using Vector. It’s capable of processing almost anything into JSON, which Wazuh can read without the need for creating complex decoders.

So, I’ll spend about a week studying and experimenting, and hopefully, I’ll come up with a functional setup that can monitor examples like overall server load, individual container performance, PHP logs, OpenLiteSpeed logs (which I use), UFW, SSH, and more. I’d also like to include logs and data from cPFence.

So, if I don’t post any updates in the next few days, it doesn’t mean I’m not working—quite the opposite 🙂 Hopefully, this will lead to creating something truly useful for monitoring Enhance servers. Looking forward to sharing my progress and hearing your thoughts!

JohnB

netzen it doesn’t mean I’m not working—quite the opposite 🙂

Well work faster!

Just kidding!! We appreciate you sharing and look forward to your update

gmakhs

i wonder if https://github.com/google/cadvisor can help us also to find problematic websites?

netzen

The individual websites in Enhance do not run on Docker containers, but rather use cgroups for resource isolation. This means that cAdvisor, which is specifically designed to monitor Docker containers, wouldn't be directly applicable in this case. However, you can collect data from the cgroups using Vector and then send it to Wazuh for monitoring and visualization. That’s what I’m attempting to do. If I’m mistaken, please correct me 🙂

ivansalloum

@netzen Are you getting the diff command identified as a rootkit in Wazuh?

netzen

ivansalloum I've reviewed the logs from my Wazuh setup and checked for any mention of the diff command being flagged as a rootkit. However, I couldn't find any related alerts or detections. While it seems that Wazuh is not identifying it as a rootkit, I cannot say this with absolute certainty without further confirmation. Let me know if there are specific steps you'd recommend to verify this more thoroughly.