Has anyone tried Wazuh?: Page 2 - Enhance Control Panel

Has anyone tried Wazuh?

ivansalloum

netzen If you go to the Malware Detection section, do you see all these events regarding the diff command?

ivansalloum

@netzen I checked their rootkit and trojan database and it is outdated. I tried using the signatures of Rootkit Hunter but they have different format. So I ignored the diff false positive by adding a custom rule with level 0 and now I'm integrating Rootkit Hunter with Wazuh to altert us whenever a rootkit is detected by adding a custom decoder and rule for it.

gmakhs

netzen very intresting!! what logs did you used ?

netzen

gmakhs I'm actually not using traditional logs - instead, I implemented a custom Vector configuration that collects container metrics directly from cgroups. It monitors CPU usage, memory consumption, and I/O rates for each container every 5 seconds using an exec source. This gives us real-time performance data for all website containers.

JohnB

@netzen Did you install the W.Server & W.Dashboard components on their own server(s) or alongside Enhance control panel?

netzen

JohnB I installed the Wazuh stack on a dedicated VM (4 cores, 8GB RAM) running on my Hetzner server with Proxmox. I wouldn't recommend installing it alongside the Enhance control panel - it's better to keep them separate to avoid any potential performance impacts or service interference between Wazuh and Enhance.

netzen

JohnB The performance impact is minimal - both Wazuh agent and Vector typically use between 0-2% CPU when checking top. RAM usage is also very low, so you shouldn't notice any significant impact on your system.

netzen

I'll share a guide with the configurations once I have everything well tested. I also want to try getting cPFence data into Wazuh. Will keep you posted 🙂

JohnB

netzen You're awesome, thanks

netzen

I'm starting to process first data from @cPFence in Wazuh. Are you interested in any specific data? Since I'm also new to cPFence, I currently have ModSecurity logs in Wazuh, and I'm thinking about what else might be useful. Thanks for your help 🙂

cPFence

netzen I'm starting to process first data from @cPFence in Wazuh. Are you interested in any specific data? Since I'm also new to cPFence, I currently have ModSecurity logs in Wazuh, and I'm thinking about what else might be useful. Thanks for your help

Here are some useful logs you can process in Wazuh:

Detected Viruses:
/var/log/cpfenceav/infections.history
Killed Queries:
/var/log/cpfenceav/killed_queries.history

IPDB Logs:

sudo tail -f /var/log/syslog | grep -E 'cPFence Blocked:|cPFence DDos Protection:'

Owl Logs:
sudo tail -f /opt/cpfence/app/owl/tmp/logs/main_log

You’ve done a great job so far. Good luck!.

netzen

cPFence Thanks, I'll try it this weekend.

netzen

cPFence Thank you for sharing these log locations! I already have IPDB and Owl logs successfully integrated and forwarding to Wazuh. Regarding the Detected Viruses and Killed Queries - these haven't been generated on my server yet, probably because nothing suspicious was detected 😊 Would you mind sending some example logs to info@netzen.cz? That would help me process and test the integration properly.

I'm making good progress with the Wazuh integration overall. In about 2-3 days, I should be ready to share my configurations with everyone. Thanks again for your help, and wishing you all the best!

manu

@netzen This is great. I tried Wazuh over the weekend too and your inputs are motivating! I will try setting up and see how it works for my use case! I will also post my learnings. I am able to work on Wazuh only on the weekends though thanks to the workload 🙂

cPFence

netzen

You’re welcome. I’ve sent an email with a sample file. Glad to hear about your progress.

netzen

Due to the pre-Christmas rush, I’m running a bit late on my promised timeline. I plan to get back to this topic between the holidays. My apologies for the delay, and wishing you all a wonderful Christmas season! 🎄

Rich

netzen Bro take all the time in the world, you're doing us all a huge favour sharing your findings! Merry Christmas to you too🦌 Pěknou dovolenou!

btraill

netzen Take all the time you need; no need to apologize. We will be here 🙂 Merry Christmas.

netzen

Thanks everyone - I hope to share my configuration for this setup after Christmas. I've successfully mapped UUIDs to domains, allowing me to visualize both container metrics and system metrics on a dashboard like this. While there are multiple display options available, this layout works best for me.

gmakhs

Looks great !

« Previous Page Next Page »