wazuh-documentation
sysmon
wazuh-documentation | sysmon | |
---|---|---|
5 | 2 | |
164 | 55 | |
2.5% | - | |
9.9 | 1.8 | |
1 day ago | almost 3 years ago | |
JavaScript | ||
- | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
wazuh-documentation
- wazuh-archive* index not found in Stack Management / Index Patterns.
-
Custom dashboard with custom visualization to completely replace wazuh dashboard?
First of all, the Wazuh dashboard, created from Kibana, is an individual package, and as so, could be replaced by another package, and this could be not based on Kibana. Depending on the features you are missing in the default Wazuh dashboard, maybe it would be better to use a simpler solution. One options is to just create new visualizations from inside the installed dashboard. Another option would be creating a different package with the modifications you see fit. - For the first option, here you have a tutorial, as it has not yet been added to the documentation: https://github.com/wazuh/wazuh-documentation/issues/5511 - For the second option, all code to create the packages is located in https://github.com/wazuh/wazuh-packages. If none of this solutions is enough for your problem, the APIs you would need to control in your custom dashboards are the ones for the Wazuh server and the Wazuh indexer: - Wazuh API(accessed by port 55000): https://documentation.wazuh.com/current/user-manual/api/index.html#restful-api - Indexer API(accessed by port 9200): https://www.elastic.co/guide/en/elasticsearch/reference/current/rest-apis.html
-
About the log retention management
You can store both alerts and events ( archive logs ) in Wazuh Indexer. (https://github.com/wazuh/wazuh-documentation/issues/4433)
-
What's the default login ID / password for the (self-served) Wazuh dashboard?
Thank you u/granth515 for your feedback! We have created this issue to add this information.
-
Decoders for Watchguard firewalls
Yes, now you should create custom alerts for those events according to your needs. I should not recommend activating the logall option in a production environment. This will take up a lot of your disk space with duplicated events. However, if you want to see archives in Elasticsearch is necessary to follow these steps https://github.com/wazuh/wazuh-documentation/issues/4433.
sysmon
-
Help Me Understand This Level 12 Sysmon Rule
Alright, I'm in the process of setting up wazuh for my organization. It's been working well with the default alerts it comes with. I wanted to try ingesting and alerting on sysmon logs so I added sysmon to a test endpoint (an IT workstation), added the necessary lines to ossec.conf, and added the ruleset mentioned here to the wazuh manager (local_rules.xml). Seems to be working, I see sysmon logs in wazuh and am now being overwhelmed by this level 12 alert...
-
Wazuh or Wazuh and Graylog?
Wazuh can do a lot for you regarding Win events: - https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/how-to-collect-wlogs.html - https://wazuh.com/blog/learn-to-detect-threats-on-windows-by-monitoring-sysmon-events/ - https://github.com/sametsazak/sysmon
What are some alternatives?
howtheysre - A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)
wazuh-ruleset - Wazuh - Ruleset
Wazuh - Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
fim - FIM is an Open Source Host-based file integrity monitoring tool that performs file system analysis, file integrity checking, real time alerting and provides Audit daemon data.
OSSEC - OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
wazuh-dashboard-plugins - Plugins for Wazuh Dashboard
wazuh-ansible - Wazuh - Ansible playbook
wazuh-docker - Wazuh - Docker containers
lynis - Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
postmortem-docs - PagerDuty's Public Postmortem Documentation
wazuh-packages - Wazuh - Tools for packages creation