Upgrading Wazuh Components
In this post, I'll be covering process of upgrading Wazuh tailored to some customizations in my environment.
6 min read
Wazuh
Wazuh SIEM
13 posts
Wazuh: File Integrity Monitoring
In this post, I show you how to configure and monitor File Integrity Monitoring (FIM) in Wazuh.
12 min read
Threat Hunting with FleetDM and Osquery
Recently, the folks at Chainguard open-sourced some Osquery threat hunting queries, so I wrote a script to convert the queries to YAML docs for import into FleetDM.
6 min read
Wazuh: Enhancing Zeek Logs with RITA
In this post, I demonstrate how to install and configure RITA on a NIDS node running Zeek and ingest the RITA output with Wazuh command logging.
8 min read
Hunting with Wazuh: Adding Context
In this post, I elaborate on the Log All JSON option in the Wazuh Manager's configuration and how that can add more context beyond just alerts.
7 min read
Wazuh Index Management Policy
In this post, I show how to manage your Wazuh Indexer indices in order to improve performance and manage disk space consumed by indices.
5 min read
Wazuh: Exploring the OwlH Integration
In this post, I explore the OwlH integration with Wazuh and the convenience of the centralized NIDS configuration management it offers.
14 min read
Wazuh: Migrating to Wazuh Dashboard, Wazuh Indexer, and to Version 4.3
In this post, I go over the procedure of migrating from OpenDistro Elasticsearch to Wazuh Indexer, OpenDistro Kibana to Wazuh Dashboard, and Wazuh 4.2 to Wazuh 4.3.
9 min read
Wazuh: Mapping Sysmon Events to MITRE ATT&CK IDs
In this post, I show how I implemented and worked around some issues while adding an enhanced ruleset mapping Sysmon events to ATT&CK IDs.
5 min read