Previous Step

Adding Another Interface to pfSense in VMware Workstation

In this module, we will look at the process of adding an additional interface to the pfSense VM when the VMware Workstation GUI only shows four available interfaces.

0xBEN0xBEN

Order of Operations

1. Add an additional interface to the pfSense VM

• This interface will serve as the target for all of the SPAN configurations
• The SPAN configurations will create copies of each Ethernet frame from each interface and send them to the SPAN port

2. Install the Wazuh Stack as an all-in-one installation

• Use the quick setup script to install the following services:
  • Wazuh Indexer
  • Wazuh Manager
  • Wazuh Dashboard

3. Install the NIDS component on the same VM

• Suricata will capture packets from the SPAN interface
• It will output logs in JSON format, which will be read by Wazuh Manager

4. As your lab grows, install Wazuh Agents on your Linux and Windows VMs

• Install agents on any hosts you want to monitor
• The hosts need to be able to communicate with the Wazuh Manager's IP address over tcp/1514 and tcp/1515 (can also be configured for UDP if desired)

Desired End State

pfSense VM

• New interface added and SPAN configurations created

Wazuh Stack + NIDS

• Configured network interfaces
• Installed and configured Wazuh Stack
  • Log into Wazuh Dashboards
  • Ensure all connections are working
• Installed and configured Suricata
  • Capturing packets from SPAN
  • Wazuh Manager is configured to read Suricata logs

Wazuh Agents

• Wazuh Agent is installed on any host to be monitored
• Wazuh Agent can communicate with Wazuh Manager IP over tcp/1514 and tcp/1515

Enabling Packet Capture

pfSense SPAN Port

Overview of the Changes

In this step, we are going to add an additional interface to the pfSense VM, much like we did in the previous step, but in the case of this new interface, it will serve the sole purpose of being a SPAN port to capture packets.

In the case of this diagram, we are doing the following:

1. Adding a new interface to the pfSense VM called, SPAN
2. Attaching the SIEM / IDS to the LAN and SPAN interfaces
3. The LAN interface provides a DHCP address to the SIEM
   1. The SPAN interface does not get any IP assignment and is simply used to receive frames copied from each interface, which in this case is:
      1. LAN
      2. ISOLATED
      3. AD_LAB
      4. SEC_EGRESS
4. With the Ethernet frames flowing to the SPAN interface
   1. Suricata on the IDS host will analyze the packets and generate logs
   2. Wazuh will be configured to ingest the log file(s)

Adding the SPAN Port

Configure the New Interface

Configure the Span Ports

LAN to SPAN

ISOLATED to SPAN

AD_LAB to SPAN

SEC_EGRESS to SPAN

Desired End State

Adding the Wazuh Stack

Ubuntu Server OVA

We are going to use the same specs that would be configured with the Wazuh OVA appliance:

• 4 CPU
• 8 GB RAM
• 50 GB Disk

Import the OVA

Ubuntu 24.04 LTS (Noble Numbat) daily [20250626]

• Username: ubuntu
• Password: wazuh — or whatever you assigned in the window above

sudo poweroff

Configure the VM

Add a DHCP Reservation

Log into pfSense using your Kali VM and go to Status > DHCP Leases...

sudo systemctl restart systemd-networkd

Expanding the Disk Partition

sudo fdisk /dev/sda

command (m for help): F

command (m for help): d

command (m for help): n

• First Sector: Press the ENTER key to accept the default
• Last Sector: Press ENTER key to accept the default
• Do you want to remove the signaure? Enter N

command (m for help): w

sudo resize2fs /dev/sda1

sudo reboot

Installing the Wazuh Stack

Quickstart · Wazuh documentation

User manual, installation and configuration guides. Learn how to get the most out of the Wazuh platform.

Wazuh

When the installation completes, you should see the password for the admin user printed to the console. However, this VM doesn't support copying to clipboard, so I'm going to use the wazuh-passwords-tool.sh utility to change to something a little easier to type.

sudo /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p 'P@$$word123!'

sudo filebeat keystore add password

sudo systemctl restart filebeat

Logging into Wazuh Dashboard

The login for the Wazuh Dashboard server is:

• Username: admin
• Password: changed using the wazuh-passwords-tool.sh utility

Install the NIDS

Auto-Raise Capture Interface

sudo nano /etc/netplan/50-cloud-init.yaml

network:
  version: 2
  ethernets:
    ens192:
      match:
        macaddress: "00:0c:29:1a:e4:84"
      dhcp4: true
      dhcp6: true
      set-name: "ens192"

network:
  version: 2
  ethernets:
    ens192:
      match:
        macaddress: "00:0c:29:1a:e4:84"
      dhcp4: true
      dhcp6: true
      set-name: "ens192"
    ens32:
      dhcp4: false
      dhcp6: false
      optional: true

sudo netplan apply

Packet Capture Test

In the screenshot below, I'm using tcpdump to listen on ens32 for packets coming from or going to 10.0.0.2 — which is Kali's IP address.

• On the right, we can see Kali pinging 1.1.1.1
• On the left, we can see the traffic in the packet capture

Install and Configure Suricata

sudo apt install -y suricata

sudo nano /etc/suricata/suricata.yaml

  # Extensible Event Format (nicknamed EVE) event log in JSON format
  - eve-log:
      enabled: yes
      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
      filename: eve.json

# Linux high speed capture support
af-packet:
  - interface: ens32
    # Number of receive threads. "auto" uses the number of cores
    #threads: auto
    # Default clusterid. AF_PACKET will load balance packets based on flow.
    cluster-id: 99
    # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
    # This is only supported for Linux kernel > 3.1
...
...
...

Select Suricata Rule Sources

sudo suricata-update update-sources

sudo suricata-update list-sources --free

sudo suricata-update enable-source et/open

sudo suricata-update enable-source tgreen/hunting

sudo suricata-update enable-source stamus/lateral

sudo suricata-update enable-source aleksibovellan/nmap

sudo suricata-update

sudo crontab -e

@reboot /usr/bin/suricata-update
0 2 * * * /usr/bin/suricata-update

sudo systemctl enable --now suricata

systemctl status suricata

Configure Wazuh Manager

Now that Suricata is analyzing captured network traffic, any events will be written to /var/log/suricata/eve.json. We need to tell the Wazuh Manager to read and ingest the logs from the file.

sudo nano /var/ossec/etc/ossec.conf

<ossec_config>
  <global>
    <rotate_interval>1d</rotate_interval>

<ossec_config>
  <localfile>
    <log_format>json</log_format>
    <location>/var/log/suricata/eve.json</location>
  </localfile>
</ossec_config>

sudo systemctl restart wazuh-manager

Trim Logs

sudo crontab -e

# Run every day at 0400
# Find Suricata log files older than 30 days and delete
0 4 * * * find /var/log/suricata -maxdepth 1 -mtime +30 -type f -exec rm -f {} \; > /dev/null

# Run every day at 0400
# Find Wazuh log directories older than 30 days and recursively delete
0 4 * * * find /var/ossec/logs/alerts -type d -mtime +30 -exec rm -rf {} \; > /dev/null 2>&1
0 4 * * * find /var/ossec/logs/archives -type d -mtime +30 -exec rm -rf {} \; > /dev/null 2>&1

Prevent Unplanned Upgrades

Wazuh documentation

User manual, installation and configuration guides. Learn how to get the most out of the Wazuh platform.

Wazuh

When consulting the Wazuh official documentation, you should take note of one key requirement:

We want to avoid unplanned upgrades of the Wazuh Manager stack and the Wazuh agents. So, first we'll take care of this on the Wazuh Manager side.

sudo apt-mark hold wazuh-indexer

sudo apt-mark hold wazuh-dashboard

sudo apt-mark hold wazuh-manager

Installing the Wazuh Agent

Update pfSense Firewall Rules

Log into the pfSense web configuration console and navigate to Firewall > Rules > Floating.

Example: Installing on Windows

In this example, I'm going to install the Wazuh Agent on a Windows Server 2019 host (the domain controller in my AD_LAB LAN).

Wazuh agent - Installation guide · Wazuh documentation

User manual, installation and configuration guides. Learn how to get the most out of the Wazuh platform.

Installation guide · Wazuh documentationWazuh

When copying the command, paste into a text editor such as notepad.exe on your Windows host. Then copy from notepad.exe and paste into the Windows VM. You may also need to install open-vm-tools on your Windows VM to enable clipboard access.

Get-Service WazuhSvc

Get-Service WazuhSvc | Start-Service

Integrate Sysmon

This is a great way to extend the monitoring capabilities on your Windows hosts. In this article, I show you how to:

• Download the Sysmon ruleset for Wazuh Manager
• Install Sysmon on Windows hosts
• Create a Wazuh Agent group and add Windows hosts to the group
• And ingest the Sysmon logs from your Windows endpoints using the Wazuh Agent

Wazuh: Mapping Sysmon Events to MITRE ATT&CK IDs

In this post, I show how I implemented and worked around some issues while adding an enhanced ruleset mapping Sysmon events to ATT&CK IDs.

0xBEN0xBEN

Testing Capabilities

I am running the example commands on my Kali VM and targeting my domain controller at 10.80.80.2. The credentials I'm using come from the AD lab exercises in the previous parts of this home lab series.

impacket-secretsdump -outputfile 'dcsync.txt' 'ad.lab/Administrator:P@$$word123!'@10.80.80.2

impacket-psexec 'ad.lab/Administrator:P@$$word123!'@10.80.80.2

sudo nmap -Pn --top-port 50 10.80.80.2

Important: Index Management

You REALLY want to do this now as opposed to later.

• Save your disk space
• Reduce stressful troubleshooting hours
• Trim your indices and improve performance

Do it now! Please.

Wazuh Index Management Policy

In this post, I show how to manage your Wazuh Indexer indices in order to improve performance and manage disk space consumed by indices.

0xBEN0xBEN

Follow-Up Activities

Extending Wazuh's Capabilities

Taylor Walton has done a really fantastic job at creating content that showcases Wazuh's capabilities and ways to extend it with various integrations. I wholeheartedly recommend taking a look.

Taylor Walton

Focusing on Open Source cybersecurity products that provide a robust and scalable solution that can be customized to integrate with any network. Cofounder of the worlds first open source security operations center: https://www.socfortress.co

YouTube

Also, have a look at a some of the additional Wazuh content I've written. If I included, everything here, the guide would quickly grow out of scope.

Wazuh - 0xBEN

Wazuh SIEM

0xBEN0xBEN

Finishing Up the Home Lab Guide

Building a Security Lab in VMware Workstation Pro

In this project, broken up into multiple modules, you will build a comprehensive cybersecurity home lab using VMware Workstation Pro. Upon completion, you will have an environment where you can safely practice penetration testing against a wide variety of targets, as well as detection in your SIEM.

0xBEN0xBEN