Space-Bar.Site

Wazuh is an open-source security monitoring platform that provides intrusion detection, vulnerability detection, incident response, and compliance management. It integrates with the MITRE ATT&CK framework for threat detection and hunting.

Service Management

systemctl start wazuh-manager - Start Wazuh manager

systemctl stop wazuh-manager - Stop Wazuh manager

systemctl restart wazuh-manager - Restart Wazuh manager

systemctl status wazuh-manager - Check manager status

systemctl start wazuh-agent - Start Wazuh agent

systemctl status wazuh-agent - Check agent status

/var/ossec/bin/wazuh-control status - Check all components status

/var/ossec/bin/wazuh-control start - Start all components

/var/ossec/bin/wazuh-control stop - Stop all components

/var/ossec/bin/wazuh-control restart - Restart all components

Agent Management

/var/ossec/bin/agent_control -l - List all agents

/var/ossec/bin/agent_control -e - Restart agent

/var/ossec/bin/agent_control -r - Remove agent

/var/ossec/bin/agent_control -a - List active agents

/var/ossec/bin/agent_control -i - Show agent info

/var/ossec/bin/agent_control -u - Upgrade agent remotely

/var/ossec/bin/agent_control -s - Show agent statistics

/var/ossec/bin/manage_agents - Manage agent keys

Log Files

/var/ossec/logs/ossec.log - Main Wazuh manager log

/var/ossec/logs/alerts/alerts.json - JSON formatted alerts

/var/ossec/logs/alerts/alerts.log - Standard alert log

/var/ossec/logs/archives/archives.log - Archived logs

tail -f /var/ossec/logs/alerts/alerts.log - Monitor alerts in real-time

tail -f /var/ossec/logs/ossec.log - Monitor main log

Rule Configuration

/var/ossec/etc/rules/local_rules.xml - Custom local rules

/var/ossec/etc/rules/ - Rules directory

/var/ossec/etc/ossec.conf - Main configuration file

wazuh-logtest - Test rule matching

wazuh-logtest -f - Test rules against log file

Searching Alerts

grep -i "rule.id" /var/ossec/logs/alerts/alerts.log - Search by rule ID

grep -i "agent.id" /var/ossec/logs/alerts/alerts.log - Search by agent ID

jq '.rule.id' /var/ossec/logs/alerts/alerts.json - Query JSON alerts

jq '.rule.mitre.id' /var/ossec/logs/alerts/alerts.json - Filter by MITRE ATT&CK ID

jq 'select(.rule.level >= 10)' /var/ossec/logs/alerts/alerts.json - High severity alerts

MITRE ATT&CK Framework Integration

Wazuh automatically maps detection rules to MITRE ATT&CK tactics, techniques, and sub-techniques. Alerts include ATT&CK metadata for threat hunting and correlation.

ATT&CK Metadata in Rules

<rule id="100200" level="12">
  <if_sid>1002</if_sid>
  <match>authentication failure</match>
  <description>Multiple authentication failures detected</description>
  <mitre>
    <id>T1110</id>
    <tactic>Credential Access</tactic>
    <technique>Brute Force</technique>
  </mitre>
</rule>

Querying ATT&CK Techniques

# Search for T1110 (Brute Force) alerts
jq 'select(.rule.mitre.id == "T1110")' /var/ossec/logs/alerts/alerts.json

# Search by tactic
jq 'select(.rule.mitre.tactic[] | contains("Credential Access"))' /var/ossec/logs/alerts/alerts.json

# Search for specific technique
jq 'select(.rule.mitre.technique == "Brute Force")' /var/ossec/logs/alerts/alerts.json

Common ATT&CK Mappings

T1003 - OS Credential Dumping (password file access)

T1018 - Remote System Discovery (network scanning)

T1021 - Remote Services (SSH, RDP connections)

T1047 - Windows Management Instrumentation (WMI abuse)

T1055 - Process Injection (suspicious process behavior)

T1070 - Indicator Removal (log deletion)

T1071 - Application Layer Protocol (network traffic)

T1105 - Ingress Tool Transfer (file downloads)

T1110 - Brute Force (authentication failures)

T1548 - Abuse Elevation Control Mechanism (sudo/privilege escalation)

Threat Hunting with ATT&CK

# Hunt for credential access techniques
jq 'select(.rule.mitre.tactic[] | contains("Credential Access")) | {time: .timestamp, agent: .agent.name, rule: .rule.description, mitre_id: .rule.mitre.id}' /var/ossec/logs/alerts/alerts.json

# Hunt for persistence mechanisms
jq 'select(.rule.mitre.tactic[] | contains("Persistence")) | {time: .timestamp, technique: .rule.mitre.technique, id: .rule.mitre.id}' /var/ossec/logs/alerts/alerts.json

# Hunt for privilege escalation
jq 'select(.rule.mitre.tactic[] | contains("Privilege Escalation"))' /var/ossec/logs/alerts/alerts.json | jq -s 'group_by(.rule.mitre.id) | map({technique: .[0].rule.mitre.technique, count: length, id: .[0].rule.mitre.id})'

Creating Custom Rules with ATT&CK

<group name="custom,mitre_attack,">
  <rule id="100001" level="10">
    <if_sid>5710</if_sid>
    <match>sudo.*su.*root</match>
    <description>Suspicious sudo to su root escalation</description>
    <mitre>
      <id>T1548.003</id>
      <tactic>Privilege Escalation,Defense Evasion</tactic>
      <technique>Sudo and Sudo Caching</technique>
    </mitre>
  </rule>

  <rule id="100002" level="12">
    <if_group>web</if_group>
    <match>SQL.*injection</match>
    <description>SQL injection attempt detected</description>
    <mitre>
      <id>T1190</id>
      <tactic>Initial Access</tactic>
      <technique>Exploit Public-Facing Application</technique>
    </mitre>
  </rule>
</group>

File Integrity Monitoring (FIM)

/var/ossec/etc/ossec.conf - Configure FIM in <syscheck> section

/var/ossec/queue/fim/ - FIM events directory

FIM Configuration Example

<syscheck>
  <disabled>no</disabled>
  <frequency>43200</frequency>
  <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
  <directories check_all="yes">/bin,/sbin</directories>
  <ignore>/etc/mtab</ignore>
  <ignore>/etc/hosts.deny</ignore>
  <ignore>/etc/mail/statistics</ignore>
</syscheck>

Rootcheck

/var/ossec/etc/ossec.conf - Configure rootcheck

grep "rootcheck" /var/ossec/logs/alerts/alerts.log - View rootcheck alerts

/var/ossec/etc/shared/default/rootcheck.conf - Rootcheck configuration

Vulnerability Detection

/var/ossec/wodles/vulnerability-detector/ - Vulnerability detector scripts

wazuh-cli -d -u -f /var/ossec/wodles/vulnerability-detector/vulnerability-detector.py - Run vulnerability scan

jq 'select(.vulnerability)' /var/ossec/logs/alerts/alerts.json - View vulnerability alerts

API Usage

curl -k -u wazuh:wazuh -X GET "https://localhost:55000/agents?pretty" - List agents via API

curl -k -u wazuh:wazuh -X GET "https://localhost:55000/agents/?pretty" - Get agent details

curl -k -u wazuh:wazuh -X GET "https://localhost:55000/rules?rule_ids=1002&pretty" - Get rule information

curl -k -u wazuh:wazuh -X POST "https://localhost:55000/syscollector//hardware?pretty" - System inventory

curl -k -u wazuh:wazuh -X GET "https://localhost:55000/rootcheck/?pretty" - Rootcheck results

curl -k -u wazuh:wazuh -X GET "https://localhost:55000/syscheck/?pretty" - FIM baseline

Common Commands

wazuh-cli -c /var/ossec/etc/ossec.conf -l - List configuration

wazuh-logtest - Interactive log testing tool

wazuh-keystore - Manage encrypted keys

/var/ossec/bin/wazuh-control info - System information

/var/ossec/bin/verify-agent-conf - Verify agent configuration

/var/ossec/bin/syscheck_update - Update FIM baseline manually

Configuration Locations

/var/ossec/etc/ossec.conf - Main configuration (manager/agent)

/var/ossec/etc/rules/ - Rule files directory

/var/ossec/etc/decoders/ - Log decoders directory

/var/ossec/etc/shared/ - Shared configuration for agents

/var/ossec/etc/lists/ - CDB lists for rules

Tips

Use MITRE ATT&CK metadata in custom rules for better threat hunting

Regularly review high-level alerts (level 12+)

Use jq for querying and filtering JSON alert logs

Create custom rules in local_rules.xml, not in default rule files

Test rules with wazuh-logtest before deploying

Monitor agent connectivity - disconnected agents can't send alerts

Use FIM to monitor critical system files and directories

Enable vulnerability detection for compliance scanning

Correlate alerts using MITRE ATT&CK tactics to identify attack chains

Use the API for automation and integration with other tools

Check /var/ossec/logs/ regularly for errors

Keep Wazuh updated to get latest detection rules and MITRE mappings

Use rootcheck to detect rootkits and suspicious system modifications

Create dashboards based on MITRE ATT&CK tactics for threat visibility

Archive and analyze historical alerts for threat hunting

Menu

GARY IS COMING FOR YOU

Bartender

Wazuh Tool Reference