Using Wazuh for Threat Detection and Log Monitoring

by

Why SIEM is Non-Negotiable

Most organisations already collect logs. Few actually use them. A SIEM turns noise into alerts. Wazuh (fork of OSSEC) offers enterprise-grade SIEM, free and open source.

Deployment Checklist

  1. Install Wazuh Manager on a central server.
  2. Deploy Wazuh Agents to endpoints (Linux, Windows, cloud).
  3. Integrate Logs: journald, syslog, Apache, MySQL, cloud services.
  4. Enable Rules: detect brute force, privilege escalation, file integrity changes.
  5. Dashboarding via Kibana/Elastic for visualisation.

Applied Example

  • Journald logs forwarded into Wazuh flagged multiple failed SSH attempts.
  • Alert triggered playbook to temporarily ban source IPs (fail2ban style).

Why Clients Care

  • Compliance evidence: CIS, ISO, PCI all require log monitoring.
  • Cost efficiency: Open-source vs Splunk licensing.
  • Real-time protection: Spotting brute force within minutes, not weeks.