Lab3.2Wazuh

Installation

Install wazuh:

• curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -i

Make sure to screenshot or somehow save the long password provided at the end

Once the installation is complete, access the dashboard at https://172.16.200.10:443 and log in with the password provided

Find the groups, Dropdown next to logo > Management > Groups

• Make a new one called "linux"

Then go to the agents section, and select the right settings to create a command to run on the computer of choice, in this case web01, to install an agent. This is what I did for mine:

• Linux - RPM64 (I hope this was right)
• Server address - 172.16.200.10
• Group - Linux

This gives you a command to run to install the agent, which looks like this:

Then you start the agent with these commands:

• sudo systemctl daemon-reload
• sudo systemctl enable wazuh-agent
• sudo systemctl start wazuh-agent

File structure

A quick google told me that most wazuh things (or at least the conf file) are located in the /var/ossec, so I looked around in there and found some logs, and the conf file, which is located in /var/ossec/etc/ossec.conf

For example, here is the tree structure of logs and etc: