The SIEM-phony of My Cyber Lab

 

I chose to use Wazuh for my home lab for a few reasons.

·        Easy to use, though my last experience was uncertain. The intuitive interface ensures that even beginners can navigate the system with minimal training, although occasional uncertainties may still arise.

 

·        Being a free and open source makes Wazuh an ideal solution to learn and master the basics of a SIEM. This accessibility allows individuals and organizations to experiment and develop their security monitoring skills without financial barriers.

 

·        Scalable, allowing the SIEM solution to grow with my cyber needs. As your organization expands and the complexity of your cybersecurity demands increases, this SIEM solution can easily accommodate additional data sources and increased workloads.

 

·        Comprehensive features, offering flexibility to explore and learn as desired. It includes a wide range of tools and functionalities that cater to various aspects of security information and event management, providing users with the opportunity to deepen their knowledge and expertise.

What I did.

Today I decided to have another go at trying to get the Wazuh dashboard to connect to my linux endpoints in my home cyber lab after last time where I couldn’t make it work I was fully invested for an uphill battle but with a different approach this wasn’t to be the case, I decided to approach the problem differently this time, I opened virtual box and started my fedora, mint and the Wazuh manager VM’s.

The picture shows a virtual box running three VMs. Each VM operates as an independent system within the virtual box, allowing for various configurations and setups. These virtual machines can simulate different operating environments, enabling testing and development without affecting the host system. The flexibility of VMs makes them valuable in tasks such as software testing, security analysis, and server virtualization.

 

Setting up on linux mint

I logged in to the web based dashboard using Firefox in my  linux mint VM and To add an endpoint, all you need is the Wazuh manager's IP address and a unique name for the endpoint, the first step is to choose the correct type of linux. For mint I chose the DEB amd64 option then put the IP address and name in to the relevant boxes and the CLI commands were generated and they just need to be copied and pasted in to the terminal, there are two one is for downloading and setting up the Wazuh agent and the other restarts the agent on the end point, and everything is set up. You don’t need to alter the .conf file which is something I may have had issues with the last time I tried to do this.

 

This image depicts the initial section of the web dashboard utilized for configuring a new endpoint. The dashboard is designed to provide an intuitive interface for users to easily set up and manage endpoints. It includes various options and settings that allow for customization, security configurations, and performance monitoring. By using this dashboard, users can ensure that their endpoints are configured correctly and optimized for their specific needs.

 

After successfully setting up the Wazuh agent on Linux Mint, I was greeted by a web dashboard interface that simplified the process immensely. This picture shows the initial steps for configuring a new endpoint on the web dashboard. By entering the IP address of the Wazuh manager and a unique name for the endpoint, the dashboard generated the necessary CLI commands for downloading and setting up the Wazuh agent. Once these commands were copied into the terminal, the agent was seamlessly downloaded and restarted, without the need to manually edit the .conf file, which I found to be a stumbling block in previous attempts. This streamlined method not only saved time but also reduced the chance for errors, thus ensuring that the setup was both efficient and effective. And less running round in CLI circles for me!

This image displays the terminal on Linux Mint during the download process of the agent. You can see a series of commands being executed, highlighting the steps involved in retrieving and installing the software. The terminal output shows the progress of the download along with detailed information such as file sizes, download speeds, and completion percentages. This visual representation helps convey the procedural aspect of working within a Linux environment and illustrates how users interact with the system through command-line interfaces.

 

The image above depicts the dashboard with one active endpoint. The dashboard provides a comprehensive overview of your system's performance, displaying critical metrics such as response times, error rates, and throughput. You can monitor real-time data, identify trends, and pinpoint areas that require attention. Additionally, it offers customizable widgets and alert settings, enabling you to tailor the interface to meet your specific monitoring needs.

Moving on from how easy it was to set up with linux mint I decided to try with fedora as this was the distro that cause me a lot of issues with the set up the last time I tried, and I was hoping with the different approach that it wouldn’t be the same this time.

Setting up on Fedora

After successfully setting up the agent on Linux Mint, I proceeded to do the same for Fedora. I selected the RPM amd64 option and executed the commands in a similar manner as I did for Linux Mint by copying and pasting them accordingly.

This picture shows the Fedora terminal during the download process of the Wazuh agent. The terminal displays a series of commands being executed, highlighting the steps involved in retrieving and installing the software. You can observe detailed progress indicators such as file sizes, download speeds, and completion percentages. This visual representation emphasizes the precision and procedural aspect of working within a Linux environment, showcasing how users interact with the system through command-line interfaces to achieve successful configurations. The comprehensive output provides insight into the methodical nature of software installation and the reliability of executing commands for accurate setup. Which was a lot easier than the last time I tried to do this!

 

After I had completed the steps required, I checked the wed dashboard and saw that there were now 2 endpoints active

The picture illustrates the dashboard showcasing two active endpoints. The interface provides a detailed and user-friendly overview of the system’s operational metrics. Users can observe critical performance indicators such as response times, error rates, and data throughput. This comprehensive display facilitates real-time monitoring and trend analysis, helping identify potential issues promptly. The dashboard’s customizable widgets and alert settings allow users to tailor their monitoring experience to suit specific requirements, thus enhancing the efficiency and effectiveness of system management.

In conclusion, my experience setting up Wazuh this time was much smoother than my previous attempts, largely due to a different approach. This process highlighted the importance of flexibility and experimentation in tackling technical challenges. While following established methods can be helpful, it is equally valuable to explore alternative solutions that may simplify the task at hand.

The web dashboard proved to be an invaluable asset, streamlining configurations and significantly reducing the need for manual adjustments. This automation not only saved time but also minimized the potential for errors, ensuring a more reliable setup. The success of this endeavour has fuelled my enthusiasm for further exploration and learning, reinforcing the notion that there is always room for improvement and innovation.

I am eager to keep growing my technical skills. This experience will guide my future projects. Next, I plan to connect my endpoints to Wazuh and integrate pfsense into my home lab, aiming to create a virtual SOC later. By implementing pfsense, I will enhance my network security, ensuring robust protection against potential threats. Setting up a virtual Security Operations Centre (SOC) will allow me to monitor, detect, and respond to security incidents in a simulated environment, giving me valuable hands-on experience in cybersecurity management. This endeavour will not only solidify my understanding of network security principles but also prepare me for more complex challenges in the future.