Wazuh SIEM Installation & Configuration Tutorial

As cyber threats continue to intensify, maintaining strong security monitoring is essential to protecting digital assets and ensuring uninterrupted operations. Wazuh, a free and open-source security platform, combines Extended Detection and Response (EDR) and Security Information and Event Management (SIEM) capabilities to deliver comprehensive protection for endpoints and cloud environments. Its wide range of applications includes configuration assessment, malware detection, file integrity monitoring, threat hunting, log analysis, vulnerability detection, incident response, regulatory compliance, IT hygiene, container security, posture management, and workload protection.

Wazuh Workflow

To install both Wazuh Server and Wazuh Agent, I will be using Ubuntu 24.04.

===============================================================

Wazuh Server Installation

**VM Specification** Operating System: Ubuntu 24.04 LTS RAM: 4 GB Hard Disk: 20 GB Network Adapter: NAT, Host-only 2 CPU cores

Let’s open up our Ubuntu Machine, and firstly we need to run this command:

• sudo apt-get update && sudo apt-get upgrade -y to update our package.

updating our packages

• curl -sO https://packages.wazuh.com/4.8/wazuh-install.sh && sudo bash ./wazuh-install.sh -a to install Wazuh Server, simply run the command above. Please make sure that we have enough storage on our PC (min. 4GB RAM & 20GB Hard Disk)

Once we are done installing all Wazuh Server Features, the interface of our Ubuntu will be like this, such as stating our Username and Password

As we can also see, there is the guide to access the web interface https://<wazuh-dashboard-ip>:443 that will be our next step

• How to know our wazuh-dashboard-ip? We can simply run this command in our terminal : ip addr show

We just need to pay attention to the IP addr on eth0 section, so basically wazuh-dashboard-ip is our own device’s private IP addr.

• Next, open up the web interface and navigate to https://<wazuh-dashboard-ip>:443

wazuh interface

By using the previous stated Username and Password, let’s try to log in into our Server account

After logging in, the interface of the homepage should look like this

Wazuh HomePage Interface

• Until this step, our Wazuh Server installation is done! Now let’s move on to our Wazuh Agent installation

First’ let’s navigate to Endpoints Summary tab on the left-side navbar

Then we will be required to fill the form, including entering our Server IP address.

Then, we have to run this command in our terminal in order to start the Agent installation

As well as these 3 commands to enable and start wazuh-agent

===============================================================

Wazuh Agent Installation

**VM Specification** Operating System: Kali Linux (64-bit) RAM: 2 GB Hard Disk: 20 GB Network Adapter: NAT or Bridged 2 CPU cores

Please do note here, to set up the Wazuh Agent, we have to use the totally different machine from the Wazuh Server we are going to connect to. I didn’t have another device to set up on, thus **I decided to set Wazuh Agent up on VMWare Kali Linux** (it is the free Virtual Machine) using the same device as Wazuh Server.

So, after I finished configuring up the Virtual Machine, I just need to copy and execute the previous command from the Wazuh Server into the Kali Linux terminal

Kali Linux VMWare Interface

As we can see on the image above, that command is to install the Wazuh Agent Server. Once the installation is done, do remember to start the Wazuh Agent too by executing these 3 commands sudo systemctl daemon-reload sudo systemctl enable wazuh-agent sudo systemctl start wazuh-agent

Start Wazuh Agent

Once successfully configuring the Wazuh Agent, we can immediately see the Agent connected in the Wazuh Server Dashboard

Wazuh Server Interface following Agent Installation

Now, we have finished installing & configuring both Wazuh Server and Wazuh Agent. To conclude, we need two different IPs address for both Server and Agent. If applicable, then we just need to set up each of them on different device. Otherwise, we can do what I have done here, such as by using the Virtual Machine for the Agent one to save cost!

===============================================================