🛡 Wazuh Mastery Pack · 01 of 15 — Installation & Setup

The single most repeated question from juniors picking up Wazuh:
"Where do I even start?"

This first cheat sheet gets a Wazuh stack from zero to producing alerts in under 30 minutes — Manager, Indexer, Dashboard, Agents, all the ports you must open, and the verification one-liners I run before walking away from any new install.

A few non-obvious things people miss on day one:
- The all-in-one assistant script (wazuh-install.sh -a) is a lab/PoC tool — don't ship it to prod
- /var/ossec/wazuh-install-files.tar contains your initial creds. Move it to a vault. Lose it = full reinstall.
- Prefer TCP/1514 over UDP for event ingest — UDP silently drops events under load
- Always run /var/ossec/bin/wazuh-control configtest before restarting the manager

If you're starting your Wazuh journey this week, this one is for you.


#Wazuh #SIEM #SOC #CyberSecurity #BlueTeam #InfoSec #OpenToWork

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 02 of 15 — CLI Commands

The Wazuh GUI is great. The CLI is where you actually solve problems at 2am.

This cheat sheet is the muscle memory I wish I'd had on day one — service control, agent management, live log testing with wazuh-logtest, cluster operations, and the file paths you'll touch a thousand times.

Three commands every Wazuh operator should burn into memory:

🔹 /var/ossec/bin/wazuh-control configtest
→ validates ossec.conf BEFORE you restart in production. Has saved me from at least three outages.

🔹 /var/ossec/bin/wazuh-logtest
→ paste a raw log line, see exactly which decoder and which rule fires (or doesn't). Single best tool for tuning custom rules.

🔹 /var/ossec/bin/agent_control -l
→ shows every agent and its connection status. Faster than the dashboard when you just need a quick health check.

If you operate Wazuh and aren't using these, you're doing it the hard way.

#Wazuh #SIEM #SOC #BlueTeam #DevSecOps #CLI #InfoSec

📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 03 of 15 — Configuration Files

Wazuh's power lives in three XML files:

🔹 /var/ossec/etc/ossec.conf — manager's brain
🔹 /var/ossec/etc/shared/default/agent.conf — central agent policy
🔹 /var/ossec/etc/rules/local_rules.xml — your custom detections

This cheat sheet ships ready-to-paste blocks for all three — the global section, the <remote> block agents connect through, central agent policy that pushes to every endpoint, and a working custom rule template.

The single biggest mistake I see in custom rules:
👉 Using rule IDs below 100000.
The 1–9999 range is owned by Wazuh's built-in ruleset. Collide with it and your rule will silently lose to the built-in. Always use 100000 and above for your custom detections.

If you're tuning Wazuh this week, save this one.

#Wazuh #SIEM #SOC #DetectionEngineering #InfoSec #BlueTeam

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 04 of 15 — Rules & Decoders

Detection engineering with Wazuh comes down to two artifacts:

📜 Decoders — pull structure out of unstructured logs
🚨 Rules — turn structured fields into alerts

This cheat sheet is the anatomy of both: alert levels 0–16 and what they actually mean, the rule ID ranges that keep you from colliding with built-ins, the chained-rule pattern (if_matched_sid + frequency + timeframe) that detects brute-force behavior, and a working decoder for a custom application log.

A practice that separates senior detection engineers from juniors:
👉 Every rule should map to a MITRE ATT&CK technique.
<mitre><id>T1110</id></mitre>

It costs nothing, takes seconds, and makes your alerts speak the same language as every threat report on the planet.

#Wazuh #DetectionEngineering #SIEM #MITREATTACK #SOC #ThreatHunting #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 05 of 15 — Wazuh API Anything you can do in the Wazuh dashboard, you can automate via the REST API on port 55000. This cheat sheet is the muscle: token auth, the endpoints I hit weekly, filtering and pagination, and curl one-liners you can drop into a Bash script today. Three workflows the API unlocks:
🔹 Mass-restart agents after a rule change → PUT /agents/restart (no more clicking through 200 hosts)
🔹 Auto-decommission stale agents → GET /agents?lastKeepAlive&status=disconnected → DELETE the list
🔹 Pipe rule and SCA data into your own dashboards → no need to touch OpenSearch directly Tokens expire in 15 minutes by default. Re-auth in your script, don't hardcode them.

#Wazuh #API #SIEM #Automation #SOC #DevSecOps #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 06 of 15 — Wazuh Query Language (WQL)

Triage speed = how fast you can write the right query.

This cheat sheet is the field-level reference for filtering alert data inside the Wazuh Dashboard — exact-match, ranges, boolean logic (AND / OR / NOT), wildcards, and the fields you'll reach for every shift.

The three queries every SOC analyst should know by heart:

🔹 rule.level >= 12
→ only critical alerts. Cuts the noise instantly during triage.

🔹 rule.groups: "authentication_failed" AND NOT data.srcuser: "backup"
→ real failed-auth events, minus your noisy service accounts.

🔹 rule.mitre.id: "T1110"
→ every brute-force alert across your fleet, in one click.

Save these as Saved Searches in the Dashboard. Triage time drops by half.

#Wazuh #SOC #ThreatHunting #SIEM #BlueTeam #SecurityAnalyst #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 07 of 15 — MITRE ATT&CK Mapping

Detections without ATT&CK tags are detections that nobody else can interpret.

This cheat sheet shows how to add a single <mitre> block to your custom rules, the techniques you should cover first (T1110, T1078, T1059, T1486, T1003 — these alone catch a huge chunk of real-world attacks), and the queries to slice your alerts by technique.

Why this matters:
👉 Threat reports speak ATT&CK.
👉 Tabletop exercises speak ATT&CK.
👉 Threat-intel feeds tag IOCs with ATT&CK.

The moment your Wazuh rules speak it too, the whole stack — detection → triage → reporting → red team feedback — starts working as one system.

Bonus tip: load your rule.mitre.id data into the MITRE ATT&CK Navigator to see your detection coverage as a heatmap. Find the gaps. Close them.

#Wazuh #MITREATTACK #DetectionEngineering #ThreatIntel #SOC #BlueTeam #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 08 of 15 — File Integrity Monitoring

FIM is the most underrated detection control in any SIEM.

This cheat sheet is the working syscheck config — Linux paths, Windows registry Run keys, realtime vs whodata vs scheduled, report_changes for actual diffs, and the ignore patterns that keep alert volume sane.

Where FIM earns its keep:
✓ /etc on every Linux server (configs, sudoers, cron)
✓ /var/www on web hosts (catches web shells the moment they land)
✓ HKLM\Software\Microsoft\Windows\CurrentVersion\Run on Windows (boot persistence)
✓ C:\Windows\System32\drivers\etc (hosts-file tampering)

Real-time FIM on /etc and Windows registry Run keys = the highest-ROI detection you can deploy in under 10 minutes.

#Wazuh #FIM #FileIntegrityMonitoring #SIEM #SOC #BlueTeam #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 09 of 15 — VirusTotal & TI Integrations

A Wazuh alert that says "new file in /var/www" is OK.
A Wazuh alert that says "new file in /var/www, hash matched 47 VT vendors" is a different conversation.

This cheat sheet is the <integration> block pattern — VirusTotal for hash lookups, Slack for alerting, PagerDuty for on-call wake-ups, Shuffle for SOAR playbooks, and custom webhook for the rest.

Pro tip on VirusTotal:
👉 Free tier = 4 requests/min. Pair the integration with a tight rule_id (e.g. only FIM events under /var/www and /home), or you'll burn the quota in the first 10 minutes of any attack.

The ROI: every analyst-hour spent on triage drops, because the enrichment is already in the alert.

#Wazuh #ThreatIntel #VirusTotal #SOAR #SOC #BlueTeam #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 10 of 15 — Active Response

Detection without response is just expensive logging.

This cheat sheet is Wazuh's killer feature: built-in response scripts (firewall-drop, disable-account, host-deny), the <command> + <active-response> wiring in ossec.conf, and a Bash skeleton for writing your own AR script.

What you can automate today:
🔹 Block an IP for 10 minutes after 5 failed SSH attempts
🔹 Disable a Windows account that fired a credential-dumping detection
🔹 Kill a malicious process the moment FIM sees it write to a sensitive path
🔹 Null-route an IP across every Wazuh agent simultaneously

Two warnings I learned the hard way:
⚠️ Test ARs in lab. A misfire on rule 5715 (failed SSH from your own admin IP) can lock you out of your own server.
⚠️ Use timeouts. Permanent firewall rules age into accidental black holes within weeks.

#Wazuh #ActiveResponse #SOAR #IncidentResponse #SOC #BlueTeam #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Book Review: "The 2026 SOC Playbook — Analysing Incidents Through Attacker Thinking" by Izzmier Izzuddin

Just finished one of the most practical SOC references I've come across this year. 193 pages, 10 end-to-end playbooks built around real 2026 attack patterns — no marketing fluff, just operational gold.

🔹 What makes this different:

Most SOC material stops at the first alert. This one assumes the attacker is successful at every stage and forces the analyst to reconstruct the entire chain, ask the right questions, validate evidence, and complete containment, eradication and recovery. That mindset shift alone is worth the read.

🔹 The 10 playbooks cover what's actually landing in SOC queues right now:

✅ OAuth Consent Abuse & Payment Fraud
✅ AiTM Phishing, Token Replay & Ransomware Staging
✅ Cloud API Token Compromise & SaaS Exfiltration
✅ API Credential Stuffing & Business Logic Abuse
✅ RMM Tool Abuse & Ransomware Deployment Prep
✅ Business Email Compromise & Vendor Payment Manipulation
✅ Teams/OneDrive Phishing, Fileless PowerShell, HTTPS C2
✅ DNS Tunnelling & Covert Exfiltration
✅ Kerberos Abuse & Domain Escalation
✅ Insider Threat & Personal Cloud Exfiltration

Each playbook ships with: attacker thinking, MITRE ATT&CK mapping, simulated evidence, the right investigative questions, log sources, detection logic, and full response workflow.

🔹 Three lessons I'm taking back to my own work:

1️⃣ MFA success ≠ benign activity. The book hammers this — exactly the assumption that lets AiTM and consent-abuse attacks succeed.

2️⃣ Build the chain, not the alert. A single signal is one frame of a longer movie. SOC maturity = stitching frames together fast.

3️⃣ Backup tampering is the new ransomware tell. If your stack ignores backup-system telemetry, you're blind to the deadliest 5 minutes of an incident.

#SOC #BlueTeam #IncidentResponse #ThreatHunting #MITREATTACK #CyberSecurity #InfoSec #DetectionEngineering #DFIR #SIEM #OpenToWork

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 11 of 15 — Compliance & Audit

The fastest way to justify a SIEM budget: hand your auditor a clean Wazuh compliance report.

This cheat sheet is the mapping layer — PCI DSS, HIPAA, GDPR, NIST 800-53, SOC 2/TSC, GPG13, all built into Wazuh. Tag your custom rules with the relevant control IDs and the dashboards generate evidence reports automatically.

The real time-saver here: the SCA module (Security Configuration Assessment).
👉 Run CIS Benchmark scans on every agent
👉 12-hour interval is enough — don't pound the endpoint
👉 Auditors get instant, exportable evidence per host
👉 Ops gets a prioritized hardening backlog

Compliance shouldn't take three weeks of spreadsheet engineering. With SCA + tagged rules, it takes a single dashboard view.

#Wazuh #Compliance #PCIDSS #HIPAA #GDPR #NIST #SOC2 #InfoSec #Audit

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 12 of 15 — Detection Use Cases

Four high-fidelity rules for the attacks you will actually see — copy-paste, restart, you're detecting:

🔹 SSH brute force (5 fails / 60s, same IP) — T1110
🔹 Suspicious PowerShell (-enc, IEX, DownloadString) — T1059.001
🔹 Web shell creation in /var/www — T1505.003
🔹 Mass file modification (ransomware behavior) — T1486

Each rule pinned with frequency thresholds, source-IP grouping, MITRE tags, and alert levels that won't drown your inbox. They're not hypothetical — these are the patterns I tune in real environments.

The single biggest mistake juniors make:
👉 Building detections without a baseline.
Run them in audit mode (level 3) for a week. Watch the false-positive volume. Tune the regex and thresholds. Then promote to level 12.

#Wazuh #DetectionEngineering #ThreatHunting #MITREATTACK #SOC #BlueTeam #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 13 of 15 — Docker & Kubernetes

Containers don't have a /var/log to watch. They have an event stream and an audit log. Wazuh handles both.

This cheat sheet is the working config:

🐳 Docker — the docker-listener wodle pulls container lifecycle events (create, start, exec, kill, network-connect) straight from the daemon socket
☸️ Kubernetes — Wazuh agent as a DaemonSet (one per node) plus parsing /var/log/kubernetes/audit/audit.log

The single most important event to alert on in any container environment:
👉 docker exec into a production container.

If a human (or attacker) is shelling into a running prod container, you want to know about it within seconds. That's a tier-1 alert in any mature container security program.

#Wazuh #Kubernetes #Docker #ContainerSecurity #CloudNative #DevSecOps #SOC #InfoSec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 14 of 15 — Troubleshooting

Wazuh fails in three ways. This cheat sheet covers all three.

🔹 Agent won't connect
→ 90% of the time it's a port (1514 / 1515 blocked) or a key mismatch. nc -vz the manager from the agent. Re-key with agent-auth.

🔹 Queue saturated ("queue is full" in ossec.log)
→ bump <queue_size> in the <remote> block AND analysisd.event_threads in internal_options.conf. The default queue is too small for any real workload.

🔹 Cluster won't sync
→ all nodes need the same KEY, port 1516 open between them, identical Wazuh versions. cluster.log on the master tells you which one is broken.

The one habit that prevents most incidents:
👉 Before opening a ticket — grep -E 'ERROR|WARN' /var/ossec/logs/ossec.log
You'll find the answer 80% of the time.

#Wazuh #SIEM #Troubleshooting #SOC #DevSecOps #InfoSec #BlueTeam

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🚨 Threat Hunting is no longer optional — it’s a core capability for every modern SOC.
Recently reviewed the Threat Hunting Playbook by RANK Software, a practical guide focused on building a proactive security posture and identifying attacker activity before major damage happens.
📘 What makes this guide valuable is its strong focus on real Indicators of Compromise (IOCs), attacker behavior, and operational hunting scenarios instead of just theoretical concepts.
The playbook covers practical hunting indicators such as:

🔹 Unusual Outbound Network Traffic
🔹 DNS Request Anomalies
🔹 Suspicious Registry Changes
🔹 Privileged Account Abuse
🔹 Lateral Movement Detection
🔹 RDP & RPC Activity
🔹 Event Log Clearing
🔹 Defense Evasion Techniques
🔹 Suspicious cmd.exe & reg.exe Activity

💡 One of the strongest sections of the guide is the inclusion of MITRE ATT&CK-aligned hunting scenarios with practical SQL-based detections for SOC analysts and threat hunters.
It also reinforces an important mindset:
🛡 Security is no longer just perimeter defense. Modern defenders must actively hunt for abnormal behavior inside the environment before attackers achieve their objectives.
👏 Huge thanks to the creators of this playbook for sharing such practical and educational content with the cybersecurity community.
❤️ If you enjoy our cybersecurity content, support us by reposting and sharing our posts — it truly helps us continue publishing more technical SOC, SIEM, DFIR, and Threat Hunting content.

hashtagThreatHunting hashtagSOC hashtagCyberSecurity hashtagBlueTeam hashtagThreatDetection hashtagSIEM hashtagDFIR hashtagMITREATTACK hashtagIncidentResponse hashtagInfosec

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer

🛡 Wazuh Mastery Pack · 15 of 15 — Wazuh vs Other SIEMs

The honest take, after operating most of them in production:

✅ Where Wazuh wins:
• No license cap — ingest as much as you want
• Built-in EDR (FIM, SCA, Active Response, rootkit checks)
• Compliance mappings out of the box
• Lightweight agents, multi-OS, easy enrollment

⚠️ Where Wazuh struggles:
• No native UEBA / ML-driven anomaly detection
• OpenSearch-based, slower than Splunk's SPL
• Dashboards less polished than commercial tools
• Community-driven support (paid tier exists)

The decision tree I actually use:

🔹 Tight budget + need SIEM + EDR + compliance → Wazuh, every time
🔹 Big budget + need ML / UEBA / fast search → Splunk
🔹 Need flexibility above all, willing to DIY → ELK
🔹 Already have OSSEC → migrate to Wazuh today

Wazuh isn't the best at any single thing. It's the best free SIEM/XDR that ships with everything in one box. Pair it with good engineering, and you outperform stacks that cost 50× more.

That's a wrap on the 15-part series. Thanks for reading along — and to everyone who commented, shared, or DM'd me with feedback: it kept me writing.

The full PDF pack is pinned to my profile if you missed earlier sheets.

#Wazuh #SIEM #Splunk #ELK #CyberSecurity #BlueTeam #SOC #InfoSec #OpenToWork

🔹 Share & Support Us 🔹
📱 Channel : @Engineer_Computer