Introduction to Wazuh

Introduction to Wazuh

• Before discussing Wazuh in greater depth, let’s first look at a concept that will help us better understand the power of Wazuh.

Security Information and Event Management

• Today’s organizations are faced with managing multiple endpoints to keep their business afloat. Even the smallest organization has at least a dozen endpoints to manage.
• These endpoints generate and collect data and logs on a continuous basis, which can cause some concern when it comes to analyzing and exploiting them.
• Security Information and Event Management (in Jay-Z’s language), or `SIEM’, is one solution organizations are opting for to solve this problem.
• This solution is an intelligent combination of two other concepts:
  1. SEM Security Event Management, which collects logs from the various endpoints.
  2. SIM Security Information Management analyzes what SEM has collected to find any suspicious activity.
• We can conclude that SIEM collects, analyzes and exploits logs to find suspicious activity. All in real time and in a very sophisticated way. And Wazuh is partly based on this approach.

Wazuh

• Wazuh is an open-source platform for intrusion detection, security monitoring, vulnerability management, security incidents and compliance.
• It can be used to monitor almost anything: servers, containers, vm, cloud services and more.
• And this is possible because Wazuh works through an agent that can be installed on any endpoint, which will collect data and logs and send them to the server, to be analyzed.
• Once analyzed, the results are displayed in the form of dashboards.

To see the architecture of the agent and server in more detail, here’s a little diagram. And take a look at Wazuh’s documentation for more details.