Wazuh Agent for Linux: Comprehensive Security Monitoring Guide#

1. Log Collection and Analysis#

The Wazuh agent excels at comprehensive log collection:

• Operating System Logs: Collects syslog, auth.log, kernel logs, and system events
• Application Logs: Monitors custom application logs with configurable patterns
• Real-time Forwarding: Near-instantaneous transmission to the central server
• Format Support: Handles various log formats including JSON, syslog, and custom formats
• Command Output: Can execute commands and collect their output as log data

Configuration example for custom log collection:

1
<localfile>
2
  <log_format>syslog</log_format>
3
  <location>/var/log/custom-app/*.log</location>
4
</localfile>

2. File Integrity Monitoring (FIM)#

FIM provides critical visibility into file system changes:

• Change Detection: Identifies file creation, modification, and deletion
• Attribute Tracking: Monitors permissions, ownership, size, and checksums
• User Attribution: Records which users and processes modified files
• Real-time Alerts: Immediate notification of critical file changes
• Baseline Comparison: Detects deviations from known-good states

Key directories typically monitored:

• /etc - System configuration files
• /bin, /sbin - System binaries
• /boot - Boot loader files
• Custom application directories

3. System Call Monitoring#

Leveraging the Linux Audit framework, Wazuh provides deep system-level visibility:

• Syscall Auditing: Monitors security-relevant system calls
• Process Tracking: Tracks process creation, file access, and network connections
• Privilege Escalation Detection: Identifies suspicious privilege changes
• Command Execution Monitoring: Records all executed commands
• User Activity Tracking: Comprehensive audit trail of user actions

Example audit rules:

1
# Monitor privilege escalation
2
-a always,exit -F arch=b64 -S setuid -F a0=0 -F exe=/usr/bin/sudo -k privilege_escalation
3

4
# Track file access in sensitive directories
5
-w /etc/passwd -p wa -k passwd_changes

4. Security Configuration Assessment (SCA)#

SCA performs automated security compliance checks:

• Policy Scanning: Evaluates system against security policies
• Misconfiguration Detection: Identifies security gaps and weaknesses
• Compliance Frameworks: Supports CIS, PCI-DSS, GDPR, and custom policies
• Remediation Guidance: Provides specific steps to fix issues
• Customizable Checks: Create organization-specific security policies

Common checks include:

• Password policy compliance
• SSH configuration hardening
• Firewall rules validation
• Service configuration security
• File permission audits

5. Vulnerability Detection#

Proactive vulnerability management capabilities:

• Software Inventory: Maintains current list of installed packages
• CVE Correlation: Matches installed software against vulnerability databases
• Severity Scoring: Prioritizes vulnerabilities by CVSS scores
• Patch Status: Tracks available security updates
• Zero-day Detection: Identifies indicators of unknown vulnerabilities

The agent collects package information from:

• APT/dpkg (Debian/Ubuntu)
• YUM/RPM (RHEL/CentOS)
• Snap packages
• Custom application manifests

6. Malware and Rootkit Detection#

Non-signature-based detection methods:

• Anomaly Detection: Identifies unusual system behavior
• Hidden Process Detection: Finds processes hidden from standard tools
• Network Backdoor Discovery: Detects hidden network listeners
• File System Anomalies: Identifies hidden files and directories
• Kernel Module Monitoring: Tracks loaded kernel modules

Detection techniques:

1
# Check for hidden processes
2
/var/ossec/bin/ossec-rootcheck
3

4
# Scan for rootkit signatures
5
/var/ossec/bin/rootkit_trojans.txt

7. Active Response Capabilities#

Automated threat containment and remediation:

• Network Blocking: Automatically block malicious IP addresses
• Process Termination: Kill suspicious processes
• File Quarantine: Move or delete malicious files
• User Account Actions: Disable compromised accounts
• Custom Scripts: Execute organization-specific response actions

Example active response configuration:

1
<active-response>
2
  <command>firewall-drop</command>
3
  <location>local</location>
4
  <level>10</level>
5
  <timeout>600</timeout>
6
</active-response>

8. Container and Cloud Security#

Modern infrastructure monitoring capabilities:

• Docker Integration: Monitors container events via Docker API
• Container Runtime Security: Tracks container creation, execution, and networking
• Image Scanning: Identifies vulnerabilities in container images
• Kubernetes Support: Monitors pod events and configurations
• Cloud Provider Integration: AWS, Azure, and GCP monitoring support

Installation Methods#

1. Package Managers: Native packages for major distributions
2. Configuration Management: Ansible, Puppet, Chef modules available
3. Container Deployment: Official Docker images for containerized environments
4. Cloud Templates: Pre-configured images for cloud deployment

Security Hardening#

1. Agent Configuration: Restrict configuration file permissions
2. Communication Security: Use certificate-based authentication
3. Resource Limits: Configure appropriate thresholds
4. Log Rotation: Implement proper log management
5. Access Control: Limit who can manage agent configuration

Performance Optimization#

1. Scan Frequencies: Balance security with performance
2. Exclusion Lists: Skip known-safe files and directories
3. Buffer Sizes: Tune for your environment’s log volume
4. Network Settings: Optimize compression and batch sizes

SIEM Integration#

The Wazuh agent data can be integrated with:

• Elasticsearch: Native integration for log storage
• Splunk: Forwarder configuration available
• IBM QRadar: DSM modules for event parsing
• Custom SIEM: Syslog and JSON output formats

Automation and Orchestration#

• SOAR Platforms: Integrate with Phantom, Demisto, etc.
• Ticketing Systems: Automatic incident creation
• Notification Services: Slack, email, SMS alerts
• API Integration: RESTful API for custom integrations

1. Insider Threat Detection#

• Monitor privileged user activities
• Track data exfiltration attempts
• Detect unauthorized access patterns

2. Advanced Persistent Threats (APT)#

• Identify lateral movement
• Detect persistence mechanisms
• Track command and control communications

3. Compliance Monitoring#

• Continuous compliance validation
• Audit trail maintenance
• Policy violation detection

4. Incident Response#

• Rapid threat containment
• Forensic data collection
• Timeline reconstruction