## Wazuh: The Modern Open SIEM

While ELK is a general-purpose data platform that *can* be used for security, **Wazuh** is a platform built *specifically* for security from day one. It often sits on top of the ELK stack (using Elasticsearch for storage) but replaces the heavy lifting of Logstash/Beats with its own specialized agents.

### Architecture

#### 1. The Wazuh Agent
Installed on endpoints (Windows, Linux, macOS). It is far more powerful than a simple log shipper.
*   **Log Collection**: Reads system logs and application logs.
*   **FIM (File Integrity Monitoring)**: It takes cryptographic hashes (MD5/SHA256) of critical files. If a hacker modifies `/etc/passwd` or `system32.dll`, Wazuh alerts immediately.
*   **Rootkit Detection**: Scans for hidden processes, hidden ports, and anomalous system calls.
*   **Vulnerability Detection**: Compares installed software versions against the CVE database. "Hey, you have Chrome version 80 installed; it has 5 critical vulnerabilities."
*   **Active Response**: Can execute scripts to block an attack. (e.g., "If source IP logs in 10 times fail -> Add IP to Firewall Drop rule").

#### 2. The Wazuh Server
*   Receives data from agents.
*   **Decoders**: Parses raw logs into fields.
*   **Rules Engine**: The core strength of Wazuh. It has thousands of pre-built rules mapped to PCI-DSS, HIPAA, GDPR, and MITRE ATT&CK.
    *   *Rule Level*: Alerts are graded 1-15.
    *   Level 3: "Login success" (Informational).
    *   Level 12: "Suspicious shell spawned" (Critical).

#### 3. The Wazuh Dashboard (Indexer)
*   Historically based on Kibana (OpenSearch Dashboards).
*   Provides a beautiful UI to visualize FIM changes, compliance scores, and threat alerts.

### Wazuh vs. Traditional SIEM
Wazuh is technically an **XDR (Extended Detection and Response)** solution because it does more than just logs—it monitors the *state* of the endpoint.

*   **Traditional SIEM**: "I saw a log that says a file changed."
*   **Wazuh**: "I saw the file change, here is the diff of the content, here is the user who did it, and by the way, that user is running a vulnerable version of Sudo."

### Use Case Example: Detecting a Web Shell
1.  **Attacker**: Uploads `shell.php` to your web server (Apache).
2.  **Wazuh FIM**: Detects a new file creation in `/var/www/html/`. Checks hash.
3.  **Wazuh Rule**: "New file created in web directory with PHP extension" -> **Alert Level 7**.
4.  **Attacker**: Accesses the shell. Apache logs 200 OK for `shell.php`.
5.  **Wazuh Log Analysis**: Sees web request to the newly created file.
6.  **Active Response**: Triggers a firewall-drop command for the attacker's IP.

### Why Analysts Love Wazuh
*   **Pre-tuned**: It comes out of the box with reasonable defaults. you don't have to write a rule to detect "SSH Brute Force"—it's already there.
*   **Compliance View**: It has a dedicated view for "PCI DSS". You can click it and see exactly which requirements you are failing based on the logs.
*   **Endpoint Visibility**: It gives you deep insight into the OS, not just the logs the OS decides to print.

### Lab Insight
In the upcoming labs, you will likely interface with a SIEM dashboard. Whether it is Splunk, ELK, or Wazuh, remember: **The logic is the same.** You are looking for anomalies, correlating events across time, and validating the generated alerts.