Hands-on Wazuh SIEM/XDR home lab covering OVA deployment, agent enrollment, file integrity monitoring, VirusTotal malware detection, and MITRE ATT&CK threat hunting.
This project demonstrates the deployment and testing of a Security Information and Event Management SIEM system using Wazuh. The setup uses a pre-built Wazuh OVA file running inside a virtual machine, making it a quick and easy way to learn about Wazuh's monitoring and detection capabilities.
⦁ Deployed Wazuh SIEM using an OVA file in a virtual environment.
⦁ Configured network settings for agent–manager communication.
⦁ Installed Wazuh agents on monitored endpoints.
⦁ Generated and detected simulated security events.
⦁ Analyzed and visualized security logs in the Wazuh Dashboard.
| Tool / Technology | Purpose |
|---|---|
| Wazuh OVA | Pre-configured SIEM with Wazuh Manager, and Dashboard |
| VMware Workstation | Virtualization platform for Wazuh VM |
| Windows 11 | Endpoint systems for Wazuh agents |
| Wazuh Agent | Installed on endpoints to send logs/events |
| Web Browser | For accessing the Wazuh Dashboard |
+--------------------+ +-------------------+ +-------------------+
| Endpoint (Agent) | ---> | | | |
| Windows / Linux | | | | |
+--------------------+ | | | |
| Wazuh Manager | <--> | (OVA VM) | | Dashboard |
+--------------------+ | | | |
| Endpoint (Agent) | ---> | | | |
+--------------------+ +-------------------+ +-------------------+
Downloading the .ova from official Wazuh Downloads section.
Importing the .ova into VMware.
Allocating at least 8GB RAM, 4 CPU cores, and 50GB storage and configured Bridged Networking or NAT with Port Forwarding.
Booting up the Virtual Machine.
• Login's with Default Credentials:
Username:
wazuh-user
Password:
wazuh
• Find the Virtual Machine IP using:
ip addr
⦁ Running a ping scan:
ping <agent-ip>
Ping return 0% Loss the Wazuh IP is reachable and responsive.
⦁ Opening a browser and navigating to:
https://<WAZUH_VM_IP>
Then the browser Google Chrome, Edge displayed the Your connection isn't private page.
Clicked on Advanced -> Continue to website(unsafe).
⦁ Login's with default credentials and changed the password:
Username:
admin
Password:
admin
• From the dashboard: Deployed new agent.
• Followed the installer instructions for Windows.
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.12.0-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='10.22.137.106' WAZUH_AGENT_NAME='Windows-Swastik'
.\wazuh-agent-4.12.0-1.msi /q WAZUH_MANAGER="10.22.137.106"
Pasting this in Windows Powershell.