#wazuh

So I hate Wazuh alerts. I have been using Wazuh for over a year now and I despise loath and detest the Wazuh alert engine. I hate how it does Slack alerting. I hate it.

The other day I replaced it all with a Python script and some JSON query files–it is a revelation. I now have a script running as a cron job that handles my alerting. I get robust controlled alerts without the noise, stupid formatting and inscrutable Wazuh interface.

If you find the Wazuh alerts to be dog water, then you too should try the Python API method. I have massively scaled up my game with Wazuh using this, and I have massively improved the reliability and cleanliness of my alerts.

This infographic provides a detailed comparison between Wazuh and Converged SIEM, highlighting their differences in cost, scale, and technical capabilities. While Wazuh is ideal for budget conscious teams needing deep endpoint visibility, Converged SIEM serves large enterprises with automated orchestration and unified cloud native integration. It outlines key selection criteria, helping organizations choose based on their specific management needs and compliance requirements. This guide serves as a practical roadmap for security teams deciding between open source flexibility and enterprise grade automation.

Visit Our Source Page:

Week 3-4 Centralized Logging and SIEM Installation & First Alerts

My next focus was to centralize all logs on my Ubuntu Server and begin building out my security monitoring environment using Wazuh as my SIEM. I also planned to create a few test users and deploy a Kali Linux machine to simulate potential attack activity.

I built a new VM and installed Ubuntu Desktop, enabling SSH logging and configuring the firewall. On the Ubuntu Server, I created a separate non-root user account following the principle of least privilege. I then allowed SSH access through the firewall on port 22, but only from the specific IP address of the Ubuntu Desktop user.

 To start, I created a new standard user that would serve as my baseline active user. This user was assigned to an Ubuntu Desktop virtual machine and would represent a normal, non-administrative user interacting with the environment.

Next, I set up a Kali Linux VM and updated all installed packages. From Kali, I attempted to SSH into the Ubuntu Server. The connection was denied due to the firewall rules restricting access to only the trusted desktop user’s IP. I checked the Ubuntu Server logs and confirmed that the attempted connection was detected and logged, including the source IP, which matched the Kali machine.

The goal was to monitor their activity, capture both successful and failed login attempts, and observe how the system logged and responded to these events.

I then set up the firewall to allow from the ubuntu user IP address and port 514 and set up a configuration file to transfer all the logs from my Ubuntu user to the Ubuntu server.

Then I did the same thing to my Kali Machine, except for the allowing SSH from it. I did this to also monitor activity on it as well.

I then checked that all the logs were being sent into the Ubuntu server and I could see that both the Kali and the Ubuntu users logs were being sent.

Once everything was configured, I logged into the server from the desktop user and reviewed the logs to confirm successful authentication. After that, I intentionally entered an incorrect password multiple times to generate failed login events. As expected, Fail2Ban triggered after five failed attempts and temporarily blocked further SSH attempts from that IP. I reviewed the logs to verify that both the failed logins and the Fail2Ban action were properly recorded and centralized.

This setup allowed me to validate that my firewall, authentication logging, and centralized log monitoring were working as intended before moving forward with Wazuh integration. I then Installed the Wazuh Manager on my Ubuntu Server, and then put a Wazuh Agent on my Ubuntu User and on my Kali and soon they were reporting on events that were happening in My Lab.

Read the full report to get the instructions and download links -

Read the full report on -

Read the full report on -