Building a SIEM Lab with Wazuh: A Hands-On File Monitoring Guide

Introduction

In this lab setup, we will be installing and configuring Wazuh as our Security Information and Event Management (SIEM) solution. This hands-on guide walks through deploying a fully functional security monitoring environment from scratch.

Lab Overview

This lab consists of the following components:

Server:

• Wazuh Server/Manager deployed on Ubuntu 24.04

Agent:

• Windows Agent

By the end of this lab, you will have hands-on experience with the following:

• Wazuh Server Deployment — Installing and configuring the Wazuh manager on Ubuntu 24.04
• Agent Deployment — Connecting both Windows and Ubuntu machines as Wazuh agents
• File Integrity Monitoring (FIM) — Detecting and alerting on unauthorized file changes

Installing Wazuh

To get started, navigate to https://documentation.wazuh.com/current/quickstart.html

This page contains everything needed for a successful installation, including:

• Installation guides
• Hardware requirements
• Supported operating systems
• Deployment methods
• Initial configuration steps

The documentation is beginner-friendly and provides step-by-step instructions for setting up the Wazuh manager, dashboard, and agents.

Virtual Machine Requirements

If you are installing Wazuh on a virtual machine using VirtualBox, proper resource allocation is very important. Wazuh can be resource-intensive, especially when running the manager and dashboard together.

To ensure smooth performance, configure your VirtualBox settings with at least the following:

• 4 CPU cores
• 8GB RAM
• 50GB hard disk space

Allocating these resources helps prevent performance issues during installation, indexing, and log monitoring activities.

On your Ubuntu virtual machine, run the command curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -i to download and install Wazuh. This command will automatically download the official Wazuh installation script and install all the necessary components on your machine, including the Wazuh indexer, Wazuh manager and Wazuh dashboard.

Once the installation is complete, you will be provided with login credentials that will grant you access to the Wazuh dashboard. You can access the Wazuh web interface by navigating to it https://<Ubuntu IP>:443 in your browser.

The Wazuh server has been successfully installed and configured on our Ubuntu machine.

Deploying Windows agent.

While it is possible to deploy a Wazuh agent automatically by visiting the Wazuh website and downloading the agent GUI installer, we will be using the manual deployment method for this setup.

On the Wazuh dashboard, click on the Add an Agent button to begin the process of deploying your first agent.

A new page will appear prompting you to fill in the following details:

• Operating System — Select the operating system of the agent to be deployed
• Server IP Address — Enter the IP address of your Ubuntu machine
• Agent Name — Provide a name for the agent
• Group — Select the group the agent will belong to; for this setup we will use the default group

Once all the required details have been filled in, a command to install the Wazuh agent on the target system will be automatically generated.

On your Windows machine, open PowerShell as administrator and run the provided command to complete the agent installation.

Once the Wazuh agent installation is complete on the Windows machine and the Wazuh service has been started, the agent will automatically connect to the Wazuh manager and appear as an active agent on the dashboard, and you should begin receiving live security event feeds from the Windows machine in real time.

We can now view and monitor events and logs coming from the Windows agent in real time. Since Wazuh also functions as an Extended Detection and Response (XDR) solution, it offers a wide range of security capabilities beyond just log monitoring. These include vulnerability detection, system scanning, file integrity monitoring and much more, making it a comprehensive security monitoring and response platform.

To generate new logs and observe real-time responses on the Wazuh manager, we will install an application on the Windows machine. Open PowerShell on the Windows machine and run the command winget install mozilla to install Mozilla Firefox. This will trigger installation logs that will be captured and forwarded to the Wazuh manager in real time.

As soon as the Mozilla Firefox installation begins and completes on the Windows machine, the entire installation process will be captured and logged as a security event on the Wazuh manager dashboard, demonstrating the real-time monitoring capabilities of Wazuh.

The Wazuh vulnerability scanner has completed its scan and confirmed that the Windows agent is currently free from any known threats or vulnerabilities.

File Integrity Monitoring

File Integrity Monitoring (FIM) is a security feature that allows us to monitor and detect any unauthorised or suspicious changes made to specific files, folders or directories on a monitored system, alerting us in real time whenever a modification, addition or deletion is detected.

By default, no files or directories are assigned for integrity monitoring on the Windows agent, which is why there is currently no real-time FIM data being displayed. To assign a file or directory for monitoring, navigate to the Program Files/ossec-agent directory on the Windows machine. Inside this directory, you will find the ossec.conf configuration file. Open this file as an administrator and add the desired directory path to enable file integrity monitoring on that location.

On the Windows machine, create a new folder of your choice. in the case of the setup, I created a new directory named FIM TEST FOLDER

Copy the path of the directory you want to monitor and open the ossec.conf file. Under the File Integrity Monitoring section, add the following line <directories realtime="yes">(path to the new directory)</directories>. For this setup we will be using <directories realtime="yes">C:\Users\Seyi\Desktop\FIM TEST FOLDER</directories>. Save the changes once done.

After saving the changes, restart the Wazuh service by running the command NET START WazuhSvc in PowerShell. Once the service has restarted, the newly added directory will be successfully registered for file integrity monitoring on the Wazuh manager dashboard, and any changes made to that directory will be monitored and logged in real time.

Any activity or changes that occur within this directory, such as file creation, modification or deletion, will now be captured and logged as a security event on the Wazuh manager dashboard in real time.

i'll create a new text document, log file.txt

You can click on the event to view full log details.