What is Wazuh?

Wazuh is an open-source security monitoring platform designed for threat detection, intrusion detection, vulnerability detection, and security information and event management (SIEM).

Why You Need a SIEM in Your Homelab or Company

A SIEM (Security Information and Event Management) system is essential for centralizing security monitoring, achieving rapid threat detection, and automating incident responses. SIEMs excel in log management for compliance and forensic analysis. They can be customized to meet your specific needs, bolstering your security posture and keeping you ahead of evolving threats. Investing in a SIEM is a proactive step towards a more resilient cybersecurity strategy.

Requirements

  • Operating System: Ubuntu Server (Tested on 22.04 LTS)
  • CPU: Dual-core or better
  • Disk Space: Minimum of 10 GB of free space (For larger environments, refer to the documentation)
  • Network: A network connection to receive logs from monitored systems

Installation

The installation process is straightforward. Ensure you have root access on your Ubuntu server, and run the following commands:

curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh
sudo bash wazuh-install.sh -a

The script will automate the installation process. Upon completion, you’ll receive a password, and the username will be ‘admin.’ Remember to access the web interface via https://, not http://.