Use cases

Monitoring Sysmon events on a Windows endpoint

To monitor specific Windows event channels using the Wazuh agent, include the channel name in the location field and set the log format as eventchannel within the localfile block in the C:\Program Files (x86)\ossec-agent\ossec.conf file.

For example, perform the following steps to monitor Sysmon events using the Microsoft-Windows-Sysmon/Operational channel:

1. Download the latest version of Sysmon from the Microsoft Sysinternals page.

2. Extract the compressed Sysmon file to your preferred location.

   > Expand-Archive "<PATH>\Sysmon.zip"
   

   Replace <PATH> with the directory where the Sysmon.zip file was downloaded.

3. Download the Sysmon configuration file using PowerShell as an administrator. Replace <SYSMON_EXECUTABLE_PATH> with the path to your Sysmon executable:

   > wget -Uri https://wazuh.com/resources/blog/emulation-of-attack-techniques-and-detection-with-wazuh/sysmonconfig.xml -OutFile <SYSMON_EXECUTABLE_PATH>\sysmonconfig.xml
   

4. Switch to the folder containing the Sysmon executable. Run the command below to install and start Sysmon:

   > .\Sysmon64.exe -accepteula -i sysmonconfig.xml
   

   If you are on ARM64, use:

   > .\Sysmon64a.exe -accepteula -i sysmonconfig.xml
   

5. Add the following configuration between the <ossec_config> tags of the Wazuh agent C:\Program Files (x86)\ossec-agent\ossec.conf file:

   <localfile>
     <location>Microsoft-Windows-Sysmon/Operational</location>
     <log_format>eventchannel</log_format>
   </localfile>
   

6. Restart the Wazuh agent via PowerShell with administrator privileges to apply the configuration change:

   > Restart-Service -Name wazuh
   

Configuring rsyslog on a Linux endpoint

Follow the steps below to configure a monitored Linux endpoint as an rsyslog relay and forward the received messages to the Wazuh manager:

1. Install rsyslog:

   $ sudo apt update
   $ sudo apt install rsyslog -y
   

2. Enable and start the rsyslog service:

   $ sudo systemctl enable rsyslog
   $ sudo systemctl start rsyslog
   

3. Create a dedicated configuration file /etc/rsyslog.d/10-remote.conf with the following content.

   module(load="imudp")
   input(type="imudp" port="514" ruleset="remote")
   template(name="TraditionalSyslogFormat" type="string"
            string="%timegenerated% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n")
   ruleset(name="remote") {
       action(type="omfile" file="/var/log/remote.log" template="TraditionalSyslogFormat")
       stop
   }
   

4. Create the destination log:

   $ sudo touch /var/log/remote.log
   $ sudo chown syslog:adm /var/log/remote.log
   $ sudo chmod 640 /var/log/remote.log
   

5. Validate the configuration

   $ sudo rsyslogd -N1
   

6. Restart rsyslog:

   $ sudo systemctl restart rsyslog
   

7. Verify rsyslog is listening on port 514:

   $ sudo ss -lun | grep 514
   

   The command output looks similar to this:

   UNCONN 0      0            0.0.0.0:514        0.0.0.0:*
   UNCONN 0      0               [::]:514           [::]:*
   

   Allow inbound UDP traffic on port 514 from your network devices at every point in the path: the host firewall (if enabled, for example ufw), and any cloud security group, network ACL, or upstream firewall in front of the relay. Confirm the relay is receiving before moving on:

   $ sudo ufw allow from <NETWORK_CIDR> to any port 514 proto udp
   

   Ensure you replace <NETWORK_CIDR> with your specified network CIDR.

8. Configure the Wazuh agent to monitor that rsyslog output file using the Logcollector module:

   <localfile>
     <location>/var/log/remote.log</location>
     <log_format>syslog</log_format>
   </localfile>
   

9. Restart the Wazuh agent.

   $ sudo systemctl restart wazuh-agent
   

Configuring a custom socket output on a macOS endpoint

Perform the following steps on the monitored macOS endpoint to create a new output socket, forward logs to it, and confirm delivery end-to-end.

1. Create the receiving socket with netcat before adding it to the Wazuh configuration:

   $ sudo nohup nc -lkU /var/run/custom.sock > /tmp/custom_socket_capture.log 2>&1 &
   

2. Create the log file that will be forwarded to the socket:

   $ sudo touch /var/log/socket-test.log
   $ sudo chmod 644 /var/log/socket-test.log
   

3. Add the following configuration between the <ossec_config> tags of the Wazuh agent /Library/Ossec/etc/ossec.conf file to add a new socket named custom_socket:

   <socket>
     <name>custom_socket</name>
     <location>/var/run/custom.sock</location>
     <mode>tcp</mode>
     <prefix>custom_syslog: </prefix>
   </socket>
   

4. Add the following to the agent configuration file to forward logs from socket-test.log to custom_socket:

   <localfile>
     <log_format>syslog</log_format>
     <location>/var/log/socket-test.log</location>
     <target>agent,custom_socket</target>
   </localfile>
   

5. Restart the Wazuh agent with administrator privileges to apply the configuration change:

   $ sudo /Library/Ossec/bin/wazuh-control restart