User manual

Welcome to the Wazuh user manual. Use it as your Wazuh reference library once you have a basic Wazuh installation in place. In the same way that the main components of Wazuh are a fork of the renowned OSSEC HIDS project, so this user manual has been derived from the OSSEC documentation. Kudos to the OSSEC team for their huge contribution to the IT security community.

Contents

• Overview
  • Wazuh server
  • Elastic Stack
  • Agents
• Manager
  • Output options
• Agents
  • Registering agents
  • Listing agents
  • Removing agents
• Capabilities
  • Log data collection
  • File integrity monitoring
  • Anomaly and malware detection
  • Monitoring security policies
  • Monitoring system calls
  • Command monitoring
  • Active response
  • Agentless monitoring
• Ruleset
  • Getting started
  • Update ruleset
  • Custom rules and decoders
  • Dynamic fields
  • Ruleset XML syntax
  • Testing decoders and rules
  • Using CDB lists
  • Contribute to the ruleset
• RESTful API
  • Getting started
  • Configuration
  • Reference
  • Examples
• Reference
  • Local configuration
  • Centralized configuration
  • Internal configuration
  • Daemons
  • Tools