Wazuh Security Configuration Assessment
Hardening checks with Wazuh SCA: the CIS-based default policies, writing custom YAML policies for internal baselines, scan scheduling and using results as configuration evidence.
Wazuh features
Wazuh capabilities beyond the core SIEM pages, each with its own configuration and tuning work.
Wazuh malware detection with YARA and rootcheck
Detecting malware with Wazuh: rootcheck, YARA scanning triggered by file changes, hash lists, VirusTotal lookups and collecting ClamAV and Windows Defender logs.
Wazuh container security for Docker and Kubernetes
Monitoring containers with Wazuh: the Docker listener, Kubernetes audit log collection, vulnerability scanning of hosts and what still needs a dedicated runtime security tool.
Wazuh system call monitoring with Linux Audit
Using Wazuh with the Linux Audit system to watch command execution, privilege escalation and sensitive file access, and keeping audit rule volume under control.
Wazuh agentless monitoring for network devices
Monitoring routers, firewalls, switches and locked-down servers without an agent: SSH-based integrity and command checks, credentials handling and limits compared with agents.
Wazuh log data collection from Windows, Linux and network devices
Getting the right logs into Wazuh: Windows event channels, journald, macOS unified logs, syslog from network devices, decoders for custom applications and when to archive all events.
Wazuh IT hygiene and system inventory
Using the Wazuh system inventory for IT hygiene: installed software, services, users, groups and browser extensions on endpoints, and feeding that inventory into vulnerability detection.
