Logs

Introduction

What to learn here

• What is an EDR and why are they useful solutions
• Where an EDR like Wazuh is used
• Accessing Wazuh
• Navigating Wazuh
• Learning about Wazuh rules and alerts
• Digesting logs to view specific events on devices including Linux and Windows
• How you can extend Wazuh using plugins and its API

Endpoint detection and response (EDR) are a series of tools and applications that monitor devices for an activity that could indicate a threat or security breach. These tools and applications have features that include:

1. Auditing a device for common vulnerabilities
2. Proactively monitoring a device for suspicious activity such as unauthorised logins, brute-force attacks or privilege escalations
3. Visualising complex data and events into neat and trendy graphs
4. Recording a device’s normal operating behaviour to help with detecting anomalies

Wazuh Agents

Devices that record the events and processes of a system are called agents. Agents monitor the processes and events that take place on the device, such as authentication and user management. Agents will offload these logs to a designated collector for processing, such as Wazuh.

In order for Wazuh to be populated, agents need to be installed onto devices to log such events.