A firewall stops unwanted traffic from getting in. It tells you nothing about what happens after something gets past it — a compromised WordPress plugin, a leaked SSH key, a cron job that shouldn't be there. That's the gap a SIEM fills.
Wazuh is the most widely deployed open-source option for self-hosted server monitoring and intrusion detection. Hosting it on a Bare Metal Server gives the OpenSearch indexer the RAM it needs to process logs rapidly.
Step 1: Install the Central Components
Wazuh provides an all-in-one installation script that deploys the manager, indexer, and dashboard together:
bash
curl -sO [https://packages.wazuh.com/4.x/wazuh-install.sh](https://packages.wazuh.com/4.x/wazuh-install.sh)
sudo bash ./wazuh-install.sh -a
Save the auto-generated admin credentials!
Step 2 & 3: Firewall Configuration
Open the required ports: 443 (Dashboard), 55000 (API), and 1514/1515 (Agent communication).
Step 4: Install and Enroll an Agent
On each server you want monitored:
curl -sO [https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.x_amd64.deb](https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.x_amd64.deb)
sudo WAZUH_MANAGER='your-manager-ip' dpkg -i ./wazuh-agent_4.x_amd64.deb
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent
Step 5: Enable File Integrity Monitoring (FIM)
Edit /var/ossec/etc/ossec.conf on the agent to watch specific directories for webshells or unwanted changes:
XML
<syscheck>
<directories check_all="yes" report_changes="yes">/etc,/bin,/sbin</directories>
<directories check_all="yes">/var/www/html</directories>
</syscheck>
Restart the agent: sudo systemctl restart wazuh-agent.
To see how to deliberately trigger SSH brute-force alerts to test the system and how to reduce dashboard noise, read the full tutorial here: https://www.eservers.uk/tutorials/howto/setup-wazuh-siem-ubuntu-debian/
Top comments (0)