getting to know a Wazuh siem.

Juan Orjuela — Wed, 28 Oct 2026 04:39:50 +0000

1.1 "Teaser" overview

After making the experiments to be able to identify the different TTPs on a Wazuh SIEM, I discovered that everything is persistence in finding the problem because after checking every single step, you will be able to find the problem and make a secure network with one of the most important skills, which will be monitoring a network and adapting the SIEM to any hacking technique to always have a complete view of your network. The second thought will be to, after making a modification and installing anything on your system, restart it because it won't work until it's restarted and check the connection with the SIEM and the agent's endpoint. The third thought will be to follow the steps in the direction in which you won't get lost. For example, deploy the agent to the endpoint, and next install the Siem agent. Of course, after that you have to include the Sysmon or syslog for the different software to make the different logs and remember to forward them to the SIEM, and to the end, check that the SIEM recognizes the logs and uses them to make that monitoring view, which will protect your network and systems. The fourth thought will be that learning this technique will be useful for any person who is interested in cybersecurity; knowing how to use a SIEM is always important because you always have to be looking at your network for any weird situation or command displayed that might hurt any system or the overall good of any company. The fifth thought will be that it might be hard to understand sometimes, but if you focus enough on it, you will make it, and you will have a way to protect the people, networks, and systems, which will be a really grateful experience if you can stop a bad guy from making any hurtful situation.

1.2 Introducing yourself to the cyber community

First, my name is Juan. To any person who is reading this post, thank you for stopping here and viewing it. I am learning about cybersecurity, and I am really interested in it because since I was a little child, I liked the systems and the technology that make a life easier for humans and be able to protect it from any person with bad intentions. It's a wonderful experience because even though somebody does not thank you directly, you know that you are doing well in the world.

2. Setup

I tried to make a modification to the SIEM, including a new endpoint to monitor it from the different attacks, but I ended up doing three modifications to the SIEM because of the TTP I chose, and then I began to research the right way to do them.

First modification: I follow the steps of the SIEM tool and download the SIEM agent on the endpoint to the command given in the Wazuh SIEM. Of course, after everything is downloaded, restart the agent and Wazuh for it to work. After that, I had to download Sysmon into the system of a Linux endpoint to be able to check the different logs and forward them into the SIEM. Remember to restart the system for it to implement the different downloads to the system. After everything, remember that the system has to recognize the logs, so the configuration file had to be modified to use these logs and make the detection plan.
coomand used to add the deploy the agent:

able to get the Sysmon in the Linux machine:

modification of log fowarding

For my second modification, I had to implement a modification to modify the set of rules of the Wazuh SIEM to make an alarm for experiment number 1 T1518.001 #4, in which the rule change was (command used to change the rule), but after I did the change of rule, it did not work, so I had to make a little change to the match section, which was (egrep|grep -E).*falcond|nessusd|cbagentd, and finally it recognized the TTP and made the alarm in the Wazuh browser.

modification that allowed me to view the new rule in the Siem browser

My third modification was like my second one. I had to modify my set of rules to identify the TTP T1098.004, and the rule change was this one

Into the file ''local_rules.xml'' with the command nano /var/ossec/etc/rules/local_rules.xml after any rule set, always test it to see that it works properly, and remember to restart the Wazuh manager to implement the new rules.

Experiment #1

for my experiment number 1 i ran in my ART the TTP T1518.001 - Software Discovery #4, but first as my ART virtual machine was a windows and my endpoint was a linux server i had to create a SSH connection to download Windows 7 into my linux server and be able to connect and run the TTP and the prerequisites and as i mention before i had to make a new rule set to be able to identify the TTP into my SIEM after everything was implemented i was successfully able to identify the event ID number 1 and see the command that shows the T1518.001 - Software Discovery**

modification of the rule made

detection

Experiment #2

for experiment number 2 it was a little easier becasue i ran the TTP TTP T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder #4 in another windows endpoint which i already did the deploying and sysmon deployment and configurations, then i ran the command $sess = New-PSSession -ComputerName 10.170.0.10 -Credential administrator to start a PSSesion and next run the command Invoke-AtomicTest T1547.001 -testnumber 4 -Session $sess -GetPrereqs and after getting the prerequisites i began to run the experiment with the command Invoke-AtomicTest T1547.001 -testnumber 4 -Session $sess -cleanup and after running it in the ART VM i was able to discover the logs of this attack into my SIEM with the different event ID 1 and 13

Experiment #3

for experiment number 3 I had the same problem as experiment number one I had to deployed in a Linux server from my VM which was a windows software in which I did the whole process again of making the SSH connection and for this one I used the downloaded Windows 7 PowerShell to make the PSSession $sess as well for this experiment I had trouble because the Siem did not identified the TTP T1098.004 - Account Manipulation: SSH Authorized Keys then I had to add another rule set into the Siem which thankfully it identified it after I implemented it after that remember to always test the new rule to see that it works and match the TTP and restart the wazuh manager again, after this procedure I checked my SIEM browser and I was able to identify the TTP with the event ID number one showing the command used for this TTP.

4.1 Summary of experimental findings:

Throughout these experiments, I gained valuable hands-on experience using Wazuh SIEM, Sysmon, and Atomic Red Team to identify and monitor different MITRE ATT&CK techniques, including T1518.001, T1547.001, and T1098.004. Although I encountered several challenges during the setup and execution phases, these experiences taught me that persistence, patience, and systematic troubleshooting are essential skills in cybersecurity. By examining logs, verifying agent connections, and creating custom detection rules, I was able to identify suspicious activities and improve my understanding of security monitoring. One of the most important lessons I learned was to follow the installation and configuration steps in the correct order. Before running experiments, it is essential to verify that the Wazuh agents are connected, Sysmon is properly configured, and logs are successfully forwarded to the SIEM. Additionally, whenever configuration files or detection rules are modified, they should be validated and the appropriate services restarted to ensure the changes take effect. Testing custom rules before executing an experiment can also prevent unnecessary troubleshooting and save valuable time. Overall, these experiments strengthened my technical knowledge and problem-solving abilities while demonstrating the importance of continuous network monitoring. Most importantly, I learned that cybersecurity requires dedication, adaptability, and attention to detail. These skills will help me become a more effective cybersecurity professional, capable of detecting potential threats and protecting organizations, systems, and users from malicious activities.

4.2 Advice on avoiding mistakes

Based on my experience with these experiments, I recommend following a structured approach when configuring a SIEM and executing Atomic Red Team tests. First, always verify that the Wazuh agent is properly installed, connected to the manager, and receiving logs from the endpoint. Ensure that Sysmon or Syslog is correctly configured to collect and forward security events before running any experiments. Second, carefully review configuration files and detection rules before implementing changes. One of my biggest challenges was creating custom rules that did not initially match the commands executed during the experiments. To avoid this, examine the actual logs, identify the correct command patterns, and use wazuh-logtest to validate the rules before restarting the Wazuh manager. And third, finally, document every step, command, error, and solution throughout the process. Following the correct order, testing each component individually, and troubleshooting patiently can save time, prevent repeated mistakes, and improve the overall effectiveness of security monitoring.

5.1 The coolest thing I learned

Throughout this project, one of the coolest things I learned was how a Security Information and Event Management (SIEM) system can detect suspicious activities by collecting and analyzing logs from different endpoints. Before starting these experiments, I did not fully understand how much configuration and troubleshooting were involved in making a SIEM work properly. Being able to execute different MITRE ATT&CK techniques using Atomic Red Team and eventually identify them through Wazuh was one of the most rewarding parts of this experience. One of my biggest achievements was learning how to create custom detection rules for techniques such as T1518.001 (Security Software Discovery) and T1098.004 (SSH Authorized Keys). At first, I struggled because the events were being collected but were not generating security alerts. After investigating the logs, correcting the matching expressions, and testing the rules, I finally understood the difference between collecting security information and successfully detecting suspicious behavior.

5.2 One piece of advice

My biggest advice to new cybersecurity analysts is to be patient, follow the correct steps, and never underestimate the importance of troubleshooting.** Before executing any experiments, verify that your agents are connected, Sysmon is collecting events, and your SIEM is receiving the logs. Always validate custom rules using tools such as wazuh-logtest, and restart the appropriate services after configuration changes. Most importantly, document every error and solution because those challenges can become valuable learning experiences.

5.3 My favorite resource

One particularly useful external resource for this type of project is the Atomic Red Team GitHub repository, maintained by Red Canary and the security community. Its documentation provides practical examples of adversary techniques, prerequisites, execution commands, and cleanup procedures. This resource is valuable because it allows analysts to simulate real attack techniques in controlled environments and evaluate whether their security tools can detect them. It helped provide the foundation for the experiments performed during this project.

5.4 Thank you (gratitudes)!

I would also like to recognize and thank two cybersecurity researchers whose contributions have helped make projects like mine possible. First, Casey Smith, a co-creator of Atomic Red Team, whose work has helped security professionals evaluate and improve their detection capabilities. Second, Daniel B. Cid, the creator of OSSEC, whose contributions to intrusion detection and log analysis helped establish important foundations for modern security monitoring tools. As well as my instructors # Jean Fobe and # Rick Rhaburn, who helped me a lot in discovering the different resources to be able to complete these experiments and post them without their lessons of learning and troubleshooting, I would have been harder for me.

References

1.

Wazuh Documentation — Custom Rules

Author: Wazuh, Inc.

Publication date: n.d. (Living documentation)

Title: Custom Rules

Link: https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html

This resource explains how to create and modify detection rules in Wazuh SIEM. It was especially useful for understanding how to configure the local_rules.xml file and create custom rules for detecting T1518.001 and T1098.004.

2.

Wazuh Documentation — Custom Rules

Author: Wazuh, Inc.

Publication date: n.d. (Living documentation)

Title: Custom Rules

Link: https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html

3.

Red Canary — Atomic Red Team

Author: Red Canary and Atomic Red Team contributors

Publication date: n.d. (Continuously maintained repository)

Title: Atomic Red Team

Link: https://github.com/redcanaryco/atomic-red-team

This open-source project provides practical security tests based on the MITRE ATT&CK framework. It was essential for performing the simulated adversary techniques and evaluating whether my Wazuh SIEM could successfully detect their activity.

4.

MITRE ATT&CK — Security Software Discovery

Author: MITRE ATT&CK

Publication date: February 21, 2020 (last modified May 12, 2026)

Title: T1518.001 — Software Discovery: Security Software Discovery

Link: https://attack.mitre.org/techniques/T1518/001/

This resource explains how attackers identify security tools and monitoring software on compromised systems. It provided the theoretical background for my first experiment and helped me understand why recognizing security-software discovery is important for threat detection.

5.

Microsoft Learn — PowerShell Remoting over SSH

Author: Microsoft

Publication date: n.d. (Continuously maintained documentation)

Title: PowerShell Remoting over SSH

Link: https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/ssh-remoting-in-powershell

This documentation explains how to establish remote PowerShell sessions between Windows and Linux machines using SSH. It was useful when configuring remote sessions with New-PSSession and executing Atomic Red Team tests against my Linux endpoint.

DEV Community: Juan Orjuela

getting to know a Wazuh siem.

1.2 Introducing yourself to the cyber community

2. Setup

Experiment #1

Experiment #2

Experiment #3

4.1 Summary of experimental findings:

4.2 Advice on avoiding mistakes

5.1 The coolest thing I learned

5.2 One piece of advice

5.3 My favorite resource

5.4 Thank you (gratitudes)!

References

1.

Wazuh Documentation — Custom Rules

2.

Wazuh Documentation — Custom Rules

3.

Red Canary — Atomic Red Team

4.

MITRE ATT&CK — Security Software Discovery

5.

Microsoft Learn — PowerShell Remoting over SSH