Wazuh Install - Worlds Best OpenSource EDR!
ฝัง
- เผยแพร่เมื่อ 13 ต.ค. 2022
- Join me as we continue on to Phase 3 of the World's Best SIEM Stack Series, installing the Wazuh Manager.
Blog Post: / part-3-wazuh-manager-i...
Contact Me: taylor.walton@socfortress.co
LinkedIn: / socfortressmdr
Twitter: / socfortress
Our Blog: / socfortress
Graylog Install: • Graylog Install - Best...
Buy Me A Coffee: bit.ly/3woh21M
Our Blog: / socfortress
Security Operations Center as a Service: www.socfortress.co/
Free For Life Tier: www.socfortress.co/trial.html
Professional Services: www.socfortress.co/ps.html
Discord Channel: / discord
Series Playlist: • World's Best SIEM Stack - วิทยาศาสตร์และเทคโนโลยี
Thanks for great mood
That was just great 👍
you are very genius and cool buddy
Fan of your work from india😃
Super informative and practical series. But can you please uncover one topic about efficient way of transferring sysmon for linux events from endpoints to backend systems. Because they are stored in XML format and it's not so obvious which forwarders and options should be used.
Checkout the decoder video:) Decoding Linux For Sysmon - Learn How To Ingest Sysmon For Linux Alerts into Wazuh
th-cam.com/video/y5K1pctFoaw/w-d-xo.html
One question. Finally, is this entire series about EDR or SIEM?
you're the boss!! 👏☝️😉 regards from Argentina 👋😁
Hi, thanks a lot for your great content. It´s possible to help me with follow issue: [Alerts index pattern] No template found for the selected index-pattern title [wazuh-alerts-*]
Great content. Helped me alot. which tool you are using for ssh? it looks cool.
Good audio.
I wish wazuh had iso 27001 compliance dashboard.
That'd be amazing, maybe a custom dashboard? That's a great idea
it has i think nist ,you can compare nist and is027001 fro their site and use it.
While retrieving data for this widget, the following error(s) occurred:
Elasticsearch exception [type=illegal_argument_exception, reason=key [types] is not supported in the metadata section]. Why I'm having this error ?
i am deploy wazuh manager graylog successfully i can see data in grafana but i cant see wazuh dashboard security event and and other alert from from wazuh .is there any way to see both dashboard wazuh and grafana?
Did you find any way to resolve this issue?
How to compile it?
Hi Bro,
I followed all your steps . regarding wazuh * and graylog. now i am unable to assign a group to wazuh agent . Please guid me
error is - Assign the agent to a group
This section could not be configured because you do not have permission to read groups.
@taylorwalton_socfortress
খুব ভালো জ্ঞনলস
In case if someone has the issue with error "Elasticsearch exception [type=illegal_argument_exception, reason=key [types] is not supported in the metadata section]." when try to see received messages (16:27), you needed to remove this from the Opensearch config file: compatibility.override_main_response_version: true (or just comment) and restart wazuh-dashboard and graylog-server
It gives me the same error
Same error for me
I also encountered the same problem, deleted the required line from opensearch.yml, did systemctl restart graylog-server, but still Elasticsearch exception [type=illegal_argument_exception, reason=key [types] is not supported in the metadata section].
The problem can be solved by installing Graylog 5.0 with MongoDB 6.0
hi Please comment out the line under /etc/wazuh-indexer/opensearch.yml
#compatibility.override_main_response_version: true
This worked for me.
i got same error even after installing Gralog 5.0 and mongoDb 6.0
Could I do this install on Ubuntu Server or Ubuntu Desktop? I would like to do this using a VM does that require Docker?
I don't understand why Graylog is in the picture. You're already using Fluent Bit, which can already do all the filtering and renaming and much more. It can even integrate with GeoLite2 IP geolocation. I decided not to install Graylog.
fluent-bit is impossible to install on Kali linux
к
You pronounce it wrong.
Huh
Duh
Wazuh