Exploring Wazuh: An Open-Source SIEM Overview with Query Examples

 

    Wazuh is an open-source Security Information and Event Management (SIEM) platform that provides log management, intrusion detection, and security monitoring capabilities. It helps organizations detect and respond to security threats in real-time by collecting, analyzing, and correlating logs and security events from various sources across the network.

Some of the key features of Wazuh SIEM include:

1. Log Collection: Wazuh can collect logs from various sources, such as servers, endpoints, firewalls, IDS/IPS, and other security devices, and normalize them into a common format for easier analysis.

2. Log Analysis: Wazuh provides powerful search and query capabilities to analyze logs for security events and anomalies. It supports complex queries using Elasticsearch Query DSL, allowing users to filter, aggregate, and correlate logs to identify potential security threats.

3. Intrusion Detection: Wazuh includes built-in rulesets for detecting common network and host-based attacks, such as brute-force attacks, malware infections, and suspicious network traffic. It can also integrate with popular intrusion detection systems (IDS) like Suricata and Snort.

4. Real-time Alerts: Wazuh can generate real-time alerts based on predefined rulesets or custom rules, allowing security teams to receive notifications and take immediate action upon detection of security events.

5. Threat Hunting: Wazuh supports proactive threat hunting by allowing security analysts to search and analyze logs for potential security threats, even if they don't have predefined rules in place. This helps in detecting advanced and targeted attacks that may bypass traditional security measures.

6. Compliance Monitoring: Wazuh includes predefined compliance rulesets for popular regulatory standards such as PCI DSS, GDPR, HIPAA, and CIS Controls. It can generate reports and alerts on compliance violations, helping organizations meet their regulatory requirements.

7. Visualization and Reporting: Wazuh provides customizable dashboards, visualizations, and reports to help security teams gain insights into security events and trends. It also supports integration with popular visualization tools like Kibana and Grafana for advanced data visualization.

8. Scalability and Extensibility: Wazuh is built on top of the ELK (Elasticsearch, Logstash, Kibana) stack and can scale horizontally to handle large volumes of logs. It also supports plugins and integrations with other security tools, making it extensible and adaptable to different environments.

9. Open Source: Wazuh is an open-source solution, which means it is free to use, modify, and customize to suit the specific needs of an organization. It also has an active community of users and developers, providing continuous updates, improvements, and support.

Here are some basic queries that you can use with Wazuh SIEM to search and analyze logs:

1. Search for logs containing a specific keyword:

sql
SELECT * FROM logs WHERE message LIKE '%keyword%'

This query will search for logs where the message field contains the specified keyword. You can replace 'keyword' with the actual keyword you want to search for.

2. Filter logs based on a specific field value:

sql
SELECT * FROM logs WHERE field_name = 'field_value'

This query will filter logs based on a specific field name and its corresponding value. You can replace 'field_name' with the name of the field you want to filter, and 'field_value' with the actual value you want to filter by.

3. Aggregate logs by a specific field:

vbnet
SELECT field_name, COUNT(*) as count FROM logs GROUP BY field_name

This query will aggregate logs based on a specific field name and provide a count of logs for each unique value of that field. You can replace 'field_name' with the name of the field you want to aggregate.

4. Search for logs within a specific time range:

sql
SELECT * FROM logs WHERE timestamp >= 'start_time' AND timestamp <= 'end_time'

This query will search for logs that fall within a specific time range. You can replace 'start_time' and 'end_time' with the actual start and end times in the format 'YYYY-MM-DD HH:MM:SS'.

5. Search for logs from a specific source IP address:

sql
SELECT * FROM logs WHERE src_ip = 'source_ip'

This query will search for logs where the source IP address matches the specified IP address. You can replace 'source_ip' with the actual IP address you want to search for.

6. Search for logs from a specific destination IP address:

sql
SELECT * FROM logs WHERE dest_ip = 'destination_ip'

This query will search for logs where the destination IP address matches the specified IP address. You can replace 'destination_ip' with the actual IP address you want to search for.

7. Filter logs by severity level:

sql
SELECT * FROM logs WHERE severity = 'severity_level'

This query will filter logs based on their severity level. You can replace 'severity_level' with the desired severity level, such as 'low', 'medium', 'high', etc., depending on the severity levels defined in your Wazuh configuration.

8. Search for logs related to a specific log source or log type:

sql
SELECT * FROM logs WHERE log_source = 'source_name' OR log_type = 'type_name'

This query will search for logs related to a specific log source or log type. You can replace 'source_name' and 'type_name' with the actual names of the log source and log type you want to search for.

9. Filter logs by a specific user or username:

sql
SELECT * FROM logs WHERE user = 'username'

This query will filter logs based on a specific user or username. You can replace 'username' with the actual username you want to filter by.

10. Search for logs containing a specific keyword in a specific field:

sql
SELECT * FROM logs WHERE field_name LIKE '%keyword%'

This query will search for logs where a specific field contains the specified keyword. You can replace 'field_name' with the name of the field you want to search in, and 'keyword' with the actual keyword you want to search for.

11. Query to search for failed SSH login attempts:

json
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "log_name": "auth.log"
          }
        },
        {
          "match": {
            "message": "Failed password for"
          }
        }
      ]
    }
  }
}

    These are just a few examples of the queries you can use with Wazuh to analyze logs and detect security threats. The specific query syntax may vary depending on your Wazuh installation and log sources. It's important to consult the Wazuh documentation and customize the queries based on your environment and security requirements. Always thoroughly test and validate any queries before implementing them in a production environment. Remember to use proper log analysis techniques, and consult with your organization's security policies and guidelines. A skilled security analyst may be able to provide further assistance with log analysis and querying in Wazuh.

Wazuh: Log Analysis Queries with Use Cases for Effective Network Security Monitoring | Part-1