Wazuh: Log Analysis Queries with Use Cases for Effective Network Security Monitoring | Part-1

 Wazuh is an open-source security information and event management (SIEM) platform that collects, analyzes, and responds to security events generated by systems and applications. Here are some basic queries that you can use with Wazuh SIEM to search and analyze logs:

1. Search for Specific Events:

   • Query by event ID or event type to find specific security events.

   sql
   SELECT * FROM alerts WHERE rule.id = 'xxxxx';
   

2. Filter by Time Range:

   • Limit the search to a specific time range to focus on events within a particular period.

   sql
   SELECT * FROM alerts WHERE timestamp >= '2022-01-01T00:00:00' AND timestamp <= '2022-01-31T23:59:59';
   

3. Search by Source IP:

   • Look for events originating from a specific source IP address.

   sql
   SELECT * FROM alerts WHERE source.ip = 'xxx.xxx.xxx.xxx';
   

4. Search by Destination IP:

   • Look for events targeting a specific destination IP address.

   sql
   SELECT * FROM alerts WHERE destination.ip = 'xxx.xxx.xxx.xxx';
   

5. Search by User:

   • Find events associated with a specific user or username.

   sql
   SELECT * FROM alerts WHERE user.name = 'username';
   

6. Search by Event Severity:

   • Filter events by severity level to focus on critical or high-priority events.

   sql
   SELECT * FROM alerts WHERE severity >= 7;
   

7. Search by Event Description:

   • Look for events containing specific keywords or descriptions.

   sql
   SELECT * FROM alerts WHERE description LIKE '%keyword%';
   

8. Aggregate Count of Events:

   • Count the number of events grouped by a specific field, such as event type or source IP.

   sql
   SELECT source.ip, COUNT(*) AS event_count FROM alerts GROUP BY source.ip;
   

9. Top N Events by Count:

   • Find the top N events with the highest occurrence count.

   sql
   SELECT rule.description, COUNT(*) AS event_count FROM alerts GROUP BY rule.description ORDER BY event_count DESC LIMIT 10;
   

10. Search for Failed Logins:

    • Identify failed login attempts for analysis or investigation.

    sql
    SELECT * FROM alerts WHERE rule.category = 'authentication_failed';
    

These are just some examples of basic queries that you can use with Wazuh SIEM to search and analyze logs. Depending on your specific use case and requirements, you can customize these queries further and combine different search criteria to gain insights into your security events and threats.

Note: Wazuh: Log Analysis Queries with Use Cases for Effective Network Security Monitoring | Part-2