Wazuh: Log Analysis Queries with Use Cases for Effective Network Security Monitoring | Part-2

 Here are some more queries you can use with Wazuh SIEM to search and analyze logs:

11. Search for Successful Logins:

    • Identify successful login events to monitor user activity.

    sql
    SELECT * FROM alerts WHERE rule.category = 'authentication_successful';
    

12. Search for Suspicious Processes:

    • Look for alerts related to suspicious processes or executables.

    sql
    SELECT * FROM alerts WHERE rule.category = 'ossec' AND rule.description LIKE '%suspicious%';
    

13. Search for Network Traffic:

    • Find alerts related to network activity or suspicious network connections.

    sql
    SELECT * FROM alerts WHERE rule.category = 'network_traffic';
    

14. Search for Brute Force Attacks:

    • Identify brute force attacks by looking for multiple failed login attempts.

    sql
    SELECT * FROM alerts WHERE rule.description LIKE '%brute force%' AND severity >= 7;
    

15. Search for Malware Activity:

    • Look for alerts related to malware detection or suspicious file activity.

    sql
    SELECT * FROM alerts WHERE rule.category = 'malware';
    

16. Search for File Integrity Changes:

    • Identify changes to critical system files or directories.

    sql
    SELECT * FROM alerts WHERE rule.category = 'file_integrity';
    

17. Search for Anomalies:

    • Look for anomalies or deviations from normal behavior using statistical analysis.

    sql
    SELECT * FROM alerts WHERE rule.category = 'anomaly_detection';
    

18. Search for Exploits or Vulnerabilities:

    • Identify alerts related to known exploits or vulnerabilities.

    sql
    SELECT * FROM alerts WHERE rule.category = 'vulnerability';
    

19. Search for Rootkit Detection:

    • Look for alerts related to rootkit detection or suspicious system modifications.

    sql
    SELECT * FROM alerts WHERE rule.category = 'rootkit_detection';
    

20. Search for Firewall Events:

    • Identify alerts related to firewall activity or blocked connections.

    sql
    SELECT * FROM alerts WHERE rule.category = 'firewall';
    

These additional queries provide further options for analyzing various types of security events and threats within your environment. You can tailor these queries to your specific use cases and security monitoring requirements to effectively detect and respond to potential security incidents.

Wazuh: Log Analysis Queries with Use Cases for Effective Network Security Monitoring | Part-1

Wazuh: Log Analysis Queries with Use Cases for Effective Network Security Monitoring | Part-3