News & Tutorials

Connect Wazuh to Claude with MCP. Ask about alerts and vulnerabilities in natural language and run actions like isolating servers or killing processes.

Monitor routers, switches, NAS and agentless devices using rsyslog as a collector. Complete setup with templates, filters and Wazuh integration.

Learn how to write custom Wazuh rules to detect folder access, specific users or Delete/Write actions. Practical examples with NAS logs and dynamic variables.

Set up email alerts in Wazuh with Postfix and Gmail/Microsoft 365. Covers ISO 27001 (A.5.24-A.5.26) and ENS (op.mon.1, op.mon.3) compliance.

Create Wazuh rules to detect software installs and uninstalls in Windows (Event IDs 11707 and 11724). ISO 27001 and compliance auditing included.

Investigate a real SSH brute-force attack step by step using Wazuh's Threat Hunting and Discover panels. A hands-on case study with remediation measures.

Understand how Wazuh processes logs: pre-decoder, decoder, rules and alerts. Configure notifications by email, Discord or Slack.

Configure Wazuh's vulnerability detector to identify CVEs across your infrastructure. Meet ISO 27001 A.8.8 and ENS op.exp.6 with continuous scanning.

Hands-on lab: configure FIM to detect changes to .pfx, .p12 and .cer certificates. Meet ISO 27001 A.8.24 and ENS mp.com.3 with custom alerts.

Set up Wazuh to automatically scan suspicious files against 70+ antivirus engines with the VirusTotal API. Step-by-step guide using FIM and EICAR.

Learn to organize your agents into groups (Windows, Linux, databases) and push centralized ossec.conf configurations to every agent in the group.

Step-by-step guide to install Wazuh using Docker Compose. Deploy the full SIEM in minutes with containers: Indexer, Server and Dashboard up and running.

How to install the Wazuh agent on Windows step by step: MSI download, install command, ossec.conf configuration, localfile and syscheck. Ready in 15 minutes.

Step-by-step guide to install and configure the Wazuh agent on Linux (Debian/Ubuntu). Install command, ossec.conf setup, localfile and restarting the service.

Learn how to install Wazuh on Ubuntu, Debian, CentOS and Rocky Linux. Step-by-step guide with the all-in-one method and separate component install.

What Wazuh is, what it's used for and how it protects your business: threat detection, compliance, log monitoring on Linux and Windows. Guide with real examples.

Configure Wazuh to monitor the Docker host and its containers: Docker Listener, container logs, FIM, real alerts and suspicious docker exec detection.

Build a complete SIEM by integrating Wazuh with Elastic Security. Step-by-step install of Elasticsearch, Kibana and Filebeat plus real-time alert dashboards.

Monitor your Office 365 tenant with Wazuh: ingest Exchange and SharePoint logs and build rules to detect foreign logins, brute force and phishing-driven breaches.

Integrate AI into Wazuh for threat hunting. Install Ollama with a local LLM, connect it to your Wazuh logs and query security events in natural language, on-prem.