How To Install Wazuh On Ubuntu 22.0.4

How To Install Wazuh On Ubuntu 22.0.4

  • Let’s Upgrade Our Elastic Stack From a Simple SIEM To an EDR with Wazuh

Installing Wazuh on ELK

  • Let’s get the prereqs (prerequisites) for Wazuh
apt install apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release gnupg2
  • We gotta get the keys like we did for ELK, remember ;)
curl -s | gpg --dearmor > /etc/apt/trusted.gpg.d/wazuh.gpg
  • With that we can get to the Wazuh repo
echo "deb stable main" > /etc/apt/sources.list.d/wazuh.list
  • Let’s update our friend APT so Wazuh can move in and bring its luggage :P
sudo apt update

*Install Wazuh

sudo apt install wazuh-manager
  • Don’t forget to be a good SysAdmin and enable Wazuh to start again if the system shutsdown (think of like during a storm and power gets lost)
sudo systemctl enable --now wazuh-manager
  • We need to allow Wazuh thru the firewall so let’s add those rules now too.
ufw allow 1514/tcp
ufw allow 1515/tcp
  • Aight party people we’re on our way to evolving our security operations. Let’s enable the Wazuh Kibana Plugin so we can see it in our GUI.

*Let’s change access so we can start using plugins we use R for reading.

chown -R kibana: /usr/share/kibana/plugins
  • Remember that we’re putting puzzle pieces together so we need to make sure our versions of different software are compatible with one another. Luckily you have your boi @J3st3rJam3s here so i’ll maek it easy for ya!
sudo -u kibana /usr/share/kibana/bin/kibana-plugin install
  • In the event the blog post gets outdated which it will please refer here for the correct Wazuh package you need for the Kibana version.

  • Let’s Be Good SysAdmins and keep our data organized so we’re gonna make a Wazuh data directory for Kibana.

mkdir /usr/share/kibana/data
chown -R kibana: /usr/share/kibana/data
  • Now that we’ve upgraded and evolved let’s update the folks at the copacabana with Kibana.
systemctl restart kibana
  • Let’s create the Wazuh module for Filebeat so we can make sure we have synergy (cringe hated business term).
sudo nano /etc/filebeat/wazuh.yml
  • Add your Elasticsearch and port
  - module: wazuh
      enabled: true
      enabled: false

setup.template.json.enabled: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json' 'wazuh'
setup.template.overwrite: true
setup.ilm.enabled: false

output.elasticsearch.hosts: ['localhost:9200']
  • Let’s Install the Filebeat Wazuh Module
wget -qO- \
| tar -xz -C /usr/share/filebeat/module/
  • Let’s also get the Wazuh alerts Elasticsearch template
wget -O /etc/filebeat/wazuh-template.json \
  • Now that we’ve made some updates to filebeat let’s make sure it’s ok with the upgrades (we don’t want to hurt its feelings now do we)
filebeat test config
  • Next let’s download the Wazuh indexer so the data can get indexed
apt -y install wazuh-indexer
  • Let’s config it
sudo nano /etc/wazuh-indexer/opensearch.yml
  • That’s it, let’s restart everything so the puzzle can come together.
systemctl restart elasticsearch kibana filebeat wazuh-manager
  • You should now be able to see Wazuh all ready to go for you to add agents in Kibana.

Let’s Go Ahead And Add Forensic Data By Adding Velociraptor Server

sudo cp velociraptor-v0.6.3-1-linux-amd64 /usr/local/bin/velociraptor
sudo chmod +x /usr/local/bin/velociraptor
  • Now let’s generate a config for Velociraptor
velociraptor config generate -i

  • copy the config to /etc because we’re gonna make velociraptor a service
cp server.config.yaml /etc/velociraptor.config.yaml

*Let’s make velociraptor a service

sudo nano /lib/systemd/system/velociraptor.service
  • Paste below peak the config file and location
Description=Velociraptor linux amd64

ExecStart=/usr/local/bin/velociraptor --config /etc/velociraptor.config.yaml frontend -v


*reload systemctl for the update to take effect and enable it for boot

sudo systemctl daemon-reload
sudo systemctl enable --now velociraptor
  • You should now be able to access velociraptor at https://localhost:8889/ and that’s Wazu-h-p :P

comments powered by Disqus