you need this FREE CyberSecurity tool

About this video

Chuck deploys Wazuh (called ‘waza’ throughout the transcript), a free, open-source SIEM — security information and event management — tool of the kind defensive/blue-team staff use. A central server collects logs and alerts from agents installed on Mac, Windows and Linux machines, and can also respond actively, for example blocking an attacking IP address. He gives the vendor’s recommended sizing as a minimum of two gigs of RAM and two CPU cores, going up to four gigs of RAM and eight CPU cores for lots of devices/logs, then installs it two ways: a one-click Linode Marketplace image on Ubuntu (warning that the smaller plan he tried would not work for that install) and a Docker single-node deployment using self-signed certificates. Adding agents is shown as a one-command install on Kali Linux and a PowerShell one-liner on Windows. In the dashboard he tours the MITRE ATT&CK mapping, compliance checks (PCI, GDPR, NIST, HIPAA), and the security configuration assessment, where one of his public servers scored 39% and failed 715 checks, with each failure explained and given a fix. He enables the vulnerability detector (not on by default; he says it runs a full scan every six hours) and points to one machine with 170 critical CVEs, in his telling. The hands-on demos customise file integrity monitoring: editing the agent config for real-time alerts on a Windows desktop folder so file adds/edits show what text changed, adding a custom registry key and shortening the scan interval so a modified key is caught (malware abusing Run/RunOnce startup keys is the use case), and configuring active response so brute-force rule 5710 triggers a firewall drop that blocks the attacker for 180 seconds. He finishes by wiring Slack alerts through an incoming webhook filtered to that same rule.

Key takeaways

• Wazuh is a free, open-source SIEM: agents on Windows, Linux and Mac report logs, configuration and security events to one server dashboard, with email/Slack-style alerting and active response.
• Deployment options shown: a Linode Marketplace Ubuntu install and a Docker single-node install; he cites minimum sizing of 2GB RAM/2 cores, scaling to 4GB RAM/8 cores.
• Its configuration assessment teaches while it audits — his example server scored 39% and failed 715 CIS-style checks, each listed with rationale, remediation and related MITRE techniques.
• File integrity monitoring can watch folders in real time and Windows registry keys for changes, a classic malware-persistence signal (e.g. Run/RunOnce keys).
• Active response turns detection into action: his brute-force rule 5710 config blocks the source IP at the firewall for 180 seconds, and the same rule can drive Slack alerts via a webhook.

Episode details: published July 19, 2023 · 32:06 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: intro to cloud hacking (leaky buckets) · Next: Subnetting…..but in reverse →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube