Open source security platform

Today, businesses face multiple security challenges such as cyber attacks, compliance requirements, and endpoint security administration. The threat landscape is constantly evolving, and it can be overwhelming for businesses to keep up with the latest security trends. The security team uses security processes and solutions to address these challenges. This solution includes a firewall, antivirus, data loss prevention service, and XDR (Extended Detection and Response).

Wazuh is a free and open source security platform that brings together XDR and SIEM (System Information and Event Management) capabilities. It consists of a universal security agency for the collection of event data from multiple sources and key components for event analysis, correlation and alerts. The main components include the Wazuh server, dashboard and indexer. Wazuh offers a suite of modules capable of providing extended threat detection and response for both on-premises and cloud workloads.

In this article, we highlight the Wazuh capabilities that are beneficial to your organization’s security needs.

Threat intelligence

Wazuh includes the MITER ATT&CK module with ready-made threat detection rules. The MITER ATT&CK module provides details that allow threat hunters to identify enemy tactics, techniques and procedures (TTP). This includes details such as threat groups, software, and mitigation measures. You can use this information to narrow down the compromised threat or endpoint in your environment. Wazuh threat detection rules are mapped with the corresponding MITER ATT&CK IDs.

Figure 1: Wazuh MITER ATT&CK Dashboard

Wazuh integrates seamlessly with third-party threat intelligence solutions such as VirusTotal, MISP, URLHaus and YARA. This integration enables checking of file hashes, IP addresses, and URLs against known malicious compromise indicators (IOCs). Wazuh’s integration with this solution improves your business’s overall security posture by providing additional insight into potential threats, malicious activity, and IOCs.

A vulnerability is a security weakness or flaw that could be exploited by a threat to carry out malicious activity in a computer system. Wazuh offers a Vulnerability Detector module to help businesses identify and prioritize vulnerabilities in their environment. This module uses data from multiple feeds such as Canonical, Microsoft, National Vulnerability Database (NVD), and others to provide real-time information about vulnerabilities.

Threat detection and response

Wazuh uses its modules, decoders, rule sets and integrations with third party solutions to detect and protect your digital assets from threats. These threats include malware, web, network attacks, and more.

The Wazuh File Integrity Monitoring Module monitors directories and reports file additions, deletions, and modifications. It is used for auditing sensitive files but can be combined with other integrations to detect malware. The rootcheck module is used to detect rootkit behavior such as hidden files, ports and unusual processes. Wazuh’s active response module provides automatic response actions such as quarantining the infected system, blocking network traffic, or terminating the ransomware process. The combination of these modules enables rapid response to reduce the impact of cyberattacks.

The image below illustrates a combination of the FIM module, VirusTotal integration, and active response module in detecting and responding to downloaded malware on monitored endpoints.

Figure 2: Malicious files detected and removed from monitored endpoints

Audit and regulatory compliance

Security audit and compliance are two important concepts for any business that aims to protect itself from cyber attacks. A security audit is a systematic process of evaluating an organization’s information systems, practices and procedures to identify vulnerabilities, assess risks and ensure that security controls are functioning as intended. Regulatory compliance refers to the process of certifying that an organization complies with an established set of standards, regulations, or laws related to information security.

Wazuh helps businesses pass security audits and meet regulatory compliance requirements. Compliance standards offer a set of guidelines and optimal procedures to ensure the security of an organization’s systems, networks and data. Adhering to these standards helps lower the chance of a security breach. Wazuh has various modules that help meet compliance standards such as PCI DSS, GDPR, NIST, etc Uses Wazuh SIEM and XDR platforms to meet PCI DSS compliance demonstrates how Wazuh plays a critical role in maintaining PCI compliance for your organization. The image below shows the Wazuh NIST dashboard.

Figure 3: NIST’s Wazuh Dashboard

Cloud security

Cloud platforms provide services that manage compute, storage, and network operations over the Internet. Businesses are widely adopting this cloud platform due to its easy access to resources, flexibility and high scalability. As more and more organizations take advantage of the cloud, keeping their digital assets secure is still important.

Wazuh is a unified XDR and SIEM platform that provides security visibility and monitoring for cloud environments. It monitors and protects cloud services running on Amazon Web Services, Microsoft Azure, and Google Cloud Platform. This is achieved by collecting and analyzing security event data from various cloud components. The data enables Wazuh to perform vulnerability detection, cloud compliance checks, security monitoring, and automatic response to detected threats.

Figure 4: Wazuh monitoring the AWS CloudTrail service

End point hardening

The Wazuh SCA module performs configuration assessments on systems and applications, ensuring hosts are secure and the vulnerability surface is reduced. Wazuh uses policy files to scan endpoints for configuration errors and vulnerabilities. This policy file is included directly and based on Internet Security Center (CIS) benchmarks. SCA scan results provide insight into existing vulnerabilities in monitored endpoints. These vulnerabilities range from configuration flaws to vulnerable versions of applications and services installed. Failed security checks are displayed along with their fixes, providing system administrators with a quick resolution path.

Figure 5: Failed SCA check and remediation for WordPress installation

Open source

Wazuh has fast growth public where users, developers and contributors can ask questions about the platform and share ideas collaboratively. The Wazuh community provides users with free support, resources and documentation.

Wazuh, being an open source security platform, provides flexibility and easy customization. Users can modify the source code to suit their particular needs or add new features and capabilities. The Wazuh source code is publicly available in the Wazuh GitHub repository for users who may wish to do a verification check or contribution.

Conclusion

Wazuh is a free and open source platform with powerful XDR and SIEM capabilities. With capabilities such as log data analysis, file integrity monitoring, intrusion detection, and automated responses, Wazuh gives businesses the ability to respond quickly and effectively to security incidents.