31. SOC, SIEM and Incident Response

31.4 Wazuh Lab: See Your Own Attacks

By Ravindra Bagale · Last updated: 27 September 2026

Wazuh has a central server (manager, indexer and dashboard) and small agents on each machine you want to watch. It is free and ideal for learning.

Lab layout: a separate VM (4 GB RAM or more, a supported Linux such as Amazon Linux 2023 or Ubuntu) on the host-only network as the Wazuh server, for example 192.168.56.30. The victim VMs get the agent.

1. Install the server (all-in-one). Wazuh provides an installation assistant; check the version and exact command in the official quickstart at documentation.wazuh.com before running it:

curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

At the end it prints the dashboard admin password. Open https://192.168.56.30 in the host browser and log in.

2. Add an agent. In the dashboard choose Agents, Deploy new agent, pick the OS, enter the server IP, and it shows the exact install command for that machine. On an Amazon Linux/RHEL-style victim the agent service is then started with:

sudo service wazuh-agent start
sudo systemctl enable wazuh-agent     # start on boot
sudo service wazuh-agent status

3. Generate and watch alerts. From Kali, repeat the Hydra SSH attack and a Nikto scan against the agent machine. In the dashboard open Threat Hunting / Security events and you will see alerts such as "sshd: authentication failed", "Multiple authentication failures" and web attack rules, each with a rule ID, level (0–15) and MITRE ATT&CK technique.

4. File integrity monitoring (FIM). Wazuh watches important files. Change one and see the alert:

sudo sh -c 'echo "# test change" >> /etc/hosts'

Useful built-in features: vulnerability detection (lists outdated packages with CVEs), security configuration assessment (CIS benchmark checks), and active response (for example automatically blocking an IP after brute force).