Thanks for watching! Give Internet Merch giveaway - dyno.gg/giveaway/39c494bb Support a great cause! - giveinternet.org/techdox

Great video, in particular you are showing the features first and then the installation, not the other way round where many then forget to show functionality… good job

@jjuarez83

22 күн бұрын

Yeah, I like to get an idea of where I am going before I go on a trip.

Great video! I've been using Wazuh at home for a while now, but still have much to learn.

Hi, thanks for this usefull guide! Signed up! Greetings from Italy !

Thanks for the video, great tool!

gonna give it a try over weekend for sure . thanks!

@Techdox

Ай бұрын

Let me know how you get on! Keen to hear other opinions on it :)

My excuse is supply chain attacks could make Wazuh into a giant backdoor to all connected systems.

@Techdox

15 күн бұрын

100% fair - While no system can be entirely risk-free, using open-source solutions like Wazuh, where there is visibility into the codebase, can offer a level of reassurance. But, like anything you do your own research to see if your comfortable with it

@bangonkali

12 күн бұрын

I have exactly the same issue. Even solar winds was susceptible to this. I think any organization large enough to become a target whether for profit or open-source or whatever are susceptible to nation backed attacks or even against another well funded and driven malicious entity.

@Iswimandrun

8 күн бұрын

@Techdox guess you got to do layers and some of your systems should be on Wiresharked listened into local networks to validate installs and that yea you still own the systems you got the Wazuh instances and no one else is getting remote access to said instance. Probably benchmark things every time you update to insure the same or similar behavior. Idk there are probably more steps you can take to ensure your remote command and control system with Wazuh. The fact it is open source auditable and used not just by your company might have some points in more secure.

@kevincedeno8899

15 сағат бұрын

Agreed. Supply chain attacks affect proprietary software as well, and there's less transparency.

Thanks for the demo and info, this is Awesome. I will set it up, and be more secure. Have a great day Sir

@Techdox

Ай бұрын

Awesome, glad you liked it!

Banger video as usual

Hi Techdoc, great video from a fellow NZder and just implemented. Any chance you can do one on Traefik, followed a few other UT tutorials but still can't get my head around it. I'm sure with the way you do your videos I'd be able to understand and it would be very helpful.

@Techdox

Ай бұрын

Traefik seems to be pretty well requested. I’ll get a video sorted for ya!

@jirehla-ab1671

25 күн бұрын

@@Techdox will Wazuh work well with tailscale?

Great tutorial!! How are updates though with the latest version? I heard there were issues in the past...

@Techdox

22 күн бұрын

I personally have had no issues

Great video, How do you make the dashboard available via Cloudflare tunnel

@Techdox

Ай бұрын

If you wanted to, you do it the same way as any other server. This would be https and then the IP address of Wazuh and that should be the config you need. Join the Discord if you need more help.

Nice video. If you could make a video for each module that would be awesome.

@Techdox

11 күн бұрын

I would love too, but it's a bit too deep for my channel I think. Happy to answer questions you have though

Great video! Can this run in LXC instead of a VM?

@Techdox

7 күн бұрын

Hey, you can deploy it as a container if you wish as well :) documentation.wazuh.com/current/deployment-options/docker/index.html

Have you every setup an open source vulnerability scanner like GVM/Openvas?

@Techdox

Ай бұрын

No I haven’t, are they worth looking into?

@reeeick

Ай бұрын

@@Techdox They are great for performing continuous scans of your network environment and catching known vulnerabilities as soon as they are disclosed

Great idea trusting yet another company with full root access to my servers. They won't ever be hacked I'm sure.

@Techdox

4 күн бұрын

Absolutely, it's a valid point to be cautious about who has root access to your servers. But if you think about it, that's a concern with pretty much any third-party service or application we use, not just Wazuh. It really comes down to trust and verifying the security practices of any company you're considering. Plus, with open-source solutions like Wazuh, there's a community keeping an eye on things, which can sometimes offer an additional layer of scrutiny and security. It's all about finding the right balance that works for you!

Thanks for the vido, but how to install in other port 443 ERROR: Port 443 is being used by another process. Please, check it before installing Wazuh.

@Techdox

Ай бұрын

Hey. This is why I suggested to run it on its own dedicated server to avoid classes with other services you are running :)

Do you know how to inventory software with wazuh? Especially this with vulnerabilities. For example, search firefor 120 and show on which hosts it is installed? Thanks

@Techdox

Күн бұрын

Only if the package has a vulnerability so under Vulnerabilities, where it asks you to select an agent, look next to Inventory and select events. Here you can filter on a package name

I could never get Wazuh to work properly First instance I did up worked okay, I could add agents to it but I had to close that instance down pretty much straight away as it was all temporary data in it I've tried 3 times after that and everytime I add an agent to it nothing happens. The little add agent window just refreshes and sits there

@Techdox

15 күн бұрын

Interesting, in this install it was done on a fresh installed VM so maybe you have conflicts? What distro are you using or how are you installing it?

Can we get a tour of ur home lab setup and design?

@Techdox

18 күн бұрын

Sure, it's nothing fancy :)

Is there a way to install wazuh with portainer and caddy reverse proxy? I tried multiple times but failed

@futuregootecks

11 күн бұрын

Not sure about wazuh specifically but the way I do it with other containers is to place it on the same docker network as caddy and then add the docker container name to the caddyfile then reload.

thnx for guide.. please tell me why we should just trust this company out of the box and installing clients/agents on our servers ? Does this company have any reputation in the world wide security map ?

@Techdox

Ай бұрын

Great question. I’ll make sure to include this in videos from now on. For me, I followed their social pages, verified their company and customers. wazuh.com/our-customers/ After six years of running, I’m sure if they were not legit they would have been called out by now. Gartner is also a good place to check out tooling www.gartner.com/reviews/market/security-information-event-management/vendor/wazuh/product/wazuh-the-open-source-security-platform

Security conscious vid and the first thing he does is to grab a random url and running it.... Always, check all scripts from the web before you run them. Else great vid, thanks!

@Techdox

Ай бұрын

Not exactly a random link, in this case I have an active server running from this same script and verified it's legit. This is something I mention a lot on this channel, making sure you actually know what is going on. I mentioned in this video this script installs the 3 components of Wazuh and showcase you can actually install the components individually as well. Valid point still

@karsh001

Ай бұрын

@@Techdox Thanks for the reply, you made a great point. I got a couple of suggestions for follow ups: 1. Like anyone installing automated tools you practically drown in warnings and errors. How do you deal with it in the best way? 2. A simple walk-through of an install script, what it does and what to look out for. Maybe framed for the Linux community as a whole. I am of course referring to the debacle that led up to CVE-2024-3094.

Do you know if Wazuh can actually run on the Proxmox server? Tried but kept running into issues sadly.

@Techdox

Ай бұрын

Really good question, it just runs Debian so I don’t see why not, I’ll give it a try. What issues did you face?

@viernester

Ай бұрын

@@Techdox wazuh-agent service just failed to start, some of the issues i found possibly with some group membership missing. Didn't get too far after trying to mess with that, hope you have more success.

@Techdox

Ай бұрын

@@viernester I also tried and failed. Will look into it some more. Most likely missing dependencies

@NahImPro

21 күн бұрын

@@viernesterworking fine for me on prox 8! Ensure you install on a full Ubuntu VM and not a container.

I’m not fully convinced that all the CIS linux server controls are necessary. Sure, they are stronger suggestions, but they don’t represent vulnerabilities.

@Techdox

18 күн бұрын

100% unless your a company aiming for certification compliance, a lot of these are overkill, but still good to implement some of them

Looks like it uses ElasticSearch / Kibana under the hood

@zgjbeta

28 күн бұрын

The font and layout gave it away for me as well.

@gerardocaceres7997

27 күн бұрын

It uses Opensearch for the Indexer and Dashboard.

@thertsr9999

18 күн бұрын

It does it's based on elastic

I’ve tried so many different ways to get this running on my raspberry pi 4b 8gb, but it doesn’t work. Followed about 3 different tutorials, but all fail. Hope you can address this, as I’d love to make use of wazuh and my spare pi! 🙏

@Techdox

Ай бұрын

That would be because Wazuh is not supported on ARM, which is what your Raspberry Pi uses - www.reddit.com/r/Wazuh/comments/16gwtt7/wazuhdashboard_on_rpi/

@-someone-.

Ай бұрын

@@Techdox thx, I guess the tutorials I followed were just clickbait for ads. Hopefully it gets support one day..👍

@Techdox

Ай бұрын

@@-someone-. yeah, especially for agents

@-someone-.

Ай бұрын

@@Techdox have you tried? doesn’t the “linux agents” cover pi’s.

@Techdox

Ай бұрын

@@-someone-. when I checked there was no ARM option which would be needed for the Pi’s

Talking about security and then running an install script downloaded from the web as root without even checking its content is a little bit off, right?

@Techdox

26 күн бұрын

Someone asked the same below this was my reply :) “Not exactly a random link, in this case I have an active server running from this same script and verified it's legit. This is something I mention a lot on this channel, making sure you actually know what is going on. I mentioned in this video this script installs the 3 components of Wazuh and showcase you can actually install the components individually as well. Valid point still”

Discord invite is invalid.

@Techdox

25 күн бұрын

I just tested it, still works. - discord.com/invite/8mX2KRxDw8

Ubiquiti 😁

Try to upgrade it. It will fail miserably

@Techdox

20 күн бұрын

What steps are you using to upgrade?

Doesn't scale well for enterprise especially in highly ephemeral environments.

@Techdox

3 күн бұрын

Keen to hear more about that use case and how it doesn’t work? :)

@trollingdirty8910

3 күн бұрын

@@Techdox use case as enterprise that makes heavy use of spot instances that auto-register. Wazuh doesn’t scale in these cases very well. Imagine thousands of instances that instantiate and terminate a day. Primarily for data operations, etl.

@Techdox

3 күн бұрын

@@trollingdirty8910 yeah, in this case they would be container based most likely and in that case the image itself would go through the testing for vulnerabilities etc

@trollingdirty8910

3 күн бұрын

@@Techdox Negative. Fat EC2 instances heavy compute. The AMI is baked and already scanned, primary concern is FIM.

Apparently the dashboard doesnt have a good dark mode, but the docs do? No thank you.

@Techdox

Ай бұрын

Haha, fair enough. Pretty sure you can get browser extensions to do that if it’s a big issue for you

@66maelstrom

Ай бұрын

Wow. So no dark mode is the killer here? Like what??? I guess network security tools rely on things being dark, before things actually go dark?? What a crazy comment.....

@rudiklein

Ай бұрын

Wearing a hoody much? 😂

@Nahga

28 күн бұрын

I will not discount software outright for no dark mode, but I really hate using a web app that is constantly flash banging me.

@gr0wnup5

25 күн бұрын

Clearly a bot