Wazuh Open Source SIEM

Wazuh is a fully-fledged SIEM platform that puts an end to the "just install it" principle. The basic idea is that an agent runs on each end device and reports to the Wazuh server. The server analyzes the information, creates an overview, and assesses the security status of the infrastructure.

For a first impression or in a small environment, Wazuh provides a virtual machine [6] that contains all services and appears at https://<Server IP Address> after booting. Without agents, though, the web pages will be largely empty. The Deploy new agent button shows how the agent software is installed on clients for various operating systems and distributions.

Nothing happens immediately after rolling out the agents. Wazuh requires patience, because the agents perform their malware and integrity checks on a schedule. Gradually, the dashboards on the Wazuh website fill up, providing information on the health status (Figure 4).

Figure 4: Wazuh collects reports from all agents to paint an overall picture of the security situation. Here, the agent has detected and reported several vulnerabilities.

Wazuh describes itself as an open source security platform [7] and goes far beyond basic protection, with a focus on a holistic view of all endpoints rather than on malware protection for a single computer.

Conclusions

Even though nasty viruses mainly attack Microsoft systems, Linux is not automatically off the hook. The smaller number of malware programs (Table 1) is reflected in the restricted selection of AV products (see the "Even More Security" box). The first port of call is ClamAV, which is available for virtually every distribution and has been sniffing around local databases for more than 20 years. If you want to protect your environment against rootkits, you will want Rootkit Hunter or Linux Malware Detect to scan your systems on a regular basis. Going one step further, to ensure a uniform level of protection on all computers, you can look into security platforms such as Wazuh.