Wazuh training

Lesson 1 • Wazuh Architecture Deep Dive

Explains the manager, agent, and indexer components and how they interact. Students diagram data flow across the platform.

Lesson 2 • Security Monitoring Fundamentals

Covers threat detection principles, log management, and why SIEM tools exist. Establishes the problem space Wazuh addresses.

Lesson 3 • Wazuh Overview and Capabilities

Introduces Wazuh as an open-source security platform covering its main modules. Students map Wazuh features to real security needs.

Lesson 1 • Agent Installation on Linux

Covers package-based and scripted agent installation on major Linux distributions. Students install and verify a functional Linux agent.

Lesson 2 • Agent Installation on macOS

Addresses macOS-specific installation steps and system extension approvals. Students connect a macOS agent to the manager.

Lesson 3 • Agent Installation on Windows

Walks through MSI-based and PowerShell-scripted Windows agent deployment. Students enroll a Windows endpoint into the Wazuh manager.

Lesson 4 • Agent Lifecycle Management

Covers upgrading, removing, and monitoring agent health at scale. Students automate agent updates using the Wazuh API.

Lesson 1 • Log Collection Sources and Methods

Introduces syslog, flat files, Windows Event Log, and API-based collection. Students configure each collection method in the agent ossec.conf file.

Lesson 2 • Writing Custom Decoders

Teaches authoring decoders for proprietary or unsupported log formats. Students produce a working decoder for a custom application log.

Lesson 3 • Writing and Testing Custom Rules

Guides students through authoring rules that detect environment-specific threats. Students validate rules using wazuh-logtest before production deployment.

Lesson 4 • Rules Engine and Alert Generation

Covers how rules consume decoded fields to generate alerts with severity levels. Students understand rule inheritance and frequency-based triggering.

Lesson 1 • FIM Concepts and Architecture

Explains how FIM detects additions, modifications, and deletions using checksums. Students understand scheduled vs. real-time monitoring modes.

Lesson 2 • Configuring FIM Policies

Covers syscheck configuration blocks for directories, files, and registries. Students write policies that monitor critical OS and application paths.

Lesson 3 • FIM Alert Tuning and Exclusions

Teaches reducing false positives by excluding noisy paths and tuning alert rules. Students apply ignore patterns and adjust rule severity for FIM events.

Lesson 1 • Prioritizing and Remediating Findings

Applies risk-based prioritization to vulnerability findings using exploitability context. Students build a remediation workflow integrated with ticketing concepts.

Lesson 2 • Configuring Vulnerability Feeds

Covers configuring OS-specific and third-party vulnerability feeds in the manager. Students add and validate feeds for Linux, Windows, and macOS endpoints.

Lesson 3 • Vulnerability Detection Module Overview

Introduces how Wazuh inventories software and matches packages against vulnerability feeds. Students enable the module and confirm feed synchronization.

Lesson 1 • SCA Module Fundamentals

Explains how SCA checks run, how results are scored, and which benchmarks ship by default. Students enable SCA and review initial scan results.

Lesson 2 • Interpreting SCA Results

Covers passed, failed, and not-applicable check statuses and their remediation implications. Students identify the highest-impact failures in a scan report.

Lesson 3 • Writing Custom SCA Policies

Teaches authoring YAML-based SCA policy files for organization-specific requirements. Students write and deploy a custom policy targeting a specific application.

Lesson 1 • Active Response Configuration

Configures automated responses such as IP blocking and script execution triggered by alerts. Students test active response actions in a safe lab environment.

Lesson 2 • Alert Correlation and Aggregation

Uses composite rules and alert correlation to detect multi-step attack patterns. Students build a correlation rule that chains multiple alert conditions.

Lesson 3 • Incident Investigation Workflow

Guides a structured investigation from initial alert triage to root cause analysis. Students document findings using a standardized incident report template.

Lesson 4 • Simulated Attack Scenarios

Runs controlled attack simulations to validate detection coverage and response speed. Students identify gaps and tune rules based on simulation outcomes.

Lesson 1 • Wazuh Indexer Cluster Tuning

Covers shard allocation, index lifecycle management, and query performance optimization. Students configure index policies to manage storage growth.

Lesson 2 • Wazuh Cluster Architecture

Explains master and worker node roles, synchronization, and failover behavior. Students deploy a two-node cluster and verify event distribution.

Lesson 3 • Performance Tuning and Optimization

Addresses manager queue sizing, analysis thread tuning, and agent event throttling. Students benchmark and optimize a high-volume Wazuh deployment.

Lesson 4 • Backup, Recovery, and Upgrades

Covers backup strategies for configuration, rules, and index data, plus upgrade procedures. Students execute a manager upgrade with zero alert data loss.