Complete Wazuh course! From basic to advanced v2026 28+hours

Install VirtualBox on Windows, download the cross-platform virtualization tool, and create a new virtual machine using an ISO image, then install the extension pack for USB and camera support.

Install Rocky Linux 9 in a virtual box, using ISO images and bridge networking; configure RAM, CPU, and disk, and set up a non-root user with SSH access.

Learn to use SSH from Windows with PowerShell 7, leveraging built-in OpenSSH, no PuTTY needed, and install options for MSI or ZIP, testing on Mikrotik and Linux with IPv4/IPv6.

Install a wazuh server with an automatic shell script on Red Hat based systems like Rocky Linux. Disable firewall and SELinux, select a version, and configure the dashboard and agents.

Master the advanced manual installation of a Wazuh server on a single host, configuring index, manager, dashboard, OpenSearch, Filebeat, SSL certificates, and security settings.

Get a quick, preconfigured wazuh installation using the ova in VirtualBox, with the wazuh server, dashboard, and index ready to use for study and agility, not for production.

Install the Wazuh agent on Windows via GUI or CLI to monitor Windows servers, configure the server IP, start the service, and verify endpoints from the Wazuh server.

Install the wazuh agent on linux systems, covering ubuntu and debian steps, including importing gpg keys, configuring repository, handling IP address variables, and verifying service status.

Plan upgrades by reviewing release notes, backups, and system requirements; test in virtual machines before production, and follow the official update guide to validate plugins and integrations.

Perform a careful upgrade of the Wazuh server by following the official documentation for your version, managing repositories and plugins, stopping services, upgrading components, and validating compatibility before restarting.

Upgrade the Wazuh agent easily from the dashboard, in batches, or agent by agent, and confirm updates across Linux and Windows via the terminal or server commands.

Create and manage groups for Windows and Linux servers to centralize agent configurations by version, then apply, synchronize, and monitor changes across all agents.

Build a Wazuh cluster on Linux with a master, multiple workers, and a proxy to enable load balancing, plus a dashboard and agent policy synchronization across five machines.

Install and configure the Wazuh indexer across master and worker nodes, generate and distribute certificates, set up the OpenSearch index, and test secure, high-availability cluster communication.

Install and configure the Wazuh manager on the master node, set up filebeat, templates, certificates, admin user, and define a cluster with IPs and ports for master and workers.

Install and configure the Wazuh dashboard, secure it with certificates, align with the master and agents, set YAML and IPs, and validate connections and load balancing across nodes.

Learn how haproxy-based proxy load balancing in a Wazuh cluster distributes agents across masters and workers, enabling high availability, automatic failover, and secure certificate-enabled communication.

Explore malware concepts and real-time detection with Wazuh, covering viruses, worms, trojans, ransomware, spyware, and rootkits, plus integrations with VirusTotal and IARA.

Learn to link antivirus logs to Wazoo by collecting Windows Defender logs via Event Viewer, configure the Azure agent, restart Wazoo, and view alerts on the dashboard.

Master Windows file integrity monitoring with FIM: configure real-time monitoring, hash verification, and change reports for system32 and documents, and review alerts and logs via the Wazoo service.

Explore optional settings in the wazuh agent, including level resource monitoring, priority process tuning, and storage and synchronization options for Linux and Windows.

Detect and automatically remove malware via VirusTotal integration with the Wazoo agent on Windows and Linux, using Python and shell scripts.

Learn how Sysmon detects fileless malware by monitoring processes, network connections, and file changes with Wazuh. Use an API to visualize attacks and set Sysmon alerts.

Learn how Wazoo decoders interpret raw logs from Linux, Windows, and network devices into a standardized format. Customize or create decoders using XML, parent and child structures, and regex.

Learn to monitor Mikrotik logs using a Linux RxLog agent and Wazoo decoders and rules, bridging Mikrotik, Linux, and Wazoo for centralized alerts and secure log forwarding.

Explore how to enable and configure log data collection in Wazoo, enabling archives, dashboards, and filebeat to capture and index alerts and all events for effective threat hunting.

Explore the MITRE ATT&CK structure and map tactics and techniques to Wazoo rules for threat hunters, across enterprise, cloud, and mobile environments.

Emulate attacker techniques using the open-source Invoke-Atomic platform to simulate attacks from the ATT&CK framework, install and run tests, and verify alerts in Wazuh with custom local rules.

Explore command monitoring with Wazoo, collecting endpoint command data, using decoders and rules, and generating netstat-based alerts across Windows and Linux.

Automate IP abuse reporting and blocking by connecting abuseipdb to wazuh, monitoring SSH and RDP logs, and using API keys to create interconnections and rules.

Learn how to detect PowerShell abuse techniques using Wazuh by enabling detailed PS command logs, creating custom rules, and monitoring Windows activity for suspicious PowerShell usage.

Learn to detect Windows malware persistence techniques using wazoo, including scheduled tasks, account creation, services tampering, registry keys, shimming, and startup key changes, with sysmon monitoring and practical simulations.

Integrate MISP with Wazuh using API to share threat intelligence. Leverage indicators of compromise, including IP addresses and domains, within an open-source malware threat intelligence community.

Study defense evasion techniques with Wazuh, including disabling security tools, tampering with event logs, obfuscating code, and abusing trusted system tools, with hands-on detection of bits tasks and registry changes.

Strengthen windows endpoint security by following CIS-based best practices, improving passwords, disabling unnecessary services, and running a PowerShell script to raise the security score.

Detect DNS tunneling attacks by monitoring DNS traffic with tcddump and wazoo, spotting high-entropy subdomains, long labels, and encoded data on port 153 to reveal exfiltration and command-and-control activity.

Explore vulnerability detection with known CVEs, using two trusted feeds and the Wazuh vulnerability center to monitor, scan, and update Windows and Linux endpoints.

Assess security configurations using a predetermined set of best practices, focusing on misconfigurations and vulnerabilities across Windows, Linux, macOS, and Docker with CIS benchmarks.

Create a custom SCA in wazuh by authoring yaml policies to monitor a test file, verify enforcement on windows and linux, and iterate by restarting services and refreshing the dashboard.

Explore how Waza supports regulatory compliance through log analysis, file monitoring, and incident responses using rule decoders across PCI-DSS, GDPR, and health information standards.

Demonstrates practical pci dss compliance with file integrity monitoring using linux audit and wazuh, watching critical files and directories for unauthorized changes and real-time alerts.

Explore suricata, a free open source network intrusion detection and prevention system, and learn to integrate it with the wazuh platform on Kali Linux for network monitoring, including promiscuous mode.

Install and configure Suricata and the wazuh agent on linux to monitor your whole network in real time, using community rules and json alert logs.

Test DVWA on Kali Linux to practice web vulnerabilities, including SQL injection and XSS reflect. Observe Suricata alerts feeding into Wazuh as you install and monitor the setup.

Explore incident response automation in the complete Wazuh course, using pre-programmed rules and active responses to contain, block malicious traffic, deactivate compromised accounts, and isolate threats.

Learn how to detect and block RDP brute-force attacks using wazuh active response, firewall rules, and netsh blocks, demonstrated with Kali Linux and Hydra testing.

block ssh brute force attacks on linux by monitoring logs and automatically blocking attackers with iptables drop via an active response.

Wazuh helps detect and prevent ransomware on Windows, exemplified by black switch simulations, using VirusTotal integration, Sysmon monitoring, and offline backup to safeguard encrypted data.

Monitor usb ports on Windows machines with wazuh to detect, authorize, or block usb drives; enable PNP auditing and create custom rules for authorized vs unauthorized devices.

Learn to detect and authorize usb devices on Linux using a udev rule, a shell script, and Wazuh agent integration for centralized analysis of authorized vs unauthorized devices.

Learn how to configure email alert notifications in Wazuh by routing alerts through a postfix mail relay, testing with Yahoo smtp, and setting alert levels to control inbox noise.