Practical Security Investigation with Splunk, Wazuh, Osquery

Explore log analysis fundamentals, including log structure, timestamps, severity, and sources across Linux and Windows, using tools like Splunk and Wazuh for incident detection and forensics.

Analyze linux logs in the /log directory, including auth.log, kernel log, and syslog, to support forensics, threat hunting, and detection of brute force and unauthorized access.

Analyze network logs from firewalls, routers, and switches to track traffic, detect scans and brute force attempts, and support blocking blacklisted IPs and unusual outbound transfers.

Define the lab's minimum hardware and software requirements for Windows or Mac hosts and Ubuntu-based components. Set up Splunk, Wazuh, and Kali on Ubuntu, with VMware or VirtualBox virtualization.

Learn to download and install Oracle VirtualBox, set up Ubuntu VMs, and prepare lab environments for Splunk, Wazuh, and Kali Linux.

Set up Ubuntu 22.04 in a VirtualBox VM named Lab agent to host Splunk, Wazuh, and Kali installations, with 1 CPU, 2 GB RAM, 20 GB disk, and OpenSSH server.

Install Splunk on Ubuntu, update apt, download with wget, install via dpkg, start Splunk, set admin user and password, and bind to 0.0.0.0 for access on port 8000.

Set up Wazuh server and agent on Ubuntu 22.04 using the quickstart curl, then verify the dashboard and open required ports (443, 80, 1514–1516) for onboarding.

Set up a Kali Linux attacker machine in VirtualBox by downloading the Kali ISO, allocating memory and disk, and completing a graphical install with hostname and user credentials.

Discover how a security information and event management (SIEM) tool collects and normalizes logs from devices and servers, aggregates data, and enables threat detection, investigation, and real-time response.

Explore Splunk’s SIM features, including data indexing, primary data search, alerts, save searches, dashboards, and the Splunk marketplace with apps, forwarder, indexer, and search head components.

Explore Splunk in a practical environment, navigating the search and reporting app, adding data sources, configuring forwarders, and building dashboards, reports, and alerts.

Learn how to ingest logs from firewalls and endpoints into Splunk with forwarders and indexers, then use Splunk Enterprise Security and Splunk Security Essentials for correlation, alerts, and dashboards.

Explore fields in Splunk search, including selected fields and interesting fields, and understand source and source type metadata such as Palo Alto and Fortinet traffic, with filtering by destination IP.

Learn to use the head command to view the latest ten events in a firewall index, then refine output with limit and table to summarize data.

Use the stats command to aggregate data, compute counts by source IP, rename fields with as, and apply value to pair source and destination IPs for failed logins.

Learn to use the time chart command to visualize trends over time by counting data per source IP address, enabling security analysts to spot spikes and exfiltration in network traffic.

Use the dedup command to create a table with source and destination IPs (and ports), then deduplicate by source IP or by source-destination IP pairs to obtain unique entries.

Investigate ssh brute force attacks with splunk on ubuntu server, analyzing failed password events to identify the user with the most attempts, and the related IP address and counts.

Learn Wazuh, an open source security monitoring platform that detects threats and file integrity changes. Integrate threat intelligence, automate operations, and perform incident response, with siem and xdr capabilities.

Explore the Wazuh demo: navigate the dashboard modules, view security events and alerts, apply filters, inspect agents, and leverage rules, decoders, MITRE mapping, and compliance tagging for unified security monitoring.

Learn to detect unauthorized file modifications with Wazuh by configuring file integrity monitoring on Ubuntu and Windows agents and viewing real-time events in the Wazuh dashboard.

Enable vulnerability detection in wazuh for ubuntu, restart the wazuh manager, and review detected vulnerabilities on the dashboard by severity. Use CVE lookups and csv export to share findings.

Detects SQL injection attempts using wazuh by analyzing curl-based requests and triggering rule 3103, logging attacker IP, URL, method, and full log message.

Learn to enumerate installed Linux software with osquery, identify unapproved tools like nmap, verify install times, and check active processes to detect potential compromises.

Identify recently created user accounts on a Linux system using osquery queries, flag suspicious usernames and accounts with unusual shells or sudo rights, and verify active sessions to assess persistence.

Detect malware making outbound connections from a temp directory using osquery queries to flag established sockets. Correlate process IDs and remote addresses to identify potential data exfiltration.