Wazuh XDR from Beginner to Expert

Install Ubuntu Linux on a virtual machine using Oracle VirtualBox, configure memory and disk, choose language and network, complete interactive installation, then install guest additions for better display.

Install Wazo on Ubuntu Linux using an all-in-one setup, update packages, install curl, run the installer, reboot to verify proxies, then access the Wazo dashboard with the admin credentials.

Download Windows Server 2019 from the Microsoft Evaluation Center, install it in a VirtualBox, configure the VM, set the administrator password, and install the Guest Additions.

Configure Active Directory and DNS on Windows Server by installing roles, promoting a domain controller for a new forest named test.com, and setting DNS forwarders to 8.8.8.8 and 1.1.1.1.

Install the wazuh agent on Windows using CMD or PowerShell with admin rights, or deploy from the wazuh dashboard, start the agent, and review vulnerabilities, alerts, and MITRE ATT&CK data.

Create a host-only internal network for wazuh and Windows servers, set manual IP addresses (10.0.0.2 and 10.0.0.1 as gateway), and verify connectivity with a ping.

Configure windows logs via group policy and advanced audit policies, add app, sysmon, defender, and powershell modules to wazuh agent, forward to wazuh server, then restart.

Discover Sysmon, a Windows system service that logs rich telemetry for deep visibility and incident response, enabling threat hunting and integration with SIEM and XDR.

Install Sysmon on Windows server by downloading the Sysmon zip and a GitHub configuration file, extracting them, and running the installer in PowerShell. Verify it starts automatically by inspecting services.

Configure VirusTotal integration with the Wazoo server to automatically scan suspicious downloads using Yara and delete files via an automation rule, and monitor results in the Wazoo dashboard.

Wasu decoders parse logs from endpoints and devices, extracting fields such as source and destination, usernames, event IDs, and actions, while decoder hierarchy refines parsing via parent and child decoders.

Create your first decoder in Wazoo using decoder syntax and regex, define pre-match and field orders, test with sample logs, and explore hierarchical decoding for dynamic logs.

Create and test your custom rule in Wazoo by organizing local rules, decoders, and groups. Configure rule ID, level, status, and description, then verify with a rule set test.

Set up the Wazo MCP server as a bridge between the Wazo scene and the Cloud AI agent, verify services, install Rust, configure API access, and test agents and alerts.

Analyze Windows alerts with the Wazuh MCP by running port tests, inspecting suspicious file activity, reviewing VirusTotal detections, and applying active response containment within cloud-connected threat intelligence and threat hunting.

Celebrate your progress in Wazuh XDR from beginner to expert and reflect on cybersecurity learning. Invite feedback, ask questions, and stay connected to advance your knowledge and career.