Skip to main content

Wazuh on-prem getting started guide

Tamim Habib
  • Updated

Tip

This article was accurate at the time of writing, but changes happen. If you find the instructions are outdated, leave a description in the comment field below and let us know!

Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech.

By following these steps, you create a user account for Expel which keeps Expel activity separate from other activity on the Wazuh console.

Note

This guide is for on-premises installations of Wazuh. For cloud installations, see the Wazuh cloud getting started guide.

Step 1: Create an account in Elasticsearch

  1. Open the Elasticsearch console and select Stack Management from the Management menu.

  2. Select Users and click Create user.

    Screen Shot 2021-06-08 at 3.49.24 PM.png

    • For Username type expel_svc.

    • Set the Password.

    • For Full name type Expel Service Account.

    • For Email type soc+<Your_Organization_Name>@expel.io.

      Tip

      Yes, the "+" sign is part of the email address (as in soc+megacorp@expel.io) and it's important. Click here to find out why.

    • For Roles select kibana_admin.

  3. Click Create user.

Note

Note the Elasticsearch server address and port number (the default port is 9200) for later use.

Step 2: Configure the technology in Workbench

Now that we have the correct access configured, we can integrate Wazuh with Workbench.

  1. In a new browser tab, login to https://workbench.expel.io.

  2. On the console page, navigate to Settings and click Security Devices.

  3. At the top right of the page, click Add Security Device.

  4. Search for and select Wazuh.

    mceclip1.png

  5. Enter your user credentials as follows:

    mceclip3.png

    • For Where is your device? select On-prem.

    • For Assembler select <?>.

    • For Name and Location enter Wazuh and <?>.

    • For Username and Password enter the username and password created in Step 1.

    • For Server address enter the server address with the port number.

    • For Is this a Wazuh cloud instance? enter <?>.

  6. Click Save.

After a few minutes, refresh the Security Devices page and you see your device status reporting as Healthy, or if there is an issue, you see details of what the issue may be.

To check if alerts are coming through, navigate to Alerts on the console page. Click the icon in the upper right to switch to grid view, then check the list for device alerts.

Related articles

Comments

0 comments

Please sign in to leave a comment.