# Lab 3.2: Wazuh

### Summary

During this lab we setup our Wazuh box with Wazoh and added the agent to web01.

### Wazuh Install

1. Curl install file and run it

```
curl -sO https://packages.wazuh.com/4.3/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
```

Take not of the password that is gernated in the terminal if you miss it. It's in plane text in the `wazuh-install-files.tar`

2. Navigate to the wazuh machines IP. Here you login with `wazuh|<passwd from before>`

### Wazuh Agent Setup

1. In the web gui navigate to the Agents tab

<figure><img src="https://lh3.googleusercontent.com/nkPySyaq5hGtwkh9XSJBeLqTqMDSvy5x-VCm7CcxrvqYxFWlC8DTLvK_YbaXWtx5wdSc4KKPbv2Fp2umw6R9X3o1fgvvjTvSOSkvzWyI6BUJg8_u1KGZsrFRm2tShYJO_rXTvW3yQMLBQVOPz6Ok4S0" alt=""><figcaption></figcaption></figure>

2. Fill out correct information
3. It will give you the commands to install the agent on selected machine

<figure><img src="https://lh3.googleusercontent.com/vRrQOtMTiOn1qbvQIbxWqztktgO-slxMFURdvGYQ4-HFxr47fUIKxTY3XatBk0sfQ9WIuJ5JMPCbFZgcPs_jMtjO7TnDrtABdpLt0Gzws69_jw5w9rRjn7zoO79lpF9WCYyUI6QNz687hHby74-ZYgQ" alt=""><figcaption></figcaption></figure>

4. Run that command on selected machine
5. enable and start the agent

```
sudo systmectl deamon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent
```

6. Now under the Agents tab it should populate with the machines information

<figure><img src="https://lh4.googleusercontent.com/Hj0g3qjYFYBEXXPVOsmdM9Pm-V_cN_Iw99BZnwb10V9c05zwv4FMg2BRzciboeJ2GLCeDZLa9rZ8k8A1NPOJbZb1Cp3vUCPVL3lx3m0XiXxLCCJiUUat0gx8V27LvRsbMyTVSgx3CT_iVJVTdte9dww" alt=""><figcaption></figcaption></figure>

### Wazuh Agent Config

Wazuh config files information is located in /var/ossec. The main config is /var/ossec/etc/shared/agent.conf

<figure><img src="https://3273291826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2AKOZN7QAJ7f0bP5MzKF%2Fuploads%2FpUgyIeVtDFe0JScLUHND%2Fimage.png?alt=media&#x26;token=e7924783-88fb-4670-907b-d27cb31914e7" alt=""><figcaption></figcaption></figure>

Config Documentation: <https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://paul-gleason.gitbook.io/sec-350-enterprise-and-network-security-controls-1/labs/lab-3.2-wazuh.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.