> For the complete documentation index, see [llms.txt](https://paul-gleason.gitbook.io/sec-350-enterprise-and-network-security-controls-1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://paul-gleason.gitbook.io/sec-350-enterprise-and-network-security-controls-1/labs/lab-3.2-wazuh.md).

# Lab 3.2: Wazuh

### Summary

During this lab we setup our Wazuh box with Wazoh and added the agent to web01.

### Wazuh Install

1. Curl install file and run it

```
curl -sO https://packages.wazuh.com/4.3/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
```

Take not of the password that is gernated in the terminal if you miss it. It's in plane text in the `wazuh-install-files.tar`

2. Navigate to the wazuh machines IP. Here you login with `wazuh|<passwd from before>`

### Wazuh Agent Setup

1. In the web gui navigate to the Agents tab

<figure><img src="https://lh3.googleusercontent.com/nkPySyaq5hGtwkh9XSJBeLqTqMDSvy5x-VCm7CcxrvqYxFWlC8DTLvK_YbaXWtx5wdSc4KKPbv2Fp2umw6R9X3o1fgvvjTvSOSkvzWyI6BUJg8_u1KGZsrFRm2tShYJO_rXTvW3yQMLBQVOPz6Ok4S0" alt=""><figcaption></figcaption></figure>

2. Fill out correct information
3. It will give you the commands to install the agent on selected machine

<figure><img src="https://lh3.googleusercontent.com/vRrQOtMTiOn1qbvQIbxWqztktgO-slxMFURdvGYQ4-HFxr47fUIKxTY3XatBk0sfQ9WIuJ5JMPCbFZgcPs_jMtjO7TnDrtABdpLt0Gzws69_jw5w9rRjn7zoO79lpF9WCYyUI6QNz687hHby74-ZYgQ" alt=""><figcaption></figcaption></figure>

4. Run that command on selected machine
5. enable and start the agent

```
sudo systmectl deamon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent
```

6. Now under the Agents tab it should populate with the machines information

<figure><img src="https://lh4.googleusercontent.com/Hj0g3qjYFYBEXXPVOsmdM9Pm-V_cN_Iw99BZnwb10V9c05zwv4FMg2BRzciboeJ2GLCeDZLa9rZ8k8A1NPOJbZb1Cp3vUCPVL3lx3m0XiXxLCCJiUUat0gx8V27LvRsbMyTVSgx3CT_iVJVTdte9dww" alt=""><figcaption></figcaption></figure>

### Wazuh Agent Config

Wazuh config files information is located in /var/ossec. The main config is /var/ossec/etc/shared/agent.conf

<figure><img src="/files/jZgxgVXSqNS6ROE5fjJx" alt=""><figcaption></figcaption></figure>

Config Documentation: <https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html>