The Basics level assumed the default ruleset. This level changes it: you will write decoders and detection rules, bring in the log sources that matter, wire notifications and automation, and learn to keep the platform healthy as data grows.
Wazuh Configuration Guide
Thirteen lessons for the analyst or engineer who has a working install and now needs it to detect what matters in their environment. Every configuration file in this level ships in the companion repository.
- 01Write a Custom Wazuh Decoder in YAMLBuild a Wazuh 5.0 decoder from one real application log line: integration, root decoder, check, parse, normalise to the Common Schema, then test it.14 min read
- 02Write Custom Wazuh Detection Rules (Sigma YAML)Author a Sigma-YAML rule against your own decoder: level strings, selections, modifiers, MITRE and compliance blocks, the draft to custom flow, and detectors.11 min read
- 03Wazuh Log Collection: Syslog, Journald, Windows EventsConfigure Wazuh log collection on the agent: files and wildcards, journald filters, Windows event channels with XPath, command output and multi-line records.14 min read
- 04Sysmon with Wazuh for Windows TelemetryInstall Sysmon with a reviewed configuration, collect the operational channel with the Wazuh agent, and write a parent-child process rule that fires.14 min read
- 05Wazuh SCA: CIS Benchmarks and Custom PoliciesRun CIS benchmark checks with Wazuh SCA, read a failed check and fix it, then write and distribute a custom policy for your own configuration standard.11 min read
- 06Wazuh Agent Groups and Centralised ConfigurationGroups are the unit of configuration in Wazuh 5.0. Create them before enrolment, write a shared agent.conf, and understand what multi-group merging really does.10 min read
- 07Wazuh Notifications: Email, Slack, Telegram, WebhooksWazuh 5.0 sends notifications from the indexer, not the manager. Build a severity-based alerting monitor and a channel, and keep the volume survivable.10 min read
- 08Wazuh Active Response: How It Works, When to Leave It OffHow active response works in Wazuh 5.0, how to write a custom script, and the gating checklist that decides whether it should be switched on at all.11 min read
- 09Wazuh Malware Detection with VirusTotal and YARAThe Wazuh VirusTotal integration is gone in 5.0. Here is what replaces it: built-in CTI hash enrichment, KVDB hash lists, and YARA through an active response script.11 min read
- 10Wazuh Cloud Logs: AWS CloudTrail, Azure, GCP, M365Collect AWS CloudTrail, Azure, Google Cloud and Microsoft 365 logs with Wazuh 5.0, where every cloud module now lives agent-side, and why the integration must be enabled first.11 min read
- 11Monitoring Docker and Kubernetes with WazuhEnable the Wazuh Docker listener on a container host, read the events it produces, and run the agent as a Kubernetes DaemonSet using the official manifest.10 min read
- 12The Wazuh API with Python: Agents, Groups and FindingsAuthenticate to the Wazuh manager API, create groups, add agents and trigger upgrades from Python, then query findings and state on the indexer API.11 min read
- 13Wazuh Upgrade, Backup and Index RetentionUpgrade agents remotely with WPK packages, back up manager and indexer configuration, take indexer snapshots, and change the default ISM retention policies.11 min read