Mahesh Tata
  • Writing
  • All Articles
  • Wazuh Tutorial
  • Topics
  • About
  • Contact
Wazuh Tutorial
Level 1 · Basics13
  1. What Is Wazuh? Architecture Explained
  2. Wazuh vs Splunk, Elastic, Security Onion and OSSEC
  3. Wazuh System Requirements and Sizing
  4. Install Wazuh on Ubuntu Step by Step
  5. Wazuh Docker Deployment
  6. Install the Wazuh Agent on Linux
  7. Install the Wazuh Agent on Windows
  8. Wazuh Agent Enrolment Explained
  9. Wazuh Dashboard Tour: Reading Your First Findings
  10. Wazuh Rules, Decoders and Severity Levels Explained
  11. Wazuh File Integrity Monitoring Setup
  12. Wazuh Vulnerability Detection Setup
  13. Wazuh Agent Disconnected or Never Connected: Fix It
Level 2 · Intermediate13
  1. Write a Custom Wazuh Decoder in YAML
  2. Write Custom Wazuh Detection Rules (Sigma YAML)
  3. Wazuh Log Collection: Syslog, Journald, Windows Events
  4. Sysmon with Wazuh for Windows Telemetry
  5. Wazuh SCA: CIS Benchmarks and Custom Policies
  6. Wazuh Agent Groups and Centralised Configuration
  7. Wazuh Notifications: Email, Slack, Telegram, Webhooks
  8. Wazuh Active Response: How It Works, When to Leave It Off
  9. Wazuh Malware Detection with VirusTotal and YARA
  10. Wazuh Cloud Logs: AWS CloudTrail, Azure, GCP, M365
  11. Monitoring Docker and Kubernetes with Wazuh
  12. The Wazuh API with Python: Agents, Groups and Findings
  13. Wazuh Upgrade, Backup and Index Retention
Level 3 · Expert14
  1. Wazuh Cluster and Distributed Architecture
  2. Wazuh Performance Tuning: EPS, Heap, Shards and Queues
  3. Multi-Tenant Wazuh for MSSPs
  4. Wazuh SSO and RBAC with Entra ID, Okta and Keycloak
  5. Cutting Wazuh False Positives Without Going Blind
  6. SOAR with Wazuh: n8n, Shuffle and TheHive
  7. Wazuh Compliance: PCI DSS, ISO 27001, SOC 2 and HIPAA
  8. Wazuh Threat Intelligence: CTI, MISP and KVDB Lists
  9. Sigma Rules in Wazuh and ATT&CK Coverage
  10. Hardening Wazuh Itself: Certificates, Exposure, Access
  11. AI-Assisted Triage for Wazuh Findings
  12. Wazuh 5: What Changes and Why It Matters
  13. Migrating Wazuh 4.x to 5: The Runbook
  14. What Wazuh Really Costs: Build vs Buy for a SOC
Reference4
  1. Wazuh Commands Cheat Sheet
  2. Wazuh Ports, Paths and Log Files Reference
  3. Wazuh Error Messages Index
  4. Wazuh Glossary
Wazuh Tutorial/Reference

Wazuh Reference

Four pages built to be bookmarked: the commands you type every day, the ports and paths that changed in Wazuh 5, every error string from the tutorial with the lesson that fixes it, and a glossary.

  1. 01Wazuh Commands Cheat SheetEvery Wazuh command worth keeping to hand: service control, manager and agent CLI tools, API one-liners and the logs to tail, all verified against the 5.0 docs.13 min read
  2. 02Wazuh Ports, Paths and Log Files ReferenceWazuh ports, install paths, config files, log files, service users and daemons, with 4.x and 5.0 in the same table so you can see exactly what moved.12 min read
  3. 03Wazuh Error Messages IndexA searchable index of every error string and symptom in this Wazuh tutorial, grouped by component, each with a one-line cause and a direct link to the fix.31 min read
  4. 04Wazuh GlossaryEvery Wazuh 5.0 term defined in two or three sentences, from agent and decoder to detector, finding, Space and KVDB, each linking to the lesson that covers it.12 min read
© 2026 Mahesh Tatamaheshtata.com