Discussion on "Setting Up Wazuh as Your SIEM on Debian 12 & Proxmox: A Step-by-Step Guide"

Maik Ro · 2023-08-25T13:07:03.074Z

Welcome to the SIEM Homelab Series - We will walk through the process of installing your very own instance of Wazuh as a Security Information and Event Management System (SIEM). If you want to do threat research or learn more about the ins and outs o...

Hi, first of all congratulations on the guide; I have a problem following it; in my proxmox I made sure that the downloaded ISOs go to an NFS folder on my synology nas, while my proxmox is on a mini PC. Here I am going to put the various VMs and CTs on an LVM type disk, but here in the creation of the VM (following your guide) I noticed that in the part relating to the disks section, precisely in the area relating to the format, everything appears to me in gray not clickable and therefore I have no way to select the QEMU image format. How can I solve it? Thanks for your possible response.

Michele Dal Bosco (Michele) ok let me know if it works out 🤞

Maik Ro Hi, it worked even without using the QEMU image format for the disk; could it be that maybe in that case it would have performed better? Now I have to understand why if in the agent (I tried the one for a Debian ct) during the installation phase, despite telling it which group to add and what name to give it, it seems that the command (WAZUH_AGENT_GROUP='SERVER' where server is the name of the group WAZUH_AGENT_NAME='AdGuard-debian' where in this case the name is AdGuard-debian) is ignored since it puts the agent in the default group (I created a couple of them, one for the servers and one for any client in lan), ditto for the name that takes for its own sake that of the hostname. Therefore it is up to (as far as the group is concerned) to issue the appropriate shell command on the "server" side of wazuh for each agent to be moved to the group and then the same to remove this agent from the default group.

Michele Dal Bosco (Michele) Unfortunately, we will not know if it would perform better without performance testing and I think that is out of scope for my home lab.

If possible I would encourage you to test it, but again not a mandatory experience.

I am glad you got it to work :) let me know how the rest of the journey is going!

Discussion

Setting Up Wazuh as Your SIEM on Debian 12 & Proxmox: A Step-by-Step Guide

Responses(1)

Recent in Forum

Search Hashnode

Setting Up Wazuh as Your SIEM on Debian 12 & Proxmox: A Step-by-Step Guide

Responses(1)

Recent in Forum