Intrusion Detection System (IDS) Using Wazuh

Organizations of all sizes are increasingly concerned about protecting their digital landscape. With technology growing and digital systems becoming more important, cyber threats are escalating rapidly. Organizations must take a proactive approach toward cybersecurity and deploy mechanisms and appropriate visibility controls that not only prevent but also detect threats or intrusions. The main goal of prevention techniques is to keep threats from getting into a network or system. Like deploying perimeter security solutions such as firewalls, intrusion prevention system (IPS) infrastructure, visibility and control, and, most importantly, endpoint protection and insider threats. They intend to put up barriers that make it impossible for bad people to get in or execute any cyber-attacks.

Detection techniques, along with preventive measures, involve keeping an eye on systems all the time for any signs of compromise or strange behavior and taking the required steps to mitigate the execution of reported malicious activity/behavior. One of the popular tools for this purpose is an intrusion detection system (IDS). Wazuh can help organizations detect potential threats or ongoing attacks, and an IDS also allows a security team to enable the early detection of possible breaches or suspicious activity, and, as a result, the security team can quickly respond to mitigate potential damage. Wazuh is a popular IDS result, which works on various levels including host-level visibility along with the capability to collect, aggregate, index, and analyze logs from various sources at a perimeter and infrastructure level; it also offers end-user activity monitoring solutions and protection. It provides a ton of features, including log collection. In addition to log collection, it has various inbuilt modules including vulnerability management, file integrity, malware detection, automated incident response, and various external integrations. Another open source popular IDS/IPS solution is Suricata, which works on a network level that helps the security team detect anomalous network behavior. In this book, we get hands-on with Wazuh capabilities and features, however, in this chapter, our focus will be on integrating Suricata IDS/IPS with Wazuh. This will help us detect any network anomalous behavior.

In this chapter, we will learn the following:

• What is an IDS?
• Configuring an IDS on Ubuntu and Windows Server
• Getting started with Wazuh and Suricata
• Detecting network scanning probes
• Testing web-based attacks with Damn Vulnerable Web Application (DVWA).
• Testing a network-based IDS (NIDS) using tmNIDS