-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Security Monitoring with Wazuh
By :

The most effective way to collect information about an endpoint is to run specific commands on the given endpoint, such as netstat
(for network connections on Windows), ps
(to collect process information from Linux machines), and so on. This information plays a vital role in collecting IOCs and running a successful threat-hunting program. The good news is that Wazuh has a built-in feature to monitor the output of specific Windows/Linux commands and show that output as log content. In this section, we will learn the following:
Wazuh runs commands on the endpoints using the Command and Logcollector modules, and then sends the results to the Wazuh server for examination. The following steps describe the process of command monitoring.
The process...