Syslog and Wazuh - Let's Build A Host Intrusion Detection System

Join me as we configure your Wazuh Manager to receive Syslog output. Receive your Firewall logs! Let's deploy a Host Intrusion Detection System and SIEM with free open source tools. Join me as we explore and learn together.

[TheMeshal]

Thank so mush, can you make a video to integrate pfsnes firewall and Email server

[huseyinozer]

Hello first of all thanks for video,
Syslogs from Synology do not appear on wazuh. When I listen to port 514, I see messages coming, but the messages do not appear in the discover section. It was written in some forums that it could not be solved because it came in rfc3164 message format. When I write the log to the test decoder section, I get the error "decoder not found". Any idea?

[AnthonyElabed]

Amazing video, thank you so much, you are a life saver for a project I'm working!! For linux users remember that the logs on your client are stored in /var/log/syslog

[iDjDepp]

Great video, really helped set up the transmission. You mentioned transferring data from network devices such as Cisco. Maybe there are ready-made dashboard templates and how to process this data?

[muharaveen]

Hi! I'm having the issue "Kibana service is not ready yet" . Am I doing something wrong?

[Samran_Shahzad]

Hi, anyone tell me that how can I confirm that my linux rsyslog is coming in wazuh dashboard how to check that?? How to configure rsyslog of kali linux without adding as an agent??

[brunobustos]

como estas muy buen video, pero quiero saber como puedo integrar un waf imperva con wazuh por medio syslog, para que los eventos se vean en el dashboard.

[streetechco]

dear taylor, what happen if the server its full with the logs, how do you delete the logs that are into the wazuh server?

[lamarlewis]

Great work on the video. Thank you for saving me some time! 😊

[MrBitviper]

thanks for the concise and clear video
much appreciated

[jwmxweh]

Hope for next video, fortigate sync with wazuh

[chinatu]

Great video, but do you have a video that integrates with edr solutions

[DannyDi]

As far as I know, syslogs are sent in plain text, so I guess it wouldn't be recommended to use this method when the Wazuh Server is on a hosted VM in another Network. Is there a solution to this?

[fahmi]

Do you have videos that share how to develop Wazuh SIEM dashboard?

[chadmarkley]

Great video!! I used your Docker video to get the Wazuh cluster setup and running. Works great. Question. Under Settings and Configuration, i don't seem to have the "edit configuration" option. Any idea how i can get that to show up? Having that would be SO MUCH EASIER than trying to do it from inside the docker container using VI! Thanks

[numanmaavia]

Hey open Secure, make a video how to integrate Azure Activity log onto wazuh. Thanks

[TheTT]

I am missing something... I have configured my Fortigate to forward logs to the Wazuh Manager. I see them in the Archives.json and the Archives.log. I do not see them in the dashboard of Wazuh. Following another tutorial that has since been taken down from YT, it has 2 Decoder files installed. What am I missing?

[syedomairmasood]

can you paste all the commands that are in your notepad?

[crlbzeb]

I am unable to use the public ip addresses. Like my syslog server is located on different AWS server and wazuh manager is located on different location. So how do I connect these with the public ip address. I am unable to use the public address in wazuh conf file.

[arifbudiman]

Great Video Man, thanks for the insight 😊