Aggregating all logs from Syslog, windows event log, etc

[Steven Paugh]

Hello team,

As we work towards rebuilding our wazuh cluster I am curious if anyone has ever tried to use wazuh as a more traditional SIEM along with the OOB EDR capabilities?

My initial thought was that it wasn't possible for us to collect all logs from our endpoints for things like DNS, syslog events, etc because of the default indexes not supporting something like that.

Is there any documentation on an ask like this? Ideally it could involve something like the wazuh-alerts index handling EDR alerts from the base wazuh tool, and then another index for all logs coming from our endpoints.

Thank you,

-Steven

[Manuel Jose Cano Rojo]

Hello Steven,

If I have not misunderstood your message, I think Wazuh can perform all the functionalities you are talking about via the Syscollector module. This module retrieves all the important information about the monitored system, there are several scan types that can be run.

Let me know if you are referring to different stuff and I will try to help you as fast as I can!

Regards,

Manuel.