Wazuh agent on Pfsense

[Tal Bar-Or]

Hello,

I am looking into integrating Pfsense with Wazuh to log suricata and its own firewall logs

Anyone had success installing agent on Pfsense , if yes please share procedure will be appreciate.

Thanks

[John Soliani]

Hello,

  Thanks for using Wazuh and posting in our community channels!

  It is possible to install an agent (FreeBSD based operating system) on pfSense, you may follow this guide to deploy it:

• Install Wazuh agent from sources

  You'll probably also need to configure pfSense to forward logs via syslog to the Wazuh manager and collect them by using Remote Syslog. Here's how to do it:

• Remote syslog

  Wazuh's stock package includes rules and decoders to understand, categorize and enrich events from pfSense, but new rules and decoders can be added if you wish to add more context to the events received, just check out documentation on how to achieve this here:

• Custom rules and decoders

Hope this helps,

Kind regards,
John Soliani.-