Hi dear members of wazuh.

[kamran ali]

i am new to use wazuh and in learning phase of wazuh as soc analyst i am requesting to here seniors members plz guide me how to write bes agent.conf file for windows 10 endpoints and linux groups ubuntu plz if someone have production ready monitoring agent.conf file please share me.

thank you 

[Md. Nazmur Sakib]

Hi kamran,

As you are new to Wazuh. I suggest you deploy Wazuh in a test environment if possible.

You can check
Virtual machine (VM)

Or
Quickstart

Next, you can check the Proof of Concept guide and implement those to understand basic configurations of Wazuh.

Next, check these documents to get to know about the different capabilities of Wazuh.

Check the document to understand the configuration of the agent local configuration (ossec.conf)

Let me know if you need any further information.

[kamran ali]

Thanks MR 
Md. Nazmur Sakib i have already done deploymant and creating servers now i in the phase of where i want to do custom configration where i can get better security results.

i can get results via good configration can you share me full configration and rules.
thank you for your response.

[Md. Nazmur Sakib]

What kind of custom configuration you would like to do will depend on what type of logs you want to monitor from your endpoints. Next, based on what you want to see as alerts, you need to write custom decoders and rules.

The customization depends on the organization's needs. It can be very different from one organization to another. So it is difficult for anyone to share a custom configuration that will be the best fit for you. It will depend fully on your needs.

So I will suggest first making a roadmap of what kind of logs/events you want to monitor, and next adjusting the configuration to forward the logs to Wazuh Manager, and after that making custom decoders and rules if needed.

You can check our blog posts and implement different security monitoring suggestions we post.
https://wazuh.com/blog/category/engineering/


Let us know if you need help with any specific configurations or use cases.