Monitoring Vmware esxi to wazuh

[Jenny Zambrano]

Hi

I need to monitor vmware esxi servers with wazuh, I have wazuh manager. I tried the wazuh documentation, but I have not had favorable results
Can you help me with the step by step

Best regards

Jenny

[Mauricio Ruben Santillan]

Hello Jenny,

You can find this procedure fully documented here: https://wazuh.com/blog/monitoring-vmware-esxi-with-wazuh/

According to the document, in order to ingest VMware ESXi events, basically you need to:

• Configure your VMware ESXi to forward events via syslog to a Wazuh agent of yours
  
• Configure such Wazuh agent to receive syslog traffic and to forward the resulting traffic to your Wazuh manager
  
• Add related custom decoders and rules to your Wazuh manager so it can create alerts from your events.
  

The provided document explains how to configure syslog ingestion into a Linux Wazuh Agent of yours. You could also use a Windows endpoint (by installing Logstash to it) as explained here.

I hope this helps. Let me know how it goes.

[Tiago Teixeira]

Hello,

Do you know if is possible to bypass the ubuntu agent and send the logs directly to the wazuh? As we do with a firewall...

Thanks in advance 

[Tedew]

Hello,

I also ask :)
" Possible to bypass the ubuntu agent and send the logs directly to the wazuh? " ???

Thanks