Wazuh-Agent features

[Tuaans Anh]

Hi Wazuh community,

I want to setup Wazuh-agent for Windows PC of users in my IT center.

But my Director want me to present about Wazuh-agent's feature, like: "Why do I need agent though I have a Anitivirus agent and ForeScout?"

Can you give me all of benefits when I install a wazuh-agent on my Windows PC

Thanks all 

[Federico Gustavo Caffieri]

Hello ,
To explain why you should install an agent in your Windows environment, you should explain what Wazuh is, how it works and its capabilities:
Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments.

Wazuh helps organizations and individuals to protect their data assets against security threats. It is widely used by thousands of organizations worldwide, from small businesses to large enterprises.

The Wazuh platform provides XDR and SIEM features to protect your cloud, container, and server workloads. These include log data analysis, intrusion and malware detection, file integrity monitoring, configuration assessment, vulnerability detection, and support for regulatory compliance.

The Wazuh architecture is based on the Wazuh agent, deployed on the monitored endpoints, that forward security data to a central server, and on three central components: the Wazuh server, the Wazuh indexer, and the Wazuh dashboard. For more information about the components I leave you this link: https://documentation.wazuh.com/current/getting-started/components/index.html

Wazuh agents are installed on endpoints such as laptops, desktops, servers, cloud instances, or virtual machines. They provide threat prevention, detection, and response capabilities. They run on operating systems such as Linux, Windows, macOS, Solaris, AIX, and HP-UX.

Wazuh agents run on the endpoints that the user wants to monitor. It communicates with the Wazuh server, sending data in near real-time through an encrypted and authenticated channel.

The agent was developed considering the need to monitor a wide variety of different endpoints without impacting their performance. It is supported on the most popular operating systems, and it requires 35 MB of RAM on average.

Now talking about your question, here are some key benefits of installing Wazuh agents on Windows PCs, especially in conjunction with antivirus agents and ForeScout:

- Comprehensive Log Analysis: Wazuh collects and analyzes log data from various sources on your Windows PCs, providing a comprehensive overview of system activities, user behavior, and potential security incidents.

- Intrusion Detection and Prevention: Wazuh can detect and respond to potential security threats and intrusion attempts in real-time. This is complementary to antivirus solutions, offering an additional layer of defense against sophisticated attacks.

- File Integrity Monitoring: Wazuh monitors changes to critical system files and directories, helping detect unauthorized modifications and potential signs of compromise. This is particularly useful in identifying malware that may go undetected by traditional antivirus solutions.

- Security Information and Event Management (SIEM): Wazuh acts as a SIEM tool, centralizing and correlating logs from different sources. This allows for easier analysis and detection of security incidents, providing a holistic view of your IT environment.

- Custom Rules and Policies: Wazuh allows you to define custom rules and policies tailored to your organization's specific needs. This flexibility enables you to adapt the security monitoring to the unique risks and requirements of your IT environment.

- Integration with Existing Security Tools: Wazuh can integrate with other security tools, including antivirus solutions and network security tools like ForeScout. This integration enhances the overall security posture by leveraging the strengths of each tool and providing a more comprehensive defense strategy. And you can centralize all the information into Wazuh Dashboard.

- Scalability and Centralized Management: Wazuh is scalable, allowing you to manage and monitor a large number of Windows PCs centrally. This centralized management simplifies the deployment, configuration, and monitoring of security across your IT infrastructure.

This is a summary, for more information you can consult the Wazuh documentation where you will find all the available features and how to configure Wazuh. https://documentation.wazuh.com/current/index.html

[Tuaans Anh]

Hi Caffieri,

Thanks for great answer. Can you propose me some demo or PoC of FIM? Like malware changed registry or some system file which could make critical error and wazuh will detect that?

[Federico Gustavo Caffieri]

Hello Tuaans Anh,
Of course, File Integrity Monitoring (FIM) is a crucial aspect of security, and Wazuh provides robust capabilities in this area.

The Wazuh FIM module monitors directories to detect file changes, additions and deletions. This module is useful for monitoring important files on endpoints. You can use the FIM module for several purposes such as change management processes, regulatory compliance, and detecting cyberattacks. Below are examples of some use cases of the Wazuh FIM module.

Below I share a series of use cases:

- Detecting malware persistence technique: https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/use-cases/detecting-malware-persistence-technique.html-
- Detecting account manipulation: https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/use-cases/detecting-account-manipulation.html
- Monitoring files at specific intervals: https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/use-cases/monitoring-files-at-specific-intervals.html
- Reporting file changes: https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/use-cases/reporting-file-changes.html
- Monitoring configuration changes: https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/use-cases/monitoring-configuration-changes.html

You can always consult the Wazuh documentation where you will find information about Wazuh capabilities, how to use and configure Wazuh and also use cases. https://documentation.wazuh.com/current/getting-started/index.html