{"id":1227,"date":"2025-01-30T13:51:27","date_gmt":"2025-01-30T12:51:27","guid":{"rendered":"https:\/\/www.cipv6.de\/worp\/?p=1227"},"modified":"2025-01-30T13:55:50","modified_gmt":"2025-01-30T12:55:50","slug":"getting-started-with-wazuh-setting-up-your-lab-environment-for-xdr-and-siem","status":"publish","type":"post","link":"https:\/\/www.cipv6.de\/worp\/index.php\/2025\/01\/30\/getting-started-with-wazuh-setting-up-your-lab-environment-for-xdr-and-siem\/","title":{"rendered":"Getting Started with Wazuh: Setting Up Your Lab Environment for XDR and SIEM”"},"content":{"rendered":"\n

<\/p>\n\n\n\n

In today’s cybersecurity landscape, having a robust and flexible security information and event management (SIEM<\/a>) system is crucial.
Wazuh<\/a>, an open-source security platform, offers comprehensive solutions for threat detection, integrity monitoring, incident response, and compliance.<\/p>\n\n\n\n

Wazuh has an interesting history. In 2015, the Wazuh team decided to fork OSSEC, an open-source host-based Intrusion Detection System (IDS), to expand its core functionalities with additional features, enhancements, and a user-friendly interface.
Wazuh has grown significantly since its inception. It is now a comprehensive, open-source security platform that provides unified XDR (Extended Detection and Response) and SIEM (Security Information and Event Management) capabilities. The platform is designed to monitor infrastructures, detect threats, respond to incidents, and ensure regulatory compliance.

This blog will guide you through setting up Wazuh in a lab environment, focusing on its basic capabilities in Extended Detection and Response (XDR<\/a>) and SIEM<\/a>.
Whether you’re a cybersecurity professional or an enthusiast, this step-by-step guide will help to get started with Wazuh to secure your systems effectively.
We start with the defaults to make the lab-setup not more complex as necessary.

My Lab-env is as follows:<\/p>\n\n\n\n

Host<\/strong><\/td>IP<\/td>OS<\/td><\/tr>
Wazuh-Server<\/td>10.50.100.76<\/td>Ubuntu 24 LTS<\/td><\/tr>
Wazuh-Agent<\/td>10.50.100.110<\/td>RHEL 9<\/td><\/tr>
Wazuh-Agent<\/td>10.50.100.111<\/td>RHEL 9<\/td><\/tr>
Wazuh-Agent<\/td>10.50.100.201<\/td>Windows<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n

Table of Contents<\/p>\n