Set up and configure Wazuh for detection and response. This pathway combines short explanations with hands-on lab exercises you can run on your own machine.
What you will learn
- Module 1 — SIEM and XDR concepts
- Module 2 — Wazuh architecture: indexer, server, dashboard
- Module 3 — Installing a single-node lab
- Module 4 — Deploying agents on Linux and Windows
- Module 5 — Log collection and decoders
- Module 6 — Writing custom rules
- Module 7 — File integrity monitoring
- Module 8 — Vulnerability detection module
- Module 9 — Mapping alerts to MITRE ATT&CK
- Module 10 — Active response
- Module 11 — Dashboards and reporting
- Module 12 — Capstone: detect a simulated attack
Before you start
Set up an isolated lab (a virtual machine or a free practice platform). Only test systems you own or have explicit written permission to assess.