Wazuh
Log and alert platforms (SIEM) — Wazuh
What is this product?
A platform that combines endpoint monitoring (through an agent on each machine) with log collection and analysis. Each rule carries a numeric Level, and search uses Lucene syntax.
About the company
An open-source project that grew out of OSSEC, backed by the company Wazuh. It is free to deploy, which is why many learners build it in a home lab.
What does an analyst do inside it?
- Opens the alert and reads the rule name and its level.
- Searches in Lucene syntax such as `agent.name: FIN-WS-014`.
- Follows the machine through its registered agent name.
- Runs an Active Response to block an address, or tunes the rule when the alert is noise.
Its search language
These examples are written in the syntax the product itself accepts.
- agent.name: FIN-WS-014
- data.status: failure and data.srcuser: "admin"
The field names it uses
- rule.groups
- agent.name
- data.srcuser
- data.srcip
- data.dstip
- rule.description
- data.status
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
The best choice for a zero-cost personal lab, and genuinely used by many small and mid-sized companies.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.