Skip to content

Hands-on Wazuh Host-based Intrusion Detection System (HIDS) Deployment

Hi Peerlysters,

In this article we are going to learn how to deploy a powerful HIDS called "Wazuh"

Image Source

What is an intrusion detection system?

Intrusion detection systems are a set of devices or pieces of software that play a huge role in modern organizations to defend against intrusions and malicious activities.We have two major intrusion detection system categories:

  • Host Based Intrusion Detection Systems (HIDS): they run on the enterprise hosts to detect host attacks
  • Network Based Intrusion Detection Systems (NIDS): their role is to detect network anomalies by monitoring the inbound and outbound traffic.

The detection can be done using two intrusion detection techniques:

  • Signature based detection technique: the traffic is compared against a database of signatures of known threats
  • Anomaly-based intrusion technique: inspects the traffic based on the behavior of activities.

How to Deploy Wazuh HIDS?

According to its official website:

Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance. Wazuh is used to collect, aggregate, index and analyze security data, helping organizations detect intrusions, threats and behavioral anomalies.

Wazuh is used to collect, aggregate, index and analyze security data, helping organizations detect intrusions, threats and behavioral anomalies.

It contains the following components:

  • Wazuh server
  • Elastic Stack
  • Wazuh agent

Now let's explore how to deploy it. For the demonstration i am using a Ubuntu 18.04 VM.

sudo apt-get update

sudo apt-get installcurl apt-transport-https lsb-release gnupg2

Install the GPG key:

wget -qO - | sudo apt-key add -

Add the repository

echo "deb stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

Update the package information:

sudo apt-get update

Installing the Wazuh manager

On your terminal, install the Wazuh manager:

sudo apt-get install wazuh-manager

Once the process is completed, you can check the service status with:

service wazuh-manager status

Installing the Wazuh API:

NodeJS \>= 4.6.1 is required in order to run the Wazuh API.

sudo curl -sL | sudo bash -

and then, install NodeJS:

sudo apt-get install nodejs

Install the Wazuh API:

sudo apt-get install wazuh-api

Once the process is complete, you can check the service status with:

sudo service wazuh-api status

Installing Filebeat

apt-get install filebeat=7.4.2

This is pre-configuration to forward Wazuh alerts to Elasticsearch

curl -so /etc/filebeat/filebeat.yml

Download the alerts template for Elasticsearch

curl -so /etc/filebeat/wazuh-template.json

Download the Wazuh module for Filebeat:

curl -s | sudo tar -xvz -C /usr/share/filebeat/module

sudo vi /etc/filebeat/filebeat.yml

Enable and start the Filebeat service:

sudo update-rc.d filebeat defaults 95 10

sudo service filebeat start

Installing Elastic Stack

Elasticsearch is a powerful open source distributed, RESTful, JSON-based search engine.You can see it as a search server.It is a NoSQL database.To install elasticsearch we need to make sure that we are already installed Java.

sudo apt-get install elasticsearch=7.4.2

sudo vi /etc/elasticsearch/elasticsearch.yml node-1 [""]
http.port: 9200
discovery.seed_hosts: []
cluster.initial_master_nodes: ["node-1"]

sudo update-rc.d elasticsearch defaults 95 10

sudo service elasticsearch start

Once Elasticsearch is up and running, it is recommended to load the Filebeat template. Run the following command where Filebeat was installed:

sudo filebeat setup --index-management -E setup.template.json.enabled=false

Installing Kibana

Kibana is a Web interface for searching and visualizing logs. It is a data-log dashboard. It contains pie charts, bars, heat maps, bubble charts and scatter plots. It is an amazing solution to visualize your data and detect any unusual patterns

apt-get install kibana=7.4.2

Install the Wazuh app plugin for Kibana

sudo -u kibana bin/kibana-plugin install

sudo vi /etc/kibana/kibana.yml

server.port: 5601
elasticsearch.hosts: ["http://localhost:9200"]

sudo update-rc.d kibana defaults 95 10

service kibana start

Transform data with Logstash (Optional)

Logstash is an open source to collect,parse and transform logs.

sudo apt-get install logstash=1:7.4.2-1

sudo systemctl daemon-reload

sudo systemctl enable logstash

Download the Wazuh configuration file for Logstash

sudo systemctl restart logstash

sudo vi /etc/filebeat/filebeat.yml\</a

Configure the Filebeat instance, change the events destination from Elasticsearch instance to the Logstash instance.

Disable Elasticsearch Output:


output.logstash.hosts: ["localhost:5000"]

sudo systemctl restart filebeat

Check if Logstash is reachable from Filebeat.

sudo filebeat test output

Replace the default credentials with your desired username where myUsername is shown below to protect your Wazuh API

More information:

Open a web browser and go to the Elastic Stack server's IP address on port 5601 (default Kibana port). Then, from the left menu, go to the Wazuh App.

Click on "Add new API" and fill the API fields. If everything goes fine, you will get this main Wazuh dashboard.

To add new agent just select the OS, curl the package and install it: