Custom Alert Rules in Wazuh

In the previous room, Wazuh, you learned about basic Wazuh concepts: decoders and rules. Out of the box, Wazuh has a comprehensive set of pre-configured rules, but there are still scenarios or risks unique to an organisation that these rules may not cover. To compensate for this, organisations can create custom alert rules, which is the focus of this room.

Learning Objectives

• Learn how important data is extracted from logs using Decoders
• Learn how alerts are triggered using custom Wazuh Rules
• Learn how to add new rules to extend detection capabilities
• Learn how to simulate a real-world attack to test existing rules

Prerequisites

• If you need a high-level overview of Wazuh features, visit the intro Wazuh room
• Wazuh relies on regex, so brush up by checking out the Regular Expressions room
• We'll use Sysmon logs as an example for this room, so consider the Sysmon room

Machine Access

We will interact with the Wazuh dashboard and server installed on a virtual machine for this room. Start the virtual machine in split-screen view by clicking on the green "Start Machine" button on the upper right section of this task. If the VM is not visible, use the blue Show Split View button at the top-right of the page. Leave the VM running for 5 minutes for Wazuh to finish setting up. The steps to access the dashboard and server will be given in later tasks.