Set up Wazuh & TheHive for threat detection & case management
PreviousInstall & configure Sysmon for deep Windows event loggingNextExecute Mimikatz & create detection rules in Wazuh
Last updated
Last updated
Wazuh is a free and open-source security platform that integrates Extended Detection and Response (XDR) and Security Information and Event Management (SIEM) capabilities. It offers comprehensive protection for endpoints and cloud workloads, enabling organizations to detect and respond to threats effectively.
Key Features of Wazuh:
Intrusion Detection: Monitors systems for signs of unauthorized access or malicious activity.
Log Data Analysis: Collects and analyzes logs from various sources to identify potential security incidents.
File Integrity Monitoring: Tracks changes to critical files and directories, alerting administrators to unauthorized modifications.
Vulnerability Detection: Identifies known vulnerabilities in software and hardware components within the network.
Configuration Assessment: Evaluates system configurations to ensure compliance with security policies and standards.
Incident Response: Provides tools and capabilities to respond to and mitigate security incidents promptly.
Regulatory Compliance: Assists organizations in meeting compliance requirements by providing necessary security controls and reporting tools.
Cloud Security: Offers monitoring and protection for cloud-based infrastructures, ensuring security across various environments.
Wazuh's architecture consists of lightweight agents deployed on monitored systems and a centralized management server that processes and analyzes data received from these agents.
Let's start by installing Wazzuh:
Finally, we will access the Wazuh dashboard.
Next, we need to configure Wazuh by setting up a new agent.
We need to put the IP address of the machine where Wazuh is installed.
Next, execute the following command on the Windows machine where you intend to install the Wazuh agent.
Next, we need to initiate the Wazuhsvc service.
Next, we need to modify the ossec.conf file to configure it for forwarding Sysmon logs to Wazuh.
I only need to forward the Sysmon logs, nothing else.
Next, restart the Wazuh service.
Now, let's verify on the Wazuh dashboard whether the Wazuh agent is successfully sending Sysmon events.
TheHive is an open-source Security Incident Response Platform (SIRP) designed to assist Security Operations Centers (SOCs), Computer Security Incident Response Teams (CSIRTs), and Computer Emergency Response Teams (CERTs) in efficiently managing and responding to security incidents. It offers a collaborative environment where security professionals can analyze, track, and resolve incidents effectively.
Key Features of TheHive:
Case Management: Create and manage cases with detailed information, including tasks, observables, and logs.
Collaboration: Multiple users can work on the same case simultaneously, promoting teamwork and efficient incident handling.
Integration: Seamlessly integrates with other security tools like MISP (Malware Information Sharing Platform) and Cortex for automated analysis.
Alert Management: Ingest alerts from various sources, enabling quick triage and prioritization.
Customizable Dashboards: Visualize incident data and track performance metrics through user-defined dashboards.
TheHive is built to be scalable and can be deployed as a standalone node or in a clustered environment, depending on organizational needs.
Installation Guid: https://docs.strangebee.com/thehive/installation/step-by-step-installation-guide/#installation
Now, let's install TheHive.
First, we need to install the required dependencies.
TheHive requires Java 11, so let's install Amazon Corretto 11 with the following commands:
TheHive uses Apache Cassandra as its database. Let's install it as follows:
TheHive requires Elasticsearch for data indexing. Let's install Elasticsearch 7.x with the following commands:
Additionally, let's add TheHive's repository and proceed with the installation.
Next, we need to start TheHive and enable it to run on system boot:
Now, let's edit Cassandra configuration file:
Enter the IP address of the machine where TheHive is installed.
After installation, let's start and enable Cassandra:
We also need to edit the configuration for Elasticsearch.
Next, let's start and enable Elasticsearch:
Next, we need to modify TheHive's configuration. However, before proceeding, we must update the ownership of the /opt/thp directory, assigning it to the thehive user and group.
Now, let's access TheHive by navigating to http://192.168.204.149:9000.
The default admin user credentials are as follows:
Username: admin@thehive.local
Password: secret
I encountered an authentication failure when attempting to access it. Let's work on resolving this issue.
Then restart the Elasticsearch.
Now, let's access TheHive again.
