Free readiness test
Home / Tool labs / Wazuh

Wazuh hands-on lab Brute force… and then a success?

An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.

SIEM & DetectionBeginnerFree live lab5 objectives
root@wazuh-manager:~#
$ tail -n 30 /var/ossec/logs/alerts/alerts.log
** Alert 1762568012.1182: - syslog,sshd,authentication_failed,
2026 Nov 08 02:13:31 (web-prod-02) 10.20.1.12->/var/log/auth.log
Rule: 5710 (level 5) -> 'sshd: Attempt to login using a non-existent user'
Src IP: 91.240.118.22  User: admin

** Alert 1762568040.1544: - syslog,sshd,authentication_failures,
2026 Nov 08 02:14:00 (web-prod-02) 10.20.1.12->/var/log/auth.log
Rule: 5712 (level 10) -> 'sshd: brute force trying to get access to the system. Non existent user.'
Src IP: 91.240.118.22   (214 failures in 4 minutes)

What is Wazuh?

Wazuh collects logs and security events from agents on servers and endpoints, decodes them, matches them against rules, raises alerts and can run active responses like blocking an IP.

1 Agents & manager

Agents on each host send logs; the manager decodes them and applies rules.

2 Decoders & rules

Decoders extract fields (user, source IP); rules decide severity, e.g. 5712 = SSH brute force.

3 Active response

Scripts that run automatically when a rule fires, such as firewall-drop for the attacking IP.

The scenario: Brute force… and then a success?

Wazuh paged the on-call analyst at 02:14 about SSH on web-prod-02. Investigate on the Wazuh manager: confirm the agent, read the alerts, see how Wazuh decoded the logs, and check what automated response is in place.

Live lab: try it now

Type the commands in the terminal below. Everything is simulated, so it's safe and legal and nothing is installed.

Step-by-step: Wazuh commands used in this lab

1List the connected agents

agent_control lists agents and their status.

/var/ossec/bin/agent_control -l
Show sample output
Wazuh agent_control. List of available agents:
   ID: 000, Name: wazuh-manager (server), IP: 127.0.0.1, Active/Local
   ID: 004, Name: web-prod-02, IP: 10.20.1.12, Active
   ID: 005, Name: db-prod-01, IP: 10.20.2.20, Active
   ID: 009, Name: FIN-APP01, IP: 10.10.20.10, Active
   ID: 012, Name: build-runner-3, IP: 10.30.0.14, Disconnected   <- why? follow up later

2Read the latest alerts

Tail the plain-text alerts log.

tail -n 30 /var/ossec/logs/alerts/alerts.log
Show sample output
** Alert 1762568012.1182: - syslog,sshd,authentication_failed,
2026 Nov 08 02:13:31 (web-prod-02) 10.20.1.12->/var/log/auth.log
Rule: 5710 (level 5) -> 'sshd: Attempt to login using a non-existent user'
Src IP: 91.240.118.22  User: admin

** Alert 1762568040.1544: - syslog,sshd,authentication_failures,

3Test how Wazuh decodes a failed SSH login

wazuh-logtest shows decoding and rule matching.

/var/ossec/bin/wazuh-logtest
Show sample output
Type one log per line
> Nov 08 02:13:59 web-prod-02 sshd[2211]: Failed password for invalid user admin from 91.240.118.22 port 50332 ssh2

**Phase 1: Completed pre-decoding.
        full event: 'Nov 08 02:13:59 web-prod-02 sshd[2211]: Failed password for invalid user admin ...'
        hostname: 'web-prod-02'   program_name: 'sshd'

4Inspect the custom correlation rule

Custom rules live in local_rules.xml.

cat /var/ossec/etc/rules/local_rules.xml
Show sample output
<group name="local,correlation,">
  <!-- Escalate: a successful login from an IP that triggered SSH brute force recently -->
  <rule id="100100" level="14" frequency="1" timeframe="600">
    <if_sid>5715</if_sid>
    <if_matched_sid>5712</if_matched_sid>
    <same_source_ip />

5Check the active response configuration

grep the active-response block in ossec.conf.

grep -A6 '<active-response>' /var/ossec/etc/ossec.conf
Show sample output
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>5712</rules_id>
    <timeout>600</timeout>
  </active-response>

Key takeaways

Install Wazuh and practise for real

curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

The all-in-one installer sets up the manager, indexer and dashboard on one VM for a home lab. Only scan or test systems you own or are explicitly authorised to assess. Official site: wazuh.com · Licence: GPLv2.

Scenario questions

Which alert proves this is more than a failed attack?

Answer: 100100: success from the brute-forcing IP. The correlation rule shows the same IP that brute forced then logged in successfully as 'deploy'.

What should you do first?

Answer: Disable/rotate the deploy account, isolate web-prod-02 and review what the session did. Treat it as a compromise: contain the account and host, then investigate the session.

What does a Wazuh decoder do?

Answer: Extracts fields like srcip and user from raw logs. Decoders parse logs into fields that rules can match on.

More open-source tool labs

Σ

Sigma

Write a detection once, run it in any SIEM.

📡

Nmap

Discover hosts, open ports and services on networks you're authorised to assess.

🦈

Wireshark / tshark

See exactly what's crossing the wire and spot malware calling home.

🔭

Zeek

Turn raw traffic into rich, searchable logs for threat hunting.

🚨

Suricata

Detect attacks in network traffic with signatures, and write your own.

🧬

YARA

Describe malware by its patterns and hunt for it across files.