Overview
The Wazuh SIEM Training at Zoom Technologies takes you from SIEM fundamentals to confidently running Wazuh, the open-source SIEM and XDR platform used by SOC teams worldwide.
You start with how a SIEM collects, correlates and archives logs. Then you deploy the full Wazuh stack (agent, server, indexer, dashboard and Filebeat) and onboard a lab of Windows 11, Windows Server, Ubuntu Desktop and Ubuntu Server machines.
From there, you work hands-on throughout:
Configure Windows Advanced Audit Policy and Linux auditing to capture logons, USB activity, object access and command execution.
Detect malware using File Integrity Monitoring, Windows Registry monitoring, Defender logs, Sysmon, CDB lists and VirusTotal.
Hunt threats with custom decoders and log archives, and simulate attacks mapped to MITRE ATT&CK using Invoke-AtomicRedTeam.
Detect SSH brute-force attacks and block the attacker automatically with AbuseIPDB and Active Response.
Find vulnerabilities and misconfigurations with SCA, and integrate Suricata for network intrusion detection.
The course finishes with email alerting and custom dashboards. By the end, you’ll be able to deploy, monitor, detect, respond and report with Wazuh in a real enterprise environment.
Curriculum
- What is SIEM (Security Information and Event Management)
- Key features: log management, event correlation, threat detection, centralised monitoring, incident response
- SIEM functions: log collection, log processing and analysis, log archival
- What is Wazuh: open-source SIEM with XDR capabilities
- Core capabilities: log analysis, FIM, SCA, vulnerability detection, threat intelligence, malware and rootkit detection, Active Response
- Regulatory compliance monitoring, system inventory and cloud security monitoring
- Endpoint, command and script monitoring
- Wazuh agent, server, indexer and dashboard
- Role of Filebeat in the data pipeline
- Preparing the Wazuh environment and installation
- Accessing and navigating the Wazuh dashboard
- Installing Windows 11, Windows Server, Ubuntu Desktop and Ubuntu Server VMs
- Deploying Wazuh agents on Windows and Linux endpoints
- Verifying agent connectivity and log flow
- Local security policy and Advanced Audit Policy configuration
- Default Windows logs
- USB (PnP) device monitoring
- Logon/logoff and object-access auditing
- Command monitoring through process creation events
- Default Ubuntu logs
- Enabling audit policies
- Command monitoring in Ubuntu
- Generating login and logoff alerts
- Malware types: virus, worm, Trojan horse, ransomware, RAT, rootkit
- How Wazuh detects malware
- Collecting and analysing Windows Defender logs
- File Integrity Monitoring (FIM) on Windows and Ubuntu
- Windows Registry monitoring
- FIM on Ubuntu Server
- Working with CDB lists
- VirusTotal integration for file reputation
- AbuseIPDB integration for IP reputation
- What Sysmon is and why it matters
- Integrating Sysmon with Wazuh to detect malware
- Introduction to threat hunting
- Wazuh decoders
- Log data collection and archives
- Introduction to the MITRE ATT&CK framework
- Simulating attacks with Invoke-AtomicRedTeam
- Command monitoring for attack detection
- Detecting SSH brute-force attacks
- Active Response: automatically blocking the attacker
- Vulnerability management in the SOC
- Detecting vulnerabilities across endpoints
- Security Configuration Assessment (SCA)
- NIDS vs HIDS
- Suricata IDS integration
- Detecting malicious command execution
- Configuring email notifications
- Anatomy of a dashboard
- Creating custom dashboards and visualizations
Course Schedule
Course Schedule
Wazuh SIEM Training: Open-Source SIEM & XDR
02:00 PM to 04:00 PM
(IST - GMT +05:30)
1
Week
2 Hrs/Day
Sunday off
For Online Training Students
- Instructions will be Provided to do Lab Practicals with your PC at Home
- You will receive a link to your email in an hour after the class from Webex to Download the Recorded Videos..
- All our study materials are available for free access on our online portal for registered students
Imp. Note
- Fees once paid will not be refunded or adjusted against other courses / batches / students under any circumstances whatsoever.
- Organization reserves the right to expel any student during the training period.
- In case, a student fails to attend the given batch the amount given will be forfeited against his / her name.
FAQ'S
Wazuh is a free, open-source security platform that combines SIEM and XDR capabilities. It collects and analyses logs from endpoints, servers and cloud workloads. It also detects threats, checks configurations and vulnerabilities, and can respond to attacks automatically.
Yes. Wazuh is open source, so there are no licence costs for the software used in this course.
No. The course begins with SIEM fundamentals before moving into Wazuh deployment and operations.
Basic networking, Windows administration and Linux command-line familiarity will help you get the most from the labs.
You build a lab with a Wazuh server plus Windows 11, Windows Server, Ubuntu Desktop and Ubuntu Server endpoints. [Add system requirements, e.g. RAM and virtualisation software.]
Yes. Modules 5 and 6 cover auditing and command monitoring on Windows and Ubuntu. FIM, malware detection and vulnerability detection are practised on both platforms.
Yes. Modules 11 and 12 cover decoders, log archives, the MITRE ATT&CK framework and attack simulation with Invoke-AtomicRedTeam.
Active Response lets Wazuh act automatically when a rule fires, for example by blocking an attacker’s IP after an SSH brute-force attempt. Module 13 builds this end to end.
Wazuh is open source and self-hosted, so you deploy and run the full stack yourself. Microsoft Sentinel is a cloud-native SaaS SIEM on Azure, billed by data ingestion. Many SOC teams use both, and Zoom Technologies offers training in each.
[1 week, 6 days / 2 hours per day], delivered online, with classroom options available.
Yes. A recording download link is emailed within an hour of each session, and study materials are free on the student portal for registered students.
Yes. A Zoom Technologies course certificate is issued on completion, and placement assistance is included.
Bestseller
