Wazuh SIEM Cluster + Suricata
Deployment of a Wazuh SIEM cluster (master node + worker node) receiving events from Windows and Linux agents, paired with Suricata for network-based detection and an OpenSearch dashboard fed through Filebeat. Over 150 custom XML detection rule files were written or adapted to cover concrete scenarios rather than relying only on Wazuh's default ruleset.
Context
Exam project from the M1 Information Security track at ESGI (January-February 2025), covering the full setup of an open source SIEM solution. The goal was not just to install Wazuh but to make it operational on a multi-OS scenario with relevant, tested detection rules rather than settling for the default ruleset.
What was built
- Two-node Wazuh cluster (master + worker), configured and functional.
- Over 150 custom XML detection rule files written/adapted, in
clusters/master/rules/. - Linux rules: detection of
/etc/shadowand/etc/passwdmodification, SSH events, antivirus status. - Windows rules: registry key modification, antivirus status, minimal log coverage.
- Windows agent deployed via
wazuh-agent-4.10.1-1.msi. - Suricata deployed upstream of the cluster for network detection, feeding into the same alert pipeline.
- OpenSearch dashboard fed by Filebeat for alert visualization and search.
- Real alert evidence kept (
Preuve_IDS_SSHfolder) demonstrating that the rules actually fired.
Tech stack
Status
Completed and submitted as part of the M1 curriculum. The skills built here were reused and extended in the M2 Mini-SOC incident investigations mapped to MITRE ATT&CK project.