An unsupervised server is not a secure server: without log collection and analysis, an intrusion or an outage can go unnoticed for weeks. This guide describes the cybersecurity and monitoring approach we follow with Wazuh: audit, SIEM platform, alerts, hardening and day-to-day operation.
1. Define the audit and the scope
Before installing a tool, you need to know what you protect: the list of servers and virtual machines, the services exposed to the Internet, privileged accounts, inbound and outbound network flows, sensitive data and its retention obligations. The audit also records which logs already exist, which are missing and which patches are overdue. The output is a ranked risk map that frames everything that follows.
2. Deploy the Wazuh platform
Wazuh is an open-source SIEM made of a management server (manager), an indexing engine, a dashboard and an agent installed on each host. The manager applies detection rules and centralises events; the indexer stores them and makes them searchable; the dashboard reports the state of the fleet. The platform runs on a dedicated server, the agents run on the monitored systems, and communication is encrypted. Agents forward system, authentication, web and application logs.
3. Write useful rules and cut the noise
A detection rule is only worth something if it is understood and actionable. Beyond the default rule set (authentication failures, privilege escalation, changes to sensitive files, service errors), you adapt the decoders to the logs actually produced and add custom rules for your own services. You also exclude known false positives: without that work, alerts become background noise nobody reads any more.
4. Organise alerts and triage
Not all alerts are equal. Define levels and channels: a stopped service or a successful login from an unexpected country triggers an immediate notification, while a burst of SSH failures goes into the daily review. Each channel has a recipient and a response time; each critical alert has a known procedure. A shared log records events handled and decisions taken.
5. Harden the hosts, then verify
Monitoring does not replace hardening, it measures it. Apply the basics: SSH key access, limited privileged accounts, allow-list firewalls, tracked updates and patches, valid TLS certificates, secrets kept out of scripts, backups tested by real restores. Wazuh then provides the evidence that these measures hold: file integrity monitoring, package inventory, detection of unexpected services.
systemctl status wazuh-agent tail -n 20 /var/ossec/logs/ossec.log
These two commands are enough to confirm that an agent is running and talking to the manager.
6. Operate and report
Value comes from regularity: a weekly review of open alerts, a monthly review of trends, a summary report (incidents, patches applied, open points), and an annual incident-response exercise so everyone knows who does what and within what delay. You then tune rules and thresholds, and extend coverage to new servers.
