2 days (16 hours total)
Day 1 — Fundamentals & Core Deployment (8h)
Chapter 1: Introduction to Wazuh (45 min)
- What Wazuh is
- Components overview: Manager, Indexer, Dashboard, Agents
- Typical architectures
- Use cases (SIEM, FIM, vulnerability detection)
Chapter 2: Preparing the Environment (1h)
- OS requirements
- Network design
- Storage & sizing basics
- Mandatory ports/services
Chapter 3: Installing Wazuh Manager (1.5h)
- Offline vs online installation
- Packages, repositories
- Service configuration
- Verifying manager health
Chapter 4: Installing Wazuh Indexer Cluster (1.5h)
- Single-node vs multi-node
- Certificates
- Cluster topology
- Troubleshooting startup issues
Chapter 5: Installing Wazuh Dashboard (1h)
- Configuration
- Connectivity to Indexer
- User accounts
- TLS basics
Chapter 6: Agent Installation & Enrollment (1h)
- Linux, Windows, macOS agents
- Enrollment keys
- Bulk deployment
- Agent groups
Chapter 7: Basic Policies & Modules (1h)
- Syscheck (FIM)
- Syscollector
- Log collection basics
- Rootcheck
- Basic ruleset activation
Day 2 — Extended Configuration & Operations (8h)
Chapter 8: Rulesets & Decoders (1h)
- Rule matching logic
- Local vs built-in rules
- Decoder basics
- Testing rule hits
Chapter 9: Threat Detection Modules (1h)
- Vulnerability scanner
- SCA (Security Configuration Assessment)
- Malware detection integration
Chapter 10: Integration with External Services (1h)
- Syslog ingestion
- Cloud integrations (AWS, Azure, GCP)
- Webhooks
- REST API usage
Chapter 11: Wazuh Agent Management (45 min)
- Groups, labels
- Overrides
- Agentless monitoring
Chapter 12: Alerting & Notifications (45 min)
- Email alerts
- Slack/Teams
- Webhooks
- Filtering rules
Chapter 13: Performance Tuning (1h)
- Manager queue tuning
- Indexer optimization
- Reducing noisy modules
- Disk usage optimization
Chapter 14: Hardening & Security (1h)
- TLS for all endpoints
- Securing API
- User/role management
- Backups
Chapter 15: Maintenance & Troubleshooting (1h)
- Log locations
- Indexer cluster checks
- Manager profiling
- Common error patterns