Using Wazuh for Security Monitoring

What is Wazuh?

Wazuh is an open-source security monitoring platform that helps organisations detect threats, monitor file and system changes, analyse logs, and meet compliance requirements. It uses lightweight agents on endpoints (servers, workstations) that report to a central manager. The manager analyses events, runs rules, and can forward alerts to external systems such as SIEMs or security portals.

Using Wazuh for security monitoring gives you visibility across many systems from a single stack: file integrity monitoring (FIM), log analysis, intrusion detection, vulnerability detection, and compliance checks. In SecBoard, the FIM Dashboard focuses on file integrity monitoring alerts from Wazuh — file added, modified, or deleted — so your team can review and triage them without leaving SecBoard.

Why use Wazuh for security monitoring?

Organisations use Wazuh to:

• Detect changes to critical files — Config files, binaries, or sensitive data that should not change without approval.
• Centralise security events — Agents send events to the manager so you can correlate activity across hosts.
• Meet compliance — Many frameworks (e.g. PCI DSS, HIPAA) require file integrity monitoring and log review; Wazuh supports both.
• Respond faster — Alerts can be sent to ticketing systems, SIEMs, or dashboards (such as the SecBoard FIM Dashboard) for triage and response.

When Wazuh is integrated with SecBoard, FIM alerts are delivered to the SecBoard FIM Dashboard via webhook. You can filter by agent, severity, status, and time, and update the processing status (e.g. confirmed incident, false positive, resolved) directly in SecBoard.

Main capabilities of Wazuh

Wazuh provides several capabilities; SecBoard’s integration focuses on FIM. A short overview of what Wazuh offers and how FIM fits in:

How Wazuh fits into your monitoring architecture

A typical flow when using Wazuh for security monitoring and feeding SecBoard:

Configuring Wazuh to send FIM alerts to SecBoard is done in the Wazuh manager (e.g. integration or webhook to the SecBoard endpoint). Webhook clients and authentication are configured in SecBoard so that only authorised Wazuh instances can push alerts.

What you see in the SecBoard FIM Dashboard

In SecBoard, the FIM Dashboard displays alerts that have been sent from Wazuh to SecBoard. For each alert you typically see:

• Alert ID and rule — Unique identifier and the Wazuh rule that fired (e.g. file modified, file added).
• File path and name — The monitored file or directory that changed.
• Alert type — Added, modified, deleted (or similar, depending on your Wazuh configuration).
• Severity — From Wazuh (e.g. critical, error, warning). SecBoard can use this for filtering and prioritisation.
• Agent — Which Wazuh agent (host) generated the alert; agent name and IP are stored in SecBoard.
• Timestamp — When the event occurred and when SecBoard received it.
• Processing status — Pending, under investigation, confirmed incident, false positive, resolved, escalated, or ignored. Your team updates this in SecBoard to track triage and response.

Using the FIM Dashboard in SecBoard you can quickly decide whether an alert is a real incident (and e.g. create or link an incident in the SecBoard Incident Register) or a false positive, and keep an audit trail of who processed the alert and when.

Best practices when using Wazuh for security monitoring

• Define what to monitor — Enable FIM on critical paths (configs, binaries, sensitive data). Avoid monitoring high-churn directories if they generate too much noise.
• Tune rules — Disable or adjust rules that produce too many false positives so analysts can focus on meaningful alerts.
• Secure the integration — Use authentication (e.g. API token or basic auth) on the SecBoard webhook so only your Wazuh manager can send alerts.
• Review regularly — Use the SecBoard FIM Dashboard to review unprocessed or high-severity alerts and update processing status so the team has a clear view of what is open.
• Link to incident response — When an alert is confirmed as an incident, document it in the SecBoard Incident Register and, if needed, escalate so that response follows your organisation’s incident process.

Frequently asked questions