Wazuh: Open Source Security Platform (SIEM + XDR)

Pengertian Wazuh

Wazuh adalah open source security platform yang menyediakan kemampuan SIEM (Security Information and Event Management), XDR (Extended Detection and Response), dan Compliance Monitoring. Wazuh lahir dari fork OSSEC dan telah berkembang menjadi platform keamanan yang sangat komprehensif.

Wazuh membantu security team untuk:

Log collection dan analysis - kumpulkan dan analisis log dari berbagai sumber
File Integrity Monitoring (FIM) - deteksi perubahan file sistem
Vulnerability Detection - identifikasi software rentan
Security Configuration Assessment (SCA) - audit konfigurasi keamanan
Malware Detection - deteksi rootkit dan malware
Active Response - respon otomatis terhadap ancaman
Compliance Monitoring - kepatuhan terhadap PCI DSS, HIPAA, NIST, CIS

Komponen Ekosistem Wazuh

  +-------------------+      +-------------------+
  |   Wazuh Agent     | ---> |  Wazuh Server     |
  | (Endpoint)        |      | (Manager)         |
  +-------------------+      +---------+---------+
                                       |
                                       v
  +-------------------+      +-------------------+
  |  Wazuh Indexer    | <--- |  Wazuh Server     |
  | (OpenSearch/ES)   |      | (Analisis)        |
  +-------------------+      +---------+---------+
                                       |
                                       v
  +-------------------+
  |  Wazuh Dashboard  |
  | (Kibana/OpenDash) |
  +-------------------+

Arsitektur Wazuh

Wazuh Indexer

Bertanggung jawab untuk menyimpan dan mengindeks data keamanan. Berbasis OpenSearch (open-source fork Elasticsearch):

# Komponen:
# - OpenSearch cluster (nodes data + master)
# - Sharding untuk skalabilitas horizontal
# - Replikasi untuk high availability
# - TLS/SSL untuk komunikasi terenkripsi

# Contoh konfigurasi node di /etc/wazuh-indexer/opensearch.yml:
discovery.seed_hosts:
  - "wazuh-indexer1:9300"
  - "wazuh-indexer2:9300"
  - "wazuh-indexer3:9300"
cluster.initial_master_nodes:
  - "wazuh-indexer1"
  - "wazuh-indexer2"
  - "wazuh-indexer3"

# Memori heap (JVM) - sesuaikan dengan RAM tersedia:
# /etc/wazuh-indexer/jvm.options
-Xms4g
-Xmx4g

Wazuh Server (Manager)

Pusat analisis yang memproses data dari agent, menjalankan decoder dan rules, serta mengelola active response:

# Komponen internal:
# - wazuh-analysisd: analisis event dan alerting
# - wazuh-remoted: komunikasi dengan agent (enkripsi AES)
# - wazuh-maild: notifikasi email
# - wazuh-authd: registrasi agent
# - wazuh-execd: active response execution
# - wazuh-modulesd: ekstensi modul (FIM, Vulnerability, SCA)

# Cek status semua komponen:
systemctl status wazuh-manager
# Output:
# ● wazuh-manager.service - Wazuh Manager
#    Loaded: loaded /etc/systemd/system/wazuh-manager.service
#    Active: active (running) since ...

# Log utama:
tail -f /var/ossec/logs/ossec.log

Wazuh Dashboard

Antarmuka visual berbasis OpenSearch Dashboards untuk monitoring, investigasi, dan reporting:

# Akses dashboard:
# https://<dashboard-ip>:5601/app/wazuh

# Default credentials saat install:
# Username: admin
# Password: (dihasilkan saat instalasi)

# Reset password:
/usr/share/wazuh-dashboard/bin/opensearch-dashboards-keystore

Wazuh Agent

Endpoint agent yang mengumpulkan data dari server/desktop/cloud:

# Install agent di Ubuntu/Debian:
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list
apt update && apt install wazuh-agent

# Register agent ke manager:
/var/ossec/bin/agent-auth -m <WAZUH_MANAGER_IP> -A <AGENT_NAME>

# Konfigurasi /var/ossec/etc/ossec.conf:
<client>
  <server>
    <address>10.0.0.10</address>
    <port>1514</port>
    <protocol>tcp</protocol>
  </server>
  <config-profile>ubuntu, ubuntu-22.04, debian</config-profile>
  <notify_time>10</notify_time>
  <time-reconnect>60</time-reconnect>
</client>

# Start agent:
systemctl start wazuh-agent
systemctl enable wazuh-agent

# Verifikasi koneksi:
/var/ossec/bin/agent-control -l
# Output:
# 001: 10.0.0.20 (web-server-01) Ubuntu 22.04 - Active
# 002: 10.0.0.21 (db-server-01) Debian 12 - Active

Instalasi Wazuh (All-in-One)

Untuk lab/testing, instalasi all-in-one (Indexer + Server + Dashboard di satu node):

# Metode 1 - Installer Asisten (rekomendasi):
curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
bash wazuh-install.sh -a

# Output akhir:
# Wazuh dashboard: https://<IP>:5601
# User: admin
# Password: <auto-generated-password>

# Metode 2 - Docker Compose (untuk development):
git clone https://github.com/wazuh/wazuh-docker.git
cd wazuh-docker/single-node
docker-compose up -d

# Verifikasi semua kontainer:
docker-compose ps
# Output:
# Name                   Status
# wazuh-indexer-single   Up
# wazuh-server-single    Up
# wazuh-dashboard-single Up

Log Collection

Wazuh mampu mengumpulkan log dari hampir semua sumber:

Log Collection via Agent (syslog)

# Konfigurasi di /var/ossec/etc/ossec.conf (agent):
<localfile>
  <location>/var/log/syslog</location>
  <log_format>syslog</log_format>
</localfile>

<localfile>
  <location>/var/log/auth.log</location>
  <log_format>syslog</log_format>
</localfile>

<localfile>
  <location>/var/log/apache2/access.log</location>
  <log_format>apache</log_format>
</localfile>

<localfile>
  <location>/var/log/nginx/error.log</location>
  <log_format>syslog</log_format>
</localfile>

Remote Syslog (Agentless)

Untuk perangkat yang tidak bisa install agent (firewall, router, switch):

# Di konfigurasi server /var/ossec/etc/ossec.conf:
<remote>
  <connection>syslog</connection>
  <port>514</port>
  <protocol>udp</protocol>
  <allowed-ips>10.0.0.0/8</allowed-ips>
</remote>

# Konfigurasi di perangkat Cisco/Palo Alto (contoh Cisco):
# configure terminal
# logging host 10.0.0.10 514
# logging trap warnings
# logging on
# end

Windows Event Log

# Di agent Windows, konfigurasi ossec.conf:
<localfile>
  <location>Application</location>
  <log_format>eventchannel</log_format>
</localfile>

<localfile>
  <location>Security</location>
  <log_format>eventchannel</log_format>
</localfile>

<localfile>
  <location>System</location>
  <log_format>eventchannel</log_format>
</localfile>

# Atau via PowerShell - install agent dari CLI:
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/wazuh-agent-4.10.0-1.msi -OutFile wazuh-agent.msi
msiexec /i wazuh-agent.msi /q WAZUH_MANAGER='10.0.0.10' WAZUH_REGISTRATION_SERVER='10.0.0.10'

JSON Log Collection

Untuk aplikasi modern yang menghasilkan log JSON (Docker, Kubernetes, custom apps):

<localfile>
  <location>/var/log/app/*.json</location>
  <log_format>json</log_format>
  <label key="app_name">my-api</label>
</localfile>

# Log JSON akan di-parse otomatis oleh Wazuh decoder
# Contoh log:
# {"level":"ERROR","timestamp":"2026-07-22T10:00:00Z","message":"Database connection failed","user_id":1234}

File Integrity Monitoring (FIM)

FIM adalah fitur yang mendeteksi perubahan pada file dan direktori yang dimonitor:

# Konfigurasi di ossec.conf:
<syscheck>
  <frequency>3600</frequency>              <!-- Scan interval dalam detik -->
  <scan_time>0</scan_time>                 <!-- Real-time monitoring -->

  <!-- Direktori yang dimonitor -->
  <directories check_all="yes">/etc</directories>
  <directories check_all="yes">/bin,/sbin,/usr/bin,/usr/sbin</directories>
  <directories check_all="yes">/root</directories>
  <directories check_all="yes">/home</directories>

  <!-- File penting di web server -->
  <directories check_all="yes">/var/www/html</directories>
  <directories check_all="yes">/etc/nginx</directories>
  <directories check_all="yes">/etc/apache2</directories>

  <!-- Eksklusi (direktori yang tidak perlu di-scan) -->
  <ignore>/etc/mtab</ignore>
  <ignore>/etc/hostname</ignore>
  <ignore type="sregex">\.log$</ignore>
  <ignore type="sregex">\.tmp$</ignore>

  <!-- File yang di-hash (MD5 + SHA1 + SHA256) -->
  <nodiff>/etc/shadow</nodiff>
  <nodiff>/etc/passwd</nodiff>

  <!-- Alert threshold -->
  <alert_new_files>yes</alert_new_files>
  <report_changes>yes</report_changes>
  <skip_nfs>yes</skip_nfs>
</syscheck>

Contoh Deteksi File Change

Ketika file yang dimonitor berubah, Wazuh menghasilkan alert:

{
  "alert_id": "123456",
  "rule_id": "553",
  "rule_level": 7,
  "description": "File '/etc/passwd' modified",
  "fim": {
    "mode": "scheduled",
    "type": "modified",
    "old_hash": "d41d8cd98f00b204e9800998ecf8427e",
    "new_hash": "098f6bcd4621d373cade4e832627b4f6",
    "changed_attributes": ["size", "md5", "sha1", "sha256"],
    "old_attributes": {
      "size": 2048,
      "perm": "rw-r--r--",
      "uid": "0",
      "gid": "0"
    },
    "new_attributes": {
      "size": 2096,
      "perm": "rw-rw-rw-",
      "uid": "0",
      "gid": "0"
    }
  }
}

Real-Time Monitoring (Whodata)

Whodata mencatat siapa yang mengubah file (Linux auditd):

<syscheck>
  <directories check_all="yes" whodata="yes">
    /etc/shadow
  </directories>
  <directories check_all="yes" whodata="yes">
    /etc/sudoers
  </directories>
</syscheck>

# Di agent, pastikan auditd terinstall:
apt install auditd audispd-plugins -y
systemctl enable auditd && systemctl start auditd

# Alert whodata akan menampilkan:
# - User yang mengubah file
# - PID proses
# - Command yang digunakan
# - Parent process

Vulnerability Detection

Wazuh terintegrasi dengan National Vulnerability Database (NVD) dan sumber CVE lainnya:

# Aktifkan vulnerability detection di ossec.conf:
<wodle name="vulnerability-detector">
  <enabled>yes</enabled>
  <interval>5m</interval>                  <!-- Update interval -->
  <min_full_scan_interval>6h</min_full_scan_interval>  <!-- Full scan -->
  <run_on_start>yes</run_on_start>

  <!-- Sumber database CVE -->
  <provider name="nvd">
    <enabled>yes</enabled>
    <update_interval>1h</update_interval>
    <path>/var/ossec/updater/nvd</path>
  </provider>

  <provider name="ubuntu">
    <enabled>yes</enabled>
    <os>focal</os>
    <os>jammy</os>
  </provider>

  <provider name="redhat">
    <enabled>yes</enabled>
    <os>9</os>
    <os>8</os>
  </provider>
</wodle>

# Cek status vulnerability:
/var/ossec/bin/wazuh-control info
# Output akan menampilkan CVEs yang terdeteksi di agent

Contoh Output Vulnerability Detection

{
  "vulnerability": {
    "cve": "CVE-2024-1234",
    "type": "package",
    "severity": "High",
    "cvss3_score": 7.8,
    "package": {
      "name": "openssl",
      "version": "1.1.1f-1ubuntu2.20",
      "architecture": "amd64",
      "condition": "package.old"
    },
    "cwe_reference": "CWE-119",
    "published": "2024-06-15",
    "updated": "2024-07-20",
    "fixed_version": "1.1.1f-1ubuntu2.21",
    "source": "NVD",
    "title": "Buffer overflow in OpenSSL CTX parsing"
  }
}

Security Configuration Assessment (SCA)

SCA melakukan audit otomatis terhadap konfigurasi keamanan sistem berdasarkan benchmark industri:

# Konfigurasi SCA di ossec.conf:
<wodle name="syscollector">
  <enabled>yes</enabled>
  <interval>1h</interval>
  <scan_on_start>yes</scan_on_start>
  <hardware>yes</hardware>
  <os>yes</os>
  <network>yes</network>
  <packages>yes</packages>
  <ports all="yes">yes</ports>
  <processes>yes</processes>
</wodle>

<sca>
  <enabled>yes</enabled>
  <scan_on_start>yes</scan_on_start>
  <interval>12h</interval>

  <!-- Policy CIS Benchmark yang digunakan -->
  <policy>CIS_Ubuntu_Linux_22.04_LTS_Benchmark_v1.0.0</policy>
  <policy>CIS_Docker_CE_v1.2.0</policy>
</sca>

Hasil SCA

# Contoh output dari SCA policy:
# Di Dashboard > Security Configuration Assessment

# Pass/Fail untuk setiap kontrol:
# [PASS] Disable unused filesystems (cramfs)
# [PASS] Ensure /tmp is configured (tmpfs)
# [FAIL] Ensure permissions on /etc/shadow are 640
# [FAIL] Ensure password expiration is 365 days or less
# [PASS] Disable root login via SSH
# [FAIL] Ensure auditd is installed and active

# Remediation command yang disarankan:
# /etc/shadow: chmod 640 /etc/shadow
# Password expiry: chage --maxdays 365 <user>
# Auditd: apt install auditd && systemctl enable auditd

Active Response

Active Response memungkinkan tindakan otomatis ketika aturan tertentu terpenuhi:

# Konfigurasi di ossec.conf (server):
<command>
  <name>firewall-drop</name>
  <executable>firewall-drop.sh</executable>
  <timeout_enabled>yes</timeout_enabled>
  <timeout>300</timeout>    <!-- 5 menit auto-unblock -->
</command>

<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <level>10</level>          <!-- Trigger pada level 10+ -->
  <rules_group>authentication_failures</rules_group>
  <timeout>300</timeout>
</active-response>

<active-response>
  <command>host-deny</command>
  <location>local</location>
  <agent_id>001</agent_id>   <!-- Response di agent tertentu -->
  <level>12</level>
</active-response>

Script Active Response (firewall-drop.sh)

#!/bin/bash
# Lokasi: /var/ossec/active-response/bin/

ACTION=\$1
USER=\$2
IP=\$3

# Blokir IP menggunakan iptables
if [ "\$ACTION" = "add" ]; then
    /sbin/iptables -A INPUT -s \$IP -j DROP
    /sbin/ip6tables -A INPUT -s \$IP -j DROP
    logger -t wazuh "Active Response: Blocked IP \$IP (SSH brute force)"
elif [ "\$ACTION" = "delete" ]; then
    /sbin/iptables -D INPUT -s \$IP -j DROP
    /sbin/ip6tables -D INPUT -s \$IP -j DROP
    logger -t wazuh "Active Response: Unblocked IP \$IP"
fi

Deteksi SSH Brute Force + Active Response

Rule bawaan Wazuh untuk SSH brute force sudah mencakup:

<!-- /var/ossec/ruleset/rules/0085-sshd_rules.xml -->
<rule id="5712" level="10" frequency="10" timeframe="120">
  <if_matched_sid>5710</if_matched_sid>
  <description>SSHD brute force (10 attempts in 2 minutes)</description>
  <group>authentication_failures,sshd,reconnaissance,pci_dss_10.2.4,</group>
</rule>

<rule id="5715" level="15" frequency="20" timeframe="120">
  <if_matched_sid>5710</if_matched_sid>
  <description>SSHD brute force (20 attempts in 2 minutes)</description>
  <group>authentication_failures,sshd,reconnaissance,pci_dss_10.2.4,</group>
  <options>no_full_log</options>
</rule>

Custom Decoders dan Rules

Wazuh memungkinkan pembuatan decoder kustom untuk log aplikasi yang tidak dikenal:

Membuat Decoder untuk Custom App

# File: /var/ossec/etc/decoders/custom-app-decoder.xml
<decoder name="custom-app">
  <prematch>^\[CUSTOM-APP\]</prematch>
</decoder>

<decoder name="custom-app-error">
  <parent>custom-app</parent>
  <regex>\[CUSTOM-APP\] (\S+) - User:(\S+) - Action:(\S+) - Status:(\S+) - IP:(\S+)</regex>
  <order>timestamp,user,action,status,srcip</order>
</decoder>

Membuat Rule untuk Log Tersebut

# File: /var/ossec/etc/rules/custom-app-rules.xml
<group name="custom-app,">
  <!-- Deteksi failed login ke custom app -->
  <rule id="100001" level="7">
    <decoded_as>custom-app-error</decoded_as>
    <field name="status">FAILED</field>
    <field name="action">LOGIN</field>
    <description>Custom App: Failed login dari user \$(user) (IP: \$(srcip))</description>
    <group>authentication_failures,</group>
  </rule>

  <!-- Deteksi brute force (5 gagal dalam 60 detik) -->
  <rule id="100002" level="10" frequency="5" timeframe="60">
    <if_matched_sid>100001</if_matched_sid>
    <description>Custom App: Brute force detected dari \$(srcip)</description>
    <group>authentication_failures,reconnaissance,</group>
  </rule>

  <!-- Deteksi akses dari IP mencurigakan -->
  <rule id="100003" level="12">
    <decoded_as>custom-app-error</decoded_as>
    <field name="status">BLOCKED</field>
    <field name="action">ACCESS</field>
    <description>Custom App: Blocked access dari user \$(user) (IP: \$(srcip))</description>
    <group>invalid_access,</group>
  </rule>
</group>

Verifikasi Decoder dan Rule

# Test decoder:
/var/ossec/bin/wazuh-logtest
# Masukkan log: [CUSTOM-APP] 2026-07-22 - User:admin - Action:LOGIN - Status:FAILED - IP:192.168.1.100
# Output akan menunjukkan decoder yang cocok dan field yang diekstrak

# Reload rule setelah edit:
systemctl restart wazuh-manager

# Cek error pada rule:
tail -f /var/ossec/logs/ossec.log | grep -i "error"

Compliance Monitoring

Wazuh memiliki aturan out-of-the-box untuk berbagai standar kepatuhan:

PCI DSS Monitoring

# Rule built-in untuk PCI DSS 4.0:
# 10.2.2 - Failed login attempts (rule 5712-5715)
# 10.2.3 - Access to audit trail (rule 80700)
# 10.5.2 - File integrity monitoring changes (rule 550, 553)
# 11.5.1 - Vulnerability scan alerts (rule 23515)

# Lihat alert PCI DSS di dashboard:
# Security Events > Filter: rule.pci_dss > 10.2.4

CIS Benchmark Monitoring

# CIS benchmarks yang tersedia:
# - CIS Ubuntu 20.04/22.04
# - CIS CentOS 7/8
# - CIS Windows Server 2019/2022
# - CIS Docker
# - CIS Kubernetes

# Hasil compliance score:
# Dashboard > Security Configuration Assessment
# > Pilih agent > Lihat skor per-control

Contoh: Deteksi File /etc/shadow diubah

# Aturan bawaan Wazuh untuk FIM
# rule_id: 550 - File dimodifikasi
# rule_id: 553 - File kritis (/etc/shadow, /etc/sudoers) dimodifikasi
# rule_id: 554 - File baru dibuat di direktori kritis

# Alert yang dihasilkan:
# Level: 7 untuk file biasa
# Level: 10 untuk file kritis (/etc/shadow, /etc/sudoers)
# Level: 12 untuk whodata (dengan informasi user/PID)

Contoh Penggunaan Nyata

1. Deteksi SSH Brute Force

# Skenario: attacker mencoba login SSH 50 kali dalam 1 menit

# Log yang dikirim agent ke server:
Jul 22 10:00:01 web1 sshd[12345]: Failed password for invalid user admin from 10.0.0.99 port 54321 ssh2
Jul 22 10:00:02 web1 sshd[12346]: Failed password for invalid user root from 10.0.0.99 port 54322 ssh2
... (48 kali lagi)

# Wazuh memicu aturan 5712 (level 10) setelah 10 gagal
# Wazuh memicu aturan 5715 (level 15) setelah 20 gagal
# Active Response menjalankan firewall-drop.sh

# Di dashboard:
# Alert: SSHD brute force (20 attempts in 2 minutes)
# Source IP: 10.0.0.99
# Action: IP blocked via iptables (active response)

2. Deteksi File Changes pada Web Server

# Skenario: attacker berhasil upload backdoor PHP

# File /var/www/html/shell.php dibuat dengan konten:
# <?php system($_GET['cmd']); ?>

# Wazuh FIM mendeteksi:
# Alert 554 (level 7): File '/var/www/html/shell.php' created
# Alert 553 (level 10): File di direktori yang dimonitor

# Whodata menampilkan:
# User: www-data
# Process: /usr/bin/php
# Parent: /usr/sbin/apache2

# Tindakan yang bisa diambil:
# - Active Response: hapus file dan restart web server
# - Email alert ke security team
# - Integrasi dengan ticketing system

3. Vulnerability Scan dan Remediation

# Skenario: vulnerability detector menemukan CVE-2024-1234 di OpenSSL

# Langkah 1 - Lihat detail CVE dari dashboard:
# CVE ID: CVE-2024-1234
# Severity: High (CVSS 7.8)
# Package: openssl 1.1.1f (installed), 1.1.1g (fixed)
# Published: 2024-06-15

# Langkah 2 - Remediasi:
apt update
apt install --only-upgrade openssl -y

# Langkah 3 - Verifikasi:
dpkg -l openssl | grep 1.1.1g

# Langkah 4 - Di Wazuh dashboard, vulnerability alert akan otomatis
# hilang pada scan berikutnya setelah upgrade

4. Integrasi dengan Slack/Telegram

# Konfigurasi integrasi custom di /var/ossec/etc/ossec.conf:
<integration>
  <name>custom-slack</name>
  <hook_url>https://hooks.slack.com/services/T00/B00/XXXXX</hook_url>
  <level>10</level>
  <rule_id>5712,5715,553</rule_id>  <!-- Hanya alert penting -->
  <format>json</format>
</integration>

# Script integrasi di /var/ossec/integrations/custom-slack.py:
#!/usr/bin/env python
import json, sys, requests

alert = json.loads(sys.stdin.read())
payload = {
    "text": f"[WAZUH] {alert['rule']['description']}\n"
            f"Agent: {alert['agent']['name']}\n"
            f"Level: {alert['rule']['level']}\n"
            f"Time: {alert['timestamp']}"
}
requests.post(alert['parameters']['hook_url'], json=payload)

5. Monitoring Docker Container

# Install agent di Docker host:
apt install wazuh-agent

# Aktifkan Docker listener di ossec.conf:
<wodle name="docker-listener">
  <enabled>yes</enabled>
</wodle>

# Yang dimonitor:
# - Container lifecycle (create, start, stop, destroy)
# - Image pull/push operations
# - Network events
# - Resource usage anomaly

# Agent akan mengirim alert seperti:
# Docker: Container 'web-app' started (Image: nginx:latest)
# Docker: Container 'malicious' menggunakan image dari unknown registry

Tips dan Best Practices

Cluster Wazuh untuk Produksi - Indexer minimal 3 node untuk high availability.

Tuning Rule Levels - Atur level alert untuk mengurangi false positive:

# Override rule di /var/ossec/etc/rules/local_rules.xml:
<rule id="100000" level="0">
  <if_sid>510</if_sid>  <!-- Rule yang di-override -->
  <description>Ignore syslog startup messages</description>
</rule>

Log Rotation - Konfigurasi rotasi log agent agar tidak penuh:
```
# Di ossec.conf agent:
<internal>
  <syscheck>debug2</syscheck>  
</internal>
```
Backup Konfigurasi - Backup rutin folder /var/ossec/etc/.
Update Ruleset - Update aturan dan decoder secara berkala:
```
/var/ossec/bin/wazuh-control restart
```
Agent Monitoring - Pantau agent yang tidak aktif (disconnected):
```
# Rule bawaan: 120 - Agent disconnected
# Rule: 121 - Agent reconnected
```

Kesimpulan

Wazuh adalah platform keamanan open-source yang sangat komprehensif - mencakup SIEM, XDR, FIM, vulnerability detection, SCA, dan compliance monitoring dalam satu ekosistem. Dengan arsitektur yang modular (Indexer, Server, Dashboard, Agent), Wazuh cocok untuk organisasi dari skala kecil hingga enterprise.

Kemampuan custom decoder dan rules, active response, serta integrasi dengan tools eksternal (Slack, Telegram, PagerDuty, ticketing systems) membuat Wazuh menjadi fondasi yang kokoh untuk Security Operations Center (SOC) tanpa biaya lisensi yang mahal.