Intrusion Detection with Wazuh | Blue Team Series with Hackersploit

[@philippedomineaux7016]

The Active Response is not working because you misconfigure the location. It must be local and not localhost. local

[@mateusjunior1937]

Hi very interessing , i just have a couple of question , if you don´t mind, what is the diference between wazuh and splunk ? and also can we consider wazuh as an IPS ?

[@smo7315]

23:18 when i copy the IP and paste it into the browser it says "This site can’t be reached"

[@jarnoruuskanen]

Thanks for the video, this was very informative!

[@ST-actual]

The firewall drop rule just drops that specific ip for the number of seconds specified. This prevents people from hammering your server and actually brute forcing their way in because they can only get 10 tries every X seconds

[@robmorin]

Hello, from Montreal, Canada... Your video was informative, however your all over the place when explaining things, i found it a bit confusing. It's almost like you either did not prepare for the making of this video or you have not used this software in a long time. There was not enough detail, or any specific order on how to add an agent, and configure email alerts for, either vulnerabilities or updates. Thanks and have a great day.

[@SuperAmir64]

Thank you so much for the demonstration, i wonder if wazuh has any agents for mobile devices.

[@javimed9669]

Hi. Although there isn't any Wazuh agents for mobile devices, you could forward system logs to the Wazuh server using a Syslog client app (granting it the appropriate syslog reading permissions) and creating custom decoders and rules for specific alerts from those logs.

[@noname54]

How can you install the wazuh agent on the wazuh server? I would like to monitor the actual server for attacks since its public facing. Thanks for the videos please create more with live attacks.

[@ST-actual]

Server manages itself as localhost. You don’t need to add an agent manually

[@markngoran7788]

Hello Please can someone help me with the default credentials for the wazuh server installed using linode as on this tutorial? I have used admin/admin as user name and password also root/root and also wazuh/wazuh but I have not been able to log in

[@anomouswarrior8492]

hello i am facing the error my wazuh agent is connected but not show logs and data at security events how to fix this issue

[@ecu4321]

how about malware detection? or utilizing virustotal?

[@calvinnguyen1699]

hi bro. i can't see the available fields

[@gjgaming3522]

આ

[@ridecaro-pk]

Linode is so irritating when signing up! there's a reason they couldnt cross AWS despite being early

[@PandaBero83]

You'r using sudo while you are root??

[@ST-actual]

😂😂😂😂😂

[@Peeki]

Im guessing it's for others who follow that's not on root.

[@DataDost]

Nice video

[@petereriksson8915]

Imagine having some SOC-nobody adding firewall rules manually in some dumb xml-file :D