Wazuh SIEM & XDR / EDR Enterprise Agent Deployment, Hardening & Active Response

1. Scope, Architecture & Agent Communication

This standard operating procedure governs the enterprise rollout, security hardening, File Integrity Monitoring (FIM), and automated Active Response mechanisms for the Wazuh Security Information & Event Management (SIEM) / Extended Detection and Response (XDR) platform across all server and workstation assets.

Port & Protocol Communication Matrix (per REF-NET-002):

Destination Port	Protocol	Source	Service Description	Encryption
1514	TCP	All Endpoints	Wazuh Agent Data Reporting & Events	TLS 1.3 AES-GCM
1515	TCP	Enrolling Endpoints	Agent Auto-Enrollment Auth Daemon	TLS Encrypted
55000	TCP	Admin Workstations	Wazuh RESTful API Daemon	HTTPS

 ┌────────────────────────────────────────────────────────┐
 │           Wazuh Manager Cluster (10.10.10.50)          │
 └───────▲────────────────────────▲───────────────▲───────┘
         │ TCP 1514 (Events)      │               │
         │ TCP 1515 (Enrollment)  │               │
 ┌───────┴──────────────┐ ┌───────┴────────┐ ┌────┴───────────────────┐
 │ Windows Domain Ctrls │ │ Linux Servers  │ │ User Workstations      │
 │ (FIM + EventLog 4625)│ │ (Auditd + FIM) │ │ (Sysmon + Active Resp) │
 └──────────────────────┘ └────────────────┘ └────────────────────────┘

---

2. Pre-Flight Preparation & Registration Credentials

Before mass deployment:

1. Verify Wazuh Manager IP is accessible from endpoint subnets: Test-NetConnection -ComputerName 10.10.10.50 -Port 1514
2. Obtain or configure the auto-enrollment password on the Wazuh Manager:

# On Wazuh Manager (/var/ossec/etc/authd.pass)
echo "SuperSecretEnrollmentPassword2026!" > /var/ossec/etc/authd.pass
chmod 640 /var/ossec/etc/authd.pass
chown root:wazuh /var/ossec/etc/authd.pass
systemctl restart wazuh-manager

---

3. Execution: Windows Enterprise Agent Deployment

Step 1: Silent Automated Installation Script

Deploy via Active Directory Group Policy (Startup Script) or automated PowerShell deployment:

<#
.SYNOPSIS
    Automated Wazuh Agent Enterprise Deployment for Windows
#>
[CmdletBinding()]
param(
    [string]$ManagerIP = "10.10.10.50",
    [string]$EnrollmentPassword = "SuperSecretEnrollmentPassword2026!",
    [string]$AgentGroup = "windows-servers",
    [string]$InstallerUrl = "https://packages.wazuh.com/4.x/windows/wazuh-agent-4.8.0-1.msi"
)

$DownloadPath = "$env:TEMP\wazuh-agent.msi"
Write-Host "[-] Downloading Wazuh MSI Installer..." -ForegroundColor Cyan
Invoke-WebRequest -Uri $InstallerUrl -OutFile $DownloadPath

Write-Host "[-] Executing Silent MSI Installation and Auto-Registration..." -ForegroundColor Cyan
$Arguments = @(
    "/i", "`"$DownloadPath`"",
    "/q",
    "WAZUH_MANAGER=`"$ManagerIP`"",
    "WAZUH_REGISTRATION_SERVER=`"$ManagerIP`"",
    "WAZUH_REGISTRATION_PASSWORD=`"$EnrollmentPassword`"",
    "WAZUH_AGENT_GROUP=`"$AgentGroup`""
)

Start-Process -FilePath "msiexec.exe" -ArgumentList $Arguments -Wait -NoNewWindow

Write-Host "[-] Starting and Arming Wazuh Service..." -ForegroundColor Green
Set-Service -Name "WazuhSvc" -StartupType Automatic
Start-Service -Name "WazuhSvc"

# Validate status
Get-Service -Name "WazuhSvc"

---

4. Execution: Linux Enterprise Agent Deployment (Debian / Ubuntu / RHEL)

Debian / Ubuntu Automated Installation:

#!/bin/bash
set -euo pipefail

# 1. Install Wazuh GPG key and APT repository
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

# 2. Install Agent package with environment variables
apt update
WAZUH_MANAGER="10.10.10.50" \
WAZUH_REGISTRATION_SERVER="10.10.10.50" \
WAZUH_REGISTRATION_PASSWORD="SuperSecretEnrollmentPassword2026!" \
WAZUH_AGENT_GROUP="linux-servers" \
apt install -y wazuh-agent

# 3. Enable and start Wazuh agent daemon
systemctl daemon-reload
systemctl enable --now wazuh-agent
systemctl status wazuh-agent --no-pager

---

5. Security Hardening & File Integrity Monitoring (FIM)

Configure centralized FIM rules within /var/ossec/etc/shared/default/agent.conf on the Wazuh Manager to automatically synchronize across all registered agents:

<agent_config>
  <!-- Real-Time File Integrity Monitoring (Syscheck) -->
  <syscheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
    <scan_on_start>yes</scan_on_start>

    <!-- Linux Critical Filesystems -->
    <directories check_all="yes" realtime="yes" report_changes="yes">/etc,/usr/bin,/usr/sbin,/bin,/sbin</directories>
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>

    <!-- Windows System Critical Locations -->
    <directories check_all="yes" realtime="yes" report_changes="yes">C:\Windows\System32\drivers\etc</directories>
    <directories check_all="yes" realtime="yes" report_changes="yes">C:\Windows\System32\GroupPolicy</directories>

    <!-- Registry Keys for Persistence Detection -->
    <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>
  </syscheck>
</agent_config>

---

6. Automated Active Response (Brute Force Defense & Quarantine)

Configure the Wazuh Manager to automatically trigger active response scripts on managed endpoints upon high-confidence alert detection:

Automated Firewall Drop (RDP / SSH Brute Force):

In /var/ossec/etc/ossec.conf on Wazuh Manager:

<!-- Define Active Response Command -->
<command>
  <name>firewall-drop</name>
  <executable>firewall-drop</executable>
  <timeout_allowed>yes</timeout_allowed>
</command>

<!-- Trigger active response on SSH/RDP repeated authentication failures (Rule 5712 / 60122) -->
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>5712,60122</rules_id>
  <timeout>1800</timeout> <!-- Block IP for 30 minutes -->
</active-response>

---

7. Operational Verification & Alert Testing

Test 1: Verify Registration from Wazuh Manager

/var/ossec/bin/agent_control -l

Verify target host displays Active and reports correct IP address.

Test 2: Trigger Controlled FIM Test Alert

On the target endpoint:

# On Linux:
echo "# Test SIEM Alert" >> /etc/hosts

# On Windows:
Add-Content -Path "C:\Windows\System32\drivers\etc\hosts" -Value "# Test SIEM Alert"

Within 5 seconds, Wazuh Dashboard must display Rule 550 (Integrity checksum changed).

---

8. Rollback & Agent Uninstallation Procedure

If an agent causes excessive CPU load, performance degradation, or requires decommissioning:

Windows Rollback:

Stop-Service -Name "WazuhSvc" -Force
Start-Process "msiexec.exe" -ArgumentList "/x", "`"$env:TEMP\wazuh-agent.msi`"", "/q" -Wait

Linux Rollback:

systemctl stop wazuh-agent
apt purge -y wazuh-agent
rm -rf /var/ossec

Remove Agent Record on Manager:

/var/ossec/bin/manage_agents -r <AGENT_ID>

---

9. SOC Sign-off & Audit Compliance

Audit Criteria	Expected Output	Status
Agent Heartbeat	Active status in Wazuh Manager	Approved
FIM Real-Time Trigger	Alert logged for /etc/hosts edit	Approved
Active Response Validation	Test IP successfully blocked in firewall table	Approved