What Is Wazuh and How Does Its Agent Architecture Work?

In modern enterprise defense and homelab administration, network firewalls only protect the perimeter. Once an attacker breaches an exposed web service, leverages an unauthenticated API vulnerability, or compromises an SSH key, perimeter firewalls cannot see the internal reconnaissance, privilege escalation, or persistence mechanisms taking place on host servers. True infrastructure security demands Endpoint Detection and Response (EDR) and centralized Security Information and Event Management (SIEM).

Wazuh stands as the premier open-source EDR/SIEM ecosystem. By deploying the lightweight C-based Wazuh agent across physical bare-metal servers, virtual machines, and Proxmox hypervisors, systems administrators gain deep forensic visibility: real-time file integrity changes, unauthorized binary execution, compliance benchmarking (CIS Benchmarks), and automated containment routines.

File Integrity Monitoring (FIM): Syscheck in Real Time

The crown jewel of the Wazuh agent is its Syscheck File Integrity Monitoring module. Syscheck continuously monitors designated system directories (such as /etc, /usr/bin, and /root/.ssh). Rather than executing noisy disk sweeps that exhaust I/O buffers, Wazuh utilizes the Linux kernel inotify API to hook filesystem modification events in real time.

The instant an unauthorized process modifies a critical configuration file (for example, appending an unauthorized public key to /root/.ssh/authorized_keys), the Wazuh agent captures the event, calculates the cryptographic SHA256 delta of the change, and dispatches a JSON telemetry payload to the Wazuh manager within 15 milliseconds. The manager correlates this event against MITRE ATT&CK techniques (T1098: Account Manipulation) and fires a high-priority Level 10 alert.

For systems administrators fortifying infrastructure, cross-referencing our analyses on Wazuh vs Security Onion SIEM Guide and Suricata & Zeek Network Threat Hunting illustrates how endpoint telemetry integrates with network-wide sensor graphs.

Linux Kernel Hardening with Auditd Integration

While log files can be modified or deleted by an attacker with root privileges, Linux kernel syscall telemetry captured via auditd cannot be bypassed easily. Wazuh integrates directly with the Linux audit subsystem via the auditd plugin.

By defining granular audit rules in /etc/audit/rules.d/audit.rules, security engineers monitor critical execution events: execution of sudo, modification of cron jobs, loading of kernel modules (init_module), and access to sensitive certificate stores. Wazuh decodes audit messages directly from the audit socket, providing an unalterable forensic record of every command executed on the host, including parent process IDs and effective user credentials.

Automated Active Response: Blocking Attackers with Nftables

Detection without automated response is insufficient during automated brute-force or ransomware attacks. Wazuh incorporates a robust Active Response framework that executes deterministic containment scripts on endpoints upon matching specific detection rules.

When an attacker executes a credential stuffing attack against SSH or an API gateway, Wazuh detects repeated authentication failures. Upon reaching rule threshold Level 8, the manager dispatches an active response command to the endpoint. The agent immediately executes a localized script that injects the attacking IP address into an isolated nftables blocklist set for 3600 seconds, dropping all subsequent packets at the kernel boundary before the attacker can compromise additional services.

Security Configuration Assessment (SCA) & CIS Hardening Checks

Beyond active intrusion detection and file integrity monitoring, the Wazuh agent integrates an automated Security Configuration Assessment (SCA) scanner. The SCA daemon queries system state against structured YAML policy files that correspond to published CIS benchmarks for Linux distributions. Every rule checks specific system artifacts, including sysctl variables, filesystem permissions, PAM module parameters, and user account configurations.

When an auditor or system administrator reviews the Wazuh dashboard, each monitored endpoint receives an objective compliance score. Common vulnerabilities detected immediately upon agent deployment include:

• Permissive SSH Daemon Configuration: Detection of PermitRootLogin yes, password-based authentication enabled, or weak legacy Diffie-Hellman key exchange groups in /etc/ssh/sshd_config.
• Insecure File Ownership on Sensitive Binaries: Identifying world-writable directories or setuid binaries owned by unprivileged accounts that could facilitate local privilege escalation (LPE).
• Unrestricted Kernel Core Dumps: Flagging missing fs.suid_dumpable = 0 configurations that could leak cryptographic tokens or process memory to disk following a segmentation fault.
• Weak Account Password Age & Hashing: Verifying that SHA-512 or yescrypt hashing is enforced in /etc/pam.d/common-password and obsolete MD5 or DES password hashes are completely eradicated.

Configuring Centralized Log Pipeline & Forwarding to OpenSearch

Deploying Wazuh across an enterprise or homelab cluster generates high log volume when full process tracking via auditd and syscheck are enabled. To maintain predictable database performance, the Wazuh manager streams structured JSON events into an OpenSearch-based indexer cluster. The indexing pipeline applies document rotation policies and data lifecycle management (ILM) to compress older security events into read-only cold tiers.

The agent configuration file at /var/ossec/etc/ossec.conf utilizes granular rate-limiting to prevent network link exhaustion during intense forensic activity:

<client_buffer>
  <disabled>no</disabled>
  <queue_size>50000</queue_size>
  <events_per_second>1000</events_per_second>
</client_buffer>

This client-side buffering ensures that if an upstream Wazuh manager undergoes rolling updates or temporary network disconnects, local agents cache up to 50,000 security telemetry events in encrypted RAM, draining the buffer automatically once the management connection resumes without dropping a single audit record.

Custom Rootcheck Signatures for Zero-Day Malware Triage

While standard signature-based antivirus scanners focus on known file hashes, modern Linux persistence mechanisms rely on user-space and kernel-space rootkits that hook standard glibc system calls or tamper with the /proc virtual filesystem. The Wazuh rootcheck engine conducts low-level system audits independently of the operating system’s standard file listing utilities.

Rootcheck evaluates Linux endpoints across four primary forensic vectors:

• Hidden Process Detection: Correlates process IDs enumerated via the standard /proc filesystem with raw kernel process tables obtained through low-level kill(pid, 0) and sched_getaffinity syscall sweeps, exposing hidden rootkit processes.
• Hidden Port and Raw Socket Auditing: Inspects network binding states directly in the kernel transport layer, identifying stealth listener backdoors that attempt to conceal their sockets from ss or netstat commands.
• Filesystem Deviation Analysis: Scans system directories for anomalous device nodes, hidden files with leading dots in binary directories (such as /usr/bin/.sshd), and unlinked inodes maintained open by terminated parent processes.
• Glibc Dynamic Linker Hooks: Audits /etc/ld.so.preload and dynamic linker environment variables for unauthorized shared libraries designed to hijack system calls at runtime.

By defining custom rootcheck signature files in /var/ossec/etc/shared/rootkit_custom.txt, enterprise security teams can rapidly distribute forensic tripwires across thousands of edge servers within minutes of receiving threat intelligence feeds.

Frequently Asked Questions