Consider replacing RKhunter with Wazuh #19

New Issue

2022-05-23T09:38:33-05:00

DarkFeather commented

2022-05-23 09:38:33 -05:00

Relevant links:

Relevant links: * https://community.graylog.org/t/how-to-create-input-to-receive-wazuh-hids-logs/18715 * https://documentation.wazuh.com/current/index.html

DarkFeather added the On-hold RFC labels 2022-05-23 09:38:45 -05:00

DarkFeather added this to the Kanban project 2022-08-04 00:40:39 -05:00

DarkFeather commented

2025-10-09 10:52:41 -05:00

Wazuh could replace a number of tools that we are aggregating inside AniNIX/Sharingan:

lynis
arch-audit
graylog+elasticsearch+mongodb
rkhunter
AIDE

However, the agent is heavy, wanting gigs of storage, two cores, and a gig of memory. This is a tradeoff, at the moment -- the syslog aggregation would be the same, but we are using daily inspections with our host tool stack to reduce persistent resource utilization. This makes our current stack more cost-effective. We can revisit this as resources become cheaper.

Deployment details: https://documentation.wazuh.com/current/deployment-options/docker/index.html

Example deployment on Arch:
https://wix-doc.com/blog/2024-05-01-secure-your-arch-linux-with-wazuh/

Note, agent-based security tools tend to require privileged access for the agents, which makes remote access to the dashboard a major issue. In our deployment, agents file data via syslog to the aggregator which prevents compromise of the aggregator from infecting servers. Examples of why this is bad:

Wazuh could replace a number of tools that we are aggregating inside AniNIX/Sharingan: * lynis * arch-audit * graylog+elasticsearch+mongodb * rkhunter * AIDE However, the agent is heavy, wanting gigs of storage, two cores, and a gig of memory. This is a tradeoff, at the moment -- the syslog aggregation would be the same, but we are using daily inspections with our host tool stack to reduce persistent resource utilization. This makes our current stack more cost-effective. We can revisit this as resources become cheaper. Deployment details: https://documentation.wazuh.com/current/deployment-options/docker/index.html Example deployment on Arch: https://wix-doc.com/blog/2024-05-01-secure-your-arch-linux-with-wazuh/ Note, agent-based security tools tend to require privileged access for the agents, which makes remote access to the dashboard a major issue. In our deployment, agents file data via syslog to the aggregator which prevents compromise of the aggregator from infecting servers. Examples of why this is bad: * https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh * https://cybersecuritynews.com/crowdstrike-falcon-windows-sensor-vulnerability * https://www.techtarget.com/whatis/feature/Explaining-the-largest-IT-outage-in-history-and-whats-next

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: AniNIX/Kapisi#19