Glossary

This chapter features a glossary of some of the important topics related to the Wazuh platform and its peripheral technologies. This chapter serves as a comprehensive guide to learning fundamentals of Wazuh’s technical landscape. Whether you are an experienced security professional or a newcomer to the security landscape, this chapter will provide you with a useful summary of Wazuh’s capabilities and its related concepts.

The glossary is covered in alphabetical order.

A

• Active response: Active response is a Wazuh module that automates response actions based on specific triggers. This helps security professionals to manage security incidents in a prompt and effective manner. Some actions that can be executed include a firewall drop or block, account block, deleting malicious files, blocking a suspicious network connection, and isolating an infected endpoint. To learn more, check out the following links:
  • Wazuh official documentation on active response: https://documentation.wazuh.com/current/user-manual/capabilities/active-response/index.html
  • Configuring active response for malicious files: https://wazuh.com/blog/detecting-and-responding-to-malicious-files/
  • Integrating Suricata with Wazuh for a network attack response: https://wazuh.com/blog/responding-to-network-attacks-with-suricata-and-wazuh-xdr/
• AWS instances: An AWS instance is a virtual machine that runs cloud-based applications on the AWS platform. The cloud-based infrastructure lets...

B

• Brute-force attack: Brute-force attacks are a type of hacking technique where passwords, login credentials, and encryption keys are cracked through a process of trial and error. It is a straightforward yet effective strategy for getting unauthorized access to user accounts, company networks, and systems. Until they discover the right login details, the hacker attempts a variety of usernames and passwords, frequently testing a large range of combinations on a machine. To learn more, check out the following links:
  • Brute-force attack: https://www.crowdstrike.com/cybersecurity-101/brute-force-attacks/
  • Brute-force attack by OWASP: https://owasp.org/www-community/attacks/Brute_force_attack

C

• CDB lists: CDB (Contant Database) lists in Wazuh are text files that can hold user lists, file hashes, IP addresses, and domain names. You can also store other things in them, such as network ports. You can use CDB lists to make “white” or “black” lists of users, files, IP addresses, or domain names. By searching to see whether their signatures are in a CDB list, they can also be used to find malicious files. To learn more, visit the following websites:
  • CDB lists and threat intelligence: https://documentation.wazuh.com/current/user-manual/capabilities/malware-detection/cdb-lists-threat-intelligence.html
  • Using CDB lists: https://documentation.wazuh.com/current/user-manual/ruleset/cdb-list.html
• ClamAV: ClamAV is an open source antivirus software that can find and get rid of malware, viruses, and other online activities that are harmful to your system and database. It’s compatible with Windows, Linux, and Mac devices. To learn more, visit the...

D

• Docker: Docker is a free tool for making apps, sending them out, and running them. Docker helps you to keep your applications separate from your infrastructure, which speeds up the delivery of software. You can manage your infrastructure with Docker in the same way you run your apps. To learn more, check out the following links:
  • Docker official documentation: https://docs.docker.com/
  • Monitoring Docker events on Wazuh: https://documentation.wazuh.com/current/proof-of-concept-guide/monitoring-docker.html

E

• Endpoint: An endpoint is a device or node in a network, such as a computer or server, which is monitored by Wazuh agents for security purposes. You can learn more about endpoint from the following link:
  • What is an endpoint?: https://www.paloaltonetworks.com/cyberpedia/what-is-an-endpoint

F

• File Integrity Monitoring (FIM): FIM is an IT security procedure and practice that examines and verifies application software, databases, and operating system (OS) files to see whether they have been altered or corrupted. If FIM finds that files have been changed, updated, or corrupted, it can send out alerts to ensure further investigation, and if necessary, remediation takes place. To learn more, check out the following links:
  • What is FIM?: https://www.crowdstrike.com/cybersecurity-101/file-integrity-monitoring/
  • Setting up FIM on Wazuh: https://documentation.wazuh.com/current/getting-started/use-cases/file-integrity.html

G

• GDPR compliance: The General Data Protection Regulation (GDPR) is a digital privacy legislation about digital privacy that tells businesses how to gather, use, and keep personal data about people who live in the European Union (EU). This law also controls the sending of personal data outside of the EU. By granting users (often referred to as data subjects) authority over the collection, sharing, and use of their personal data, GDPR compliance enhances privacy rights. To learn more, check out the following links:
  • What is the GDPR?: https://www.cloudflare.com/learning/privacy/what-is-the-gdpr/
  • Using Wazuh for GDPR compliance: https://documentation.wazuh.com/current/compliance/gdpr/index.html
• GitHub: GitHub uses Git, an open source version control software, to allow multiple people to make changes to web pages at the same time. This makes it possible for teams to collaborate in real time while creating and editing the content for their websites. To learn more, check out the following...

H

• HIPAA compliance: HIPAA compliance is a set of standards and protocols that healthcare organizations must follow to protect the privacy and security of sensitive patient data. If an organization deals with protected health information (PHI), it need to make sure that it follow HIPAA rules about physical, network, and process security. To learn more, check out the following links:
  • What is HIPPA compliance?: https://www.proofpoint.com/us/threat-reference/hipaa-compliance
  • Using Wazuh for HIPPA compliance: https://documentation.wazuh.com/current/compliance/hipaa/index.html

I

• IDS (Intrusion Detection System): An IDS is a network security solution that checks network data and devices for known malicious activity, unusual activity, or security policy violations. When there are known or potential threats, an IDS detects and alerts a central security tool, such as a security information and event management (SIEM) system. To learn more, check out the following links:
  • What is IDS?: https://www.geeksforgeeks.org/intrusion-detection-system-ids/
  • Network IDS integration with Wazuh: https://documentation.wazuh.com/current/proof-of-concept-guide/integrate-network-ids-suricata.html

J

• JSON (JavaScript Object Notation): JSON is a simple text-based format for sending and storing info. When data is sent from a computer to a web page, JSON is often used. It is a data serialization format that enables consistent data transmission between many platforms, applications, and systems. To learn more, check out the following link:
  • What is JSON?: https://www.w3schools.com/whatis/whatis_json.asp

K

• Kubernetes: Kubernetes is a portable, expandable, open source platform that makes automation and declarative configuration easier for managing containerized workloads and services. In a production setting, you need to keep an eye on the containers that run the apps and make sure they don’t go down. Containers are a good way to bundle and run your applications. To learn more, check out the following links:
  • What is Kubernetes?: https://cloud.google.com/learn/what-is-kubernetes
  • How to deploy Wazuh on Kubernetes?: https://documentation.wazuh.com/current/deployment-options/deploying-with-kubernetes/index.html

L

• Log data collection: Log data collection is the process of getting logs from different network sources and putting them all in one place. Collecting log data helps security teams maintain compliance, identify and remediate threats, and find failures in applications and other security problems.
• To learn more, check out the following link:
  • How log data collection works: https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/how-it-works.html

M

• Malware IOC (Indicators of Compromise): This is forensic data that shows that an attack has been executed in an organization’s network or endpoint. IOCs can be IP addresses, domains, hashes of malware files, and so on. An IOC can also include metadata about a file, such as author, the date of creation, and the file version. To learn more, check out the following links:
  • What are IOCs?: https://www.crowdstrike.com/cybersecurity-101/indicators-of-compromise/
  • Malware detection using Wazuh: https://documentation.wazuh.com/current/user-manual/capabilities/malware-detection/index.html
• MITRE ATT&CK: A MITRE ATT&CK (MITRE Adversarial Tactics, Techniques, and Common Knowledge) is a framework that assists organizations in determining their security readiness and locating vulnerabilities in their defenses. The MITRE ATT&CK framework offers an exhaustive taxonomy of adversary techniques and tactics and is characterized by its level of specificity. It is built on observations...

N

• NIST 800-53 framework: The National Institute of Standards and Technology (NIST) 800-53 is a cybersecurity standard and compliance framework. It is a set of guidelines that specify the bare minimum-security controls for all federal information systems in the United States, excluding those that are critical to national security. To learn more, check out the following links:
  • What is the NIST SP 800-53 framework?: https://www.forcepoint.com/cyber-edu/nist-sp-800-53
  • Wazuh for compliance with NIST 800-53: https://documentation.wazuh.com/current/compliance/nist/index.html

O

• OpenSearch: OpenSearch is an open source search engine and analytics suite, used for log analytics, website information search, and real-time application monitoring. OpenSearch is a fork of Elasticsearch and Kibana, launched in 2021. It is licensed under the Apache 2.0 license and is Lucene-based. OpenSearch provides functionality for searching using keywords, multiple languages, natural language, and synonyms. To learn more, check out the following links:
  • OpenSearch official documentation: https://opensearch.org/docs/latest/
  • Wazuh and OpenSearch integration: https://documentation.wazuh.com/current/integrations-guide/opensearch/index.html
• OSSEC: OSSEC is an open-source host-based intrusion detection system (HIDS) that’s compatible with multiple operating systems. It is a scalable program that checks logs, makes sure files are correct, keeps an eye on the Windows system, enforces policies centrally, finds rootkits, sends real-time alerts, and many more. To learn more...

P

• PCI DSS compliance: PCI DSS (Payment Card Industry Data Security Standard) compliance is a set of requirements that talks about how an organization should store, process, or transmit credit card information to achieve a secure environment. It’s an international security standard that helps prevent fraud and data breaches while providing consumers with a baseline degree of protection. PCI DSS compliance is not a one-time activity; it’s a continuous process that involves assessing infrastructure that handles cardholder data, analyzing the system vulnerabilities, and remediating the exploitable vulnerabilities to secure the network.
• To learn more, check out the following links:
  • What is PCI DSS compliance?: https://www.techtarget.com/searchsecurity/definition/PCI-DSS-Payment-Card-Industry-Data-Security-Standard
  • Using Wazuh for PCI DSS compliance: https://documentation.wazuh.com/current/compliance/pci-dss/index.html
• PowerShell: Built on.NET, PowerShell is a task...

R

• Rootkit: A rootkit is a type of software that allows hackers to gain unauthorized access to a network or machine while hiding its presence. Rootkits can be difficult to discover and hide for a very long period. To learn more, check out the following links:
  • What is Rootkit?: https://www.fortinet.com/resources/cyberglossary/rootkit
  • Rootkit detection using Wazuh: https://documentation.wazuh.com/current/user-manual/capabilities/malware-detection/rootkits-behavior-detection.html

S

• SCA Policy: In the Wazuh platform version 3.9.0, the SCA module was added. It offers unique tests that are applied to hardened systems. All platforms supported by Wazuh (Linux, macOS, Windows, Solaris, AIX, and HP-UX) can run the module. The SCA tool gives you a way to read and run configuration checks that are written in the YAML format. Also, having policies set up front makes it easier to follow rules such as HIPAA or PCI DSS, as well as guidelines such as those provided by the CIS (Center for Internet Security). To learn more, check out the following link:
  • SCA by Wazuh: https://documentation.wazuh.com/current/user-manual/capabilities/sec-config-assessment/index.html
• SSH (Secure Shell): The SSH protocol is a protocol for securely sending remote commands to a computer over an unsecured network. SSH encrypts and verifies device connections using cryptography. To learn more, check out the following link:
  • What is SSH?: https://www.geeksforgeeks.org/introduction-to-sshsecure...

T

• Threat intelligence: Threat intelligence is data that is gathered, processed, and studied to figure out why a threat actor does what they do, who they attack, and how they do it. Threat intelligence lets us make faster, smarter data-based security decisions. It also changes the way threat actors act, from being reactive to being proactive, in the fight against them. To learn more, check out the following links:
  • What is cyber threat intelligence?: https://www.crowdstrike.com/cybersecurity-101/threat-intelligence/
  • Building IOC files for threat intelligence with Wazuh: https://wazuh.com/blog/building-ioc-files-for-threat-intelligence-with-wazuh-xdr/
• Trust Services Criteria (TSC) compliance: The Assurance Services Executive Committee (ASEC) of the AICPA developed the Trust Services Criteria (TSC), which are standards for evaluating control objectives. These standards include measures for the safety, availability, processing integrity, privacy, and confidentiality of all of an...

V

• Vulnerability: An information system vulnerability is a weakness or an opportunity that hackers can take advantage of to get into a computer system without consent. Vulnerabilities make systems less strong and allow hackers to attack them. To learn more, check out the link below:
  • What is vulnerability?: https://www.upguard.com/blog/vulnerability
• Vulnerability Detector module: The Wazuh Vulnerability Detector module helps users find weaknesses in an operating system and apps that are installed on the endpoints that are monitored. The module works by integrating Wazuh natively with external vulnerability feeds from Microsoft, Amazon Linux Advisories Security (ALAS), Canonical, Debian, Red Hat, Arch Linux, and the National Vulnerability Database (NVD). To learn more, check out the following link:
  • How vulnerability detection works: https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/
• Windows Defender: Windows Defender is a built-in antivirus...

Y

• YARA: YARA is a tool that helps malware analysts to detect and classify malware samples. YARA rules are instructions that describe what a certain kind of malware or threat looks like. YARA rules check files and networks for patterns, scripts, and signatures that show the presence of malicious software. To learn more, check out the following links:
  • What is YARA?: https://virustotal.github.io/yara/
  • Detecting malware using YARA integration: https://documentation.wazuh.com/current/proof-of-concept-guide/detect-malware-yara-integration.html