> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/08-wazuh-security-monitoring-basics/create-wazuh01.md).

# Create WAZUH01

This lab adds the first centralized security monitoring system to ZyberLab.

## Objective

Create a Wazuh system named `WAZUH01` and confirm that it can communicate with the existing lab network.

## Recommended Approach

For a beginner lab, use a single-node Wazuh deployment. This keeps the architecture simple and places the core Wazuh services on one virtual machine.

Wazuh installation options and requirements can change between releases, so use the current official Wazuh installation documentation for the exact version you are deploying.

## Suggested VM Settings

Start with resources appropriate for a small lab and adjust if the current Wazuh release requires more.

| Setting | Suggested Starting Point                         |
| ------- | ------------------------------------------------ |
| VM name | `WAZUH01`                                        |
| CPU     | 4 vCPU                                           |
| Memory  | 8 GB or more                                     |
| Disk    | 80 GB or more                                    |
| Network | Same VMware NAT network as the other lab systems |

If the host becomes constrained, shut down lab systems that are not required for the current exercise rather than reducing the monitoring VM below practical requirements.

## Create the VM

1. Create a new virtual machine in VMware Workstation.
2. Use the operating system supported by the Wazuh deployment method you selected.
3. Name the VM:

```
WAZUH01
```

4. Connect it to the same VMware NAT network used by `DC01`, `CLIENT01`, and `KALI01`.
5. Complete the operating-system installation or import the supported Wazuh virtual appliance if you are using one.
6. Apply normal operating-system updates when appropriate.
7. Confirm the system time is correct.

## Check Network Information

Record the IP address assigned to `WAZUH01`.

On Linux, a command such as the following can help:

```
ip addr
```

Also identify the default route:

```
ip route
```

## Test Connectivity

Confirm that `WAZUH01` can reach the other lab systems where firewall policy permits it.

For example, test connectivity to `CLIENT01` and `DC01` using their lab IP addresses.

Do not disable host firewalls simply to make ping work. A failed ICMP test does not automatically mean that the required Wazuh communication is unavailable.

## Install Wazuh

Follow the current official Wazuh instructions for a single-node deployment or supported virtual appliance.

During installation, record only the information needed for the lab, such as:

* Wazuh server IP address
* dashboard address
* lab administrator username
* installation date
* Wazuh version

Do not place passwords or sensitive credentials in GitBook or GitHub.

## Protect the Dashboard

Keep the dashboard accessible only from the ZyberLab environment or trusted host access.

Do not configure public internet exposure for this lab.

## Create a Snapshot

After the platform is installed and stable, create a VMware snapshot named:

```
WAZUH01 - Base Install
```

## Verification

The lab is complete when:

* `WAZUH01` starts normally
* the system is on the ZyberLab network
* the Wazuh services are running
* the dashboard is reachable from the trusted lab environment
* you have recorded the Wazuh version
* the base snapshot exists

## Security Relevance

Centralized monitoring depends on the monitoring platform itself being available and protected. Treat `WAZUH01` as an important security system rather than an ordinary workstation.