> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/08-wazuh-security-monitoring-basics/wazuh-checkpoint.md).

# Wazuh Security Monitoring Checkpoint

Use this checkpoint to confirm that the centralized monitoring environment is stable before adding more tools or detection content.

## Systems

Confirm the current ZyberLab systems:

```
DC01
CLIENT01
KALI01
WAZUH01
```

## Check WAZUH01

Confirm that:

* the Wazuh platform starts normally
* the dashboard is accessible from the trusted lab environment
* the platform shows healthy status
* the Wazuh version has been recorded in private lab notes
* the base snapshot exists
* the dashboard is not exposed directly to the public internet

## Check CLIENT01

Confirm that:

* the Wazuh agent is installed
* the agent service is running
* the endpoint appears active in Wazuh
* Windows events can be found centrally
* Sysmon events can be found centrally

## Check DC01

Confirm that:

* the Wazuh agent is installed
* the agent appears active
* Active Directory events can be found in Wazuh
* temporary test users have been removed
* the domain controller continues to operate normally

## Validate Known Events

You should be able to locate at least one example of each of the following where your audit configuration generates them:

| Source   | Example Activity        | Common Event                 |
| -------- | ----------------------- | ---------------------------- |
| CLIENT01 | Failed logon            | Windows Event ID `4625`      |
| CLIENT01 | Process creation        | Sysmon Event ID `1`          |
| DC01     | User account creation   | Windows Event ID `4720`      |
| DC01     | Group membership change | Relevant Windows group event |

## Investigation Check

Choose one event or alert and answer:

1. What happened?
2. Which host generated the data?
3. Which user or process was involved?
4. When did it happen?
5. What original event supports the Wazuh record?
6. Was the activity expected?
7. What is your conclusion?

## What You Should Understand

At this point, you should understand the difference between:

```
Source System
     ↓
Raw Security Event
     ↓
Wazuh Agent
     ↓
Central Collection
     ↓
Rule Evaluation
     ↓
Alert or Searchable Event
     ↓
Investigation
     ↓
Conclusion
```

## Keep the Environment Simple

Do not add more monitoring products simply because the current stage is complete.

Use the existing environment until a future lab has a clear reason to introduce another system or data source.

## Completion Criteria

This section is complete when:

* `WAZUH01` is stable
* `CLIENT01` and `DC01` are reporting
* Windows and Sysmon data can be located centrally
* you can search using time, host, and event context
* you can review a simple alert without assuming it is an incident
* you can compare centralized data with the original source event
* all temporary lab changes have been cleaned up

The next stage should build on this visibility rather than replacing it.