> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/08-wazuh-security-monitoring-basics/wazuh-security-monitoring.md).

# Wazuh Security Monitoring Basics Overview

This section introduces centralized security monitoring with Wazuh.

Until this point, ZyberLab has focused on reading logs directly from Windows, Active Directory, Sysmon, and network tools. Wazuh gives us one place to collect and review security information from multiple systems.

The goal is not to build a large SOC platform. The goal is to understand what changes when endpoint and server telemetry is collected centrally.

## Learning Objectives

By the end of this section, you should be able to:

* understand the basic role of a Wazuh server and agent
* create a small Wazuh system named `WAZUH01`
* access the Wazuh dashboard
* enroll `CLIENT01` as the first monitored endpoint
* confirm that Windows events are reaching Wazuh
* confirm that Sysmon telemetry can be reviewed centrally
* enroll `DC01` after the client setup is stable
* search for security events
* review a simple Wazuh alert
* document the difference between raw events and alerts

## Lab Systems

The environment now expands to four systems:

```
DC01
Windows Server and Domain Controller

CLIENT01
Windows Domain Member with Sysmon

KALI01
Linux Security Testing Workstation

WAZUH01
Centralized Security Monitoring
```

`WAZUH01` is the first additional monitoring platform introduced into ZyberLab because the previous sections already established the events and telemetry that it will collect.

## Simple Architecture

```
CLIENT01 --------+
                 |
DC01 ------------+----> WAZUH01
                 |      Wazuh Server
                 |      Dashboard
                 |      Central Monitoring
KALI01 ----------+
      optional later
```

We will begin with `CLIENT01`. Once that endpoint is reporting correctly, `DC01` can be enrolled.

## Important Principle

Do not treat every Wazuh alert as a confirmed security incident.

An alert is a signal that requires context. The investigation process remains the same:

1. identify what happened
2. identify the affected host and user
3. review the relevant time window
4. compare the alert with the underlying event
5. decide whether the activity was expected
6. document the result

## Safety

Keep Wazuh inside the ZyberLab network. Do not expose the dashboard directly to the public internet.

Use lab-only accounts and credentials. Do not reuse production passwords.

## Learning Flow

```
Create WAZUH01
      ↓
Access the Dashboard
      ↓
Enroll CLIENT01
      ↓
Verify Windows Events
      ↓
Verify Sysmon Events
      ↓
Enroll DC01
      ↓
Search Security Events
      ↓
Review a Wazuh Alert
      ↓
Complete the Checkpoint
```

This section turns the existing lab telemetry into a small centralized monitoring environment.