Wazuh MCQ Study Notes

Wazuh MCQ Study Notes

• Wazuh Overview: Wazuh is an open-source security information and event management (SIEM) solution focused on security automation. It collects, analyzes, and correlates security events from various sources, enabling organizations to proactively detect and respond to threats.

• Key Components:

  • Wazuh Agent: Collects logs and events from endpoints (servers, workstations, and IoT devices).
  • Wazuh Server: Processes and analyzes data collected by agents. Stores, manages, and correlates collected data.
  • Wazuh Console: Provides a user interface for visualizing alerts, investigating incidents, and configuring the system.
  • Wazuh Rules: Define criteria for detecting security events, matching actions, processes, or behaviors with threat indicators.

• Data Collection:

  • Wazuh agents gather data from diverse sources (system logs, application logs, network traffic).
  • Supported log formats include Syslog, JSON, and others.
  • Agent configuration dictates collected event types.

• Security Automation:

  • Wazuh integrates with various tools for automated threat responses.
  • Capabilities include blocking malicious connections, quarantining compromised systems, and triggering incident response procedures.

• Alerting and Threat Detection:

  • Wazuh analyzes events and alerts security teams when rules are violated.
  • Alerts are categorized and prioritized based on pre-defined severity levels.

• Investigation and Response:

  • Wazuh provides tools for investigating alerts, offering detailed event information.
  • It generates reports (daily, incident) to help understand threats.
  • Event correlation tools aid in understanding activities.

• Configuration and Management:

  • Server parameters adjust agent data collection.
  • Modules handle tasks like user management, role-based access control, and agent configuration.
  • Management tools allow agent updates and server status monitoring.

• Scalability and Deployment Options:

  • Wazuh adapts to various environments (cloud, on-premises, hybrid).
  • Configurations can be centralized or decentralized.

• Architecture:

  • Wazuh employs a client-server architecture with a central server communicating to multiple endpoint agents.
  • Key design incorporates data collection, aggregation, processing, and analysis.

Example Wazuh MCQ Questions

• Question 1: What is the primary function of the Wazuh agent?

  • b) Collect logs and events from endpoints

• Question 2: Which component is responsible for processing and correlating security events in Wazuh?

  • b) Wazuh Server

• Question 3: Wazuh security automation capabilities encompass:

  • d) Blocking malicious IP addresses, isolating compromised hosts

• Question 4: Why is Wazuh considered an SIEM solution?

  • d) All of the above (collects multiple data from various sources, correlating events from different sources, and helps analyze security events and threats).

• Question 5: Wazuh configuration involves what key set of parameters?

  • d) All of the above (log collection settings, rule definitions, user/group management, event processing parameters).

• Question 6: Wazuh is scalable. This means what?

  • d) a and b (It can be deployed in various environments and handle a large amount of data.)

• Question 7: True or False: Wazuh agents are typically installed on servers only.

  • b) False

• Question 8: True or False: Wazuh leverages a standalone relational database for data storage.

  • b) False

• Question 9: What is a key factor in wazuh's design considerations?

  • c) Data collection, aggregation, and processing, and analysis

• Question 10: What are important parts of Wazuh deployment considerations?

  • d) All of the above (data storage and management options, scalability and deployment options, server and agent architecture)

This quiz covers the fundamentals of Wazuh, an open-source SIEM solution. It includes key components like Wazuh Agent, Wazuh Server, and Wazuh Console, along with their roles in security data collection and analysis. Prepare to test your knowledge on security event management using Wazuh.