Wazuh App, User Logins, and File Integrity - Let's Deploy a Host Intrusion Detection System #5 

Thanks for watching! I hope to get to security onion videos soon :)

Thanks for watching!

same here, did you solved that already sir?

@@redhat3831 Yes I was able to fix it by using the cmd -

Hey Neith, what OS are you logging to capture SSH logs from? Also, what version of the SSH service are you running? Possibly, we need to add a decoder that will better fit your ssh log output.

@@taylorwalton_socfortress i have a wazuh manager in ubuntu desktop, and im trying to catch the login through ssh when i connect to Windows agent.

@@neithaltair4597 Hey Neith, apologies for the late reply. If the Wazuh Agent is a Windows server than it will most likely be a RDP login attempt and not an SSH login attempt. Try looking for rule id 18107. Hope this helps and thanks for watching!

Hey Pawel, perhaps the module is not enabled as it should be? Ensure that both the agent and the manager are both configured to run the vulnerability scanning. An example is provided here: documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/running_vu_scan.html Hope that helps and let me know if you have any other questions. Thanks for watching!

@@taylorwalton_socfortress will check thanks! but my problem was - my machines were up2date and wazuh reported vulnerabiliteis ;)

I have the same problem with a linux user agent (debian)

@@karlmaamary8181 well i have solved it - all is ok - you need to switch from stable to sid and in sid everything is patched

@@pawelsmierciak2559 Thank you!

Hey, what does the raw log of a failed ssh login look like? It could be that the source IP is not being identified as a Geolocation field. What version of SSH are you running?