Mastering SIEM with Wazuh

Mastering SIEM with Wazuh is a practical, hands-on guide to understanding, deploying, configuring, and operating Wazuh as a modern Security Information and Event Management (SIEM) platform.

Starting with SIEM fundamentals and security monitoring concepts, the book gradually takes you into Wazuh architecture, installation, agent deployment, log collection, decoders, rules, threat detection, vulnerability detection, File Integrity Monitoring, Security Configuration Assessment, incident investigation, active response, threat hunting, and SOC operations.

You will also learn how to integrate Wazuh with technologies such as Suricata, osquery, MISP, OpenCTI, TheHive, Cortex, and other security and enterprise systems.

Inside the book you will learn how to:

• Understand SIEM concepts, architecture, and real-world use cases
• Install, configure, and manage Wazuh 4.14.8
• Deploy and manage Linux and Windows agents
• Collect and analyze security logs
• Create custom decoders, rules, and active-response scripts
• Detect threats and investigate security incidents
• Integrate Wazuh with security and threat-intelligence platforms
• Apply MITRE ATT&CK for detection and threat hunting
• Use dashboards, APIs, automation, and SOC workflows
• Build, troubleshoot, harden, and scale a Wazuh environment

The book includes 12 hands-on labs, practical examples, troubleshooting guidance, and real-world case files designed to help turn concepts into usable skills.

Whether you are a student, system administrator, network administrator, cybersecurity professional, SOC analyst, or IT manager, this book provides a structured path from SIEM fundamentals to practical Wazuh implementation.

Technical reference version: Wazuh 4.14.8.