VM instances

[Fred Claus]

Has anyone used Wazuh? I was thinking about setting up a virtual machine to host the Wazuh server, and test it out on a few endpoints. Does the VM need to be running 24/7 in order for the agents on the endpoints to be working? If I were to turn off the server say at night or when I'm traveling, will the endpoint still capture things, that I can view when I turn the VM back on and look at the dashboard, or would the agents on the endpoints stop working as well?

I don't use VM's much so I'm not sure if they constantly need to be running.

 

[phaZed]

You can think of a VM as a physical computer. If it's off, it's off.. and won't be doing anything you may need it to be doing.

 

[Fred Claus]

I understand that when the VM is off, it's not gathering data from the computers, but are the agents on the individual computers still collecting data, and the VM will receive all that collected data as soon as it turns back on?

 

[phaZed]

Gotcha, Sorry I misunderstood.

It looks like, from the interwebs, that Logs and data will be lost if the Agent machine is rebooted before it has a chance to connect. It also looks like the agent goes into a low-volume, slow-polling mode while disconnected - so as to not dump a large cache on re-connection.

Not sure though, I've never used it.

Agent life cycle - Agent management · Wazuh documentation

User manual, installation and configuration guides. Learn how to get the most out of the Wazuh platform.

documentation.wazuh.com

global - Local configuration (ossec.conf) · Wazuh documentation

User manual, installation and configuration guides. Learn how to get the most out of the Wazuh platform.

documentation.wazuh.com

Logs lost if agents is disconnected and system rebooted before connection is restored · Issue #11217 · wazuh/wazuh

Wazuh version Component Install type Install method Platform 4.2.5 Wazuh component Agent Packages ubuntu 18.04.6 LTS Scenario: Agent is disconnected due to network issue, and during the outtage the...

github.com

 

[Fred Claus]

ya, I might have to rethink this one. Really all I wanted was the ability to monitor the software on a computer against the CVE Database, and let me know what vulnerabilities there are.