Creating a Threat Hunting Lab with Wazuh and Google Cloud Platform

September 22, 2024
Post Author / Publisher: Azhar Ghafoor

CISO2CISO post categories: 0 - CT - Cybersecurity Tools - MS Azure Security, CISO2CISO Notepad Series 2

Rate this post

The document titled “Creating a Threat Hunting Lab with Wazuh and Google Cloud Platform” by Azhar Ghafoor details the steps to set up a threat hunting lab using Wazuh SIEM, Snort IDS, and Google Cloud Platform (GCP). Here’s an extensive summary:

Overview of Tools and Technologies:

Google Cloud Platform (GCP): A cloud service used for building and managing applications. In this setup, a virtual machine (VM) on GCP is used to host security tools.
Snort IDS: An open-source Intrusion Detection System (IDS) designed to detect and prevent network attacks by analyzing network traffic. It uses customizable rules to detect threats like port scans or buffer overflow attacks.
Wazuh SIEM: A cloud-based Security Information and Event Management (SIEM) tool that offers real-time threat detection, monitoring, and response. It integrates with tools like Snort to centralize security event management, providing visual dashboards and alerts.

Step-by-Step Lab Setup:

1. Creating a Virtual Machine (VM) on GCP:

Log into GCP and navigate to the console.
Create or select an existing project and access the “Compute Engine” to create a new VM instance.
Configure the VM by setting its name, region, zone, and machine type. For this lab, Ubuntu is chosen as the operating system.
Enable HTTP and HTTPS traffic in the firewall settings.
Once the VM is created, connect to it via SSH for further configuration.

2. Installing and Configuring Snort IDS:

Use SSH to connect to the VM and update the system’s packages.
Install Snort IDS by running specific commands, and configure it for the network interface that will monitor traffic.
Snort’s key configuration file, snort.conf, allows users to define the monitored network range (e.g., a subnet or a single device). Users can enable, disable, or create custom Snort rules based on specific detection needs.
Test Snort configurations to ensure there are no errors before running the IDS. After validation, Snort can be started to monitor network traffic and detect threats.
As an example, Snort can detect ICMP packets (such as ping requests) and log these intrusions in the system.

3. Integrating Wazuh SIEM with Snort:

To integrate Snort with Wazuh SIEM, first, sign up for an account on Wazuh Cloud Console and create an environment.
Install the Wazuh agent on the GCP VM by copying commands from the Wazuh dashboard into the VM’s terminal.
Once the Wazuh agent is installed and started, its status can be checked via the terminal.
Re-enable Snort IDS and run some test traffic, such as ping requests or SSH connections. These actions will be logged in Snort and sent to Wazuh for monitoring, where they will appear on the Wazuh SIEM dashboard.

4. Threat Detection and Monitoring:

Once integrated, Snort detects network-based intrusions on the VM, and Wazuh provides real-time visibility of these events. The Wazuh dashboard updates in real-time with statistics related to the captured network traffic, allowing security analysts to investigate potential threats.