F.O.S.S.O.C. || Free & open-source Security Operations Centre
GithubTeam
  • Overview
    • Need for this project
    • Aim of this project
    • Network Architecture
    • System Specifications
  • Wazuh Manager
    • Setup
    • Log Behaviour
      • Creating logs for every event
      • Adding custom Wazuh Rules
        • CLI method
        • GUI method
    • Rules
      • Mimikatz Rule
    • Integration
      • With Shuffle
  • Wazuh Agent (Windows)
    • Setup
  • Sysmon
    • Setup
  • TheHive
    • Setup
    • Integrating with Shuffle
  • Cortex
    • Setup
  • Shuffle
    • Setup
    • Workflows
      • Mimikatz Workflow
  • Case Studies
    • Mimikatz
      • Mimikatz execution
      • Wazuh rule
      • Shuffle workflow
  • Conclusion
    • Team
Powered by GitBook
On this page

Was this helpful?

  1. Wazuh Manager
  2. Log Behaviour

Creating logs for every event

If we want Wazuh to create logs for every event that happens on the endpoint, we need to make some modification.

Edit ossec.conf in the Wazuh manager

/var/ossec/etc/ossec.conf
    <ossec_config>
        <global>
--          <logall>no</logall>
++          <logall>yes</logall>  
--          <logall_json>no</logall_json>
++          <logall_json>yes</logall_json>
        </global>
    </ossec_config>
PreviousLog BehaviourNextAdding custom Wazuh Rules

Last updated 1 year ago

Was this helpful?