# Wazuh & TheHive: Installation, Configuration, and Optimization

## **What is Wazuh?**

Wazuh is an **open-source Security Information and Event Management (SIEM) solution**. It helps monitor systems, detect threats, and respond to security incidents.

#### **Why Use Wazuh?**

✅ **Threat Detection** – Identifies malware, intrusions, and suspicious activity.\
✅ **Log Analysis** – Collects and analyzes logs from servers, networks, and applications.\
✅ **Compliance Monitoring** – Helps meet security standards (HIPAA, PCI-DSS, GDPR, etc.).\
✅ **Incident Response** – Detects and alerts on security events in real time.\
✅ **File Integrity Monitoring (FIM)** – Tracks changes in critical system files.\
✅ **Vulnerability Detection** – Scans for security weaknesses in systems and software.\
✅ **Free & Open-Source** – No licensing costs, highly customizable.

## **🔹 Wazuh Setup Guide**

#### Step 1: Connect to Your Linux Server via SSH

Open PowerShell or Command Prompt on Windows and run:

```
ssh username@server-ip
```

Replace:

* `username` → Your Ubuntu username (e.g., root or ubuntu).
* `server-ip` → The IP address of your Linux machine.

### **Step 2: Install Wazuh SIEM**

#### **1️⃣ Install Wazuh on Ubuntu**

Run the following command to download and install Wazuh:

```bash
curl -sO https://packages.wazuh.com/4.11/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
```

* This installs Wazuh **Indexers, Server, and Dashboard**.
* Once installed, the dashboard URL and login credentials will be displayed.

<figure><img src="/files/kl6uASmX2KvnSPUqXvkY" alt="" width="563"><figcaption></figcaption></figure>

#### **2️⃣ Access Wazuh Dashboard**

* Open a web browser and enter:

  ```
  https://<your_wazuh_server_ip>
  ```
* Use the **default username:** `admin`
* The password is **randomly generated** during installation.
* Now we can access the Wazuh dashboard.<br>

  <figure><img src="/files/UMPRKQbJhwwfXRA4hjCO" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="/files/tZjnEIkwmGpeS4p3YMHB" alt="" width="563"><figcaption></figcaption></figure>

## 👉Setting Up TheHive

## **What is TheHive?**

TheHive is an **open-source Security Incident Response Platform (SIRP)** that helps cybersecurity teams **detect, investigate, and respond** to security threats efficiently. It acts as a **central hub** for managing incidents, automating workflows, and enhancing collaboration.

### **Key Features:**

🔹 **Incident & Case Management** – Organize, track, and resolve security incidents effectively.\
🔹 **Alert Ingestion** – Collect alerts from Wazuh, SIEMs, IDS, and emails for centralized analysis.\
🔹 **Collaboration** – Multiple analysts can work together on cases in real time.\
🔹 **Threat Intelligence (Cortex Integration)** – Enrich investigations with automated intelligence gathering.\
🔹 **Automation & API Support** – Automate repetitive tasks to speed up response times.\
🔹 **Dashboards & Reporting** – Gain insights and track security incidents with visual reports.

### **Why Use TheHive?**

✅ Centralized management of security incidents.\
✅ Faster response through automation.\
✅ Improved teamwork and case tracking.\ <br>

**Now that we know TheHive is a powerful tool for security incident response, let's install and configure it for efficient case management and alert handling 👇**

### 👉 Installation Guide

Follow these steps to install TheHive on your system.

#### 1. Install Dependencies

These are required to ensure system compatibility and allow package installation.

```bash
sudo apt install wget gnupg apt-transport-https git ca-certificates ca-certificates-java curl software-properties-common python3-pip lsb-release
```

#### 2. Install Java 11 (Amazon Corretto)

TheHive requires Java 11 to run properly.

```bash
wget -qO- https://apt.corretto.aws/corretto.key | sudo gpg --dearmor -o /usr/share/keyrings/corretto.gpg
echo "deb [signed-by=/usr/share/keyrings/corretto.gpg] https://apt.corretto.aws stable main" | sudo tee /etc/apt/sources.list.d/corretto.list
sudo apt update
sudo apt install -y java-11-amazon-corretto-jdk
echo 'JAVA_HOME="/usr/lib/jvm/java-11-amazon-corretto"' | sudo tee -a /etc/environment
source /etc/environment
```

#### 3. Install Apache Cassandra (Database)

Cassandra is used to store case data and observables.

```bash
wget -qO - https://downloads.apache.org/cassandra/KEYS | sudo gpg --dearmor -o /usr/share/keyrings/cassandra-archive.gpg
echo "deb [signed-by=/usr/share/keyrings/cassandra-archive.gpg] https://debian.cassandra.apache.org 40x main" | sudo tee /etc/apt/sources.list.d/cassandra.sources.list
sudo apt update
sudo apt install -y cassandra
```

#### 4. Install Elasticsearch (For Data Indexing)

Elasticsearch indexes and searches case data efficiently.

```bash
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elasticsearch-7.x.list
sudo apt update
sudo apt install -y elasticsearch
```

#### 5. Install TheHive

This installs TheHive from the official repository.

```bash
wget -O- https://archives.strangebee.com/keys/strangebee.gpg | sudo gpg --dearmor -o /usr/share/keyrings/strangebee-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/strangebee-archive-keyring.gpg] https://deb.strangebee.com thehive-5.2 main' | sudo tee -a /etc/apt/sources.list.d/strangebee.list
sudo apt update
sudo apt install -y thehive
```

### 👉 Cassandra Configuration&#x20;

We need to edit **Cassandra’s config file** so TheHive can connect properly.\
\
**Open the file in Nano:**

```bash
sudo nano /etc/cassandra/cassandra.yaml
```

* **Cluster Name** – Must match across nodes.\
  &#x20;

  <figure><img src="/files/XB4cnwjb0EyTLNva8XQC" alt="" width="563"><figcaption></figcaption></figure>
* **Seed Nodes** – Helps nodes discover each other.<br>

  <figure><img src="/files/jX3Tg8UGP2j0v5dyZGXd" alt="" width="563"><figcaption></figcaption></figure>
* **Listen Address** – Defines the IP address of the machine where TheHive is installed, ensuring proper communication.<br>

  <figure><img src="/files/Ap17h7zRXq2WRqKrJjH8" alt="" width="563"><figcaption></figcaption></figure>
* **RPC Address** – Allows client connections.<br>

  <figure><img src="/files/Du7MtRWX33WnH2mn3Q5T" alt="" width="563"><figcaption></figcaption></figure>

**🔔Without these steps, TheHive won’t store or retrieve data correctly.**&#x20;

### Now, we should restart Cassandra service:

```bash
sudo systemctl stop cassandra 
sudo systemctl start cassandra  
sudo systemctl enable cassandra  
```

### 👉We need to edit **Elasticsearch’s configuration** to:

open the config file:

```bash
nano /etc/elasticsearch/elasticsearch.yml
```

We need to edit these in **Elasticsearch** to ensure proper setup and stability:

1. **Cluster Name** – Identifies your Elasticsearch cluster. All nodes must have the same name to communicate.<br>

   <figure><img src="/files/oDIYqQ1qAvof9e0j68EE" alt=""><figcaption></figcaption></figure>
2. **Node Name** – Gives each node a unique identity for tracking and troubleshooting.<br>

   <figure><img src="/files/ECtSUAq5cQqcnBX3oLoW" alt=""><figcaption></figcaption></figure>
3. **Network Host** – Defines the IP address Elasticsearch binds to, allowing remote access if needed.<br>

   <figure><img src="/files/PXYy6dYMoZfqH1hQ5x6g" alt=""><figcaption></figcaption></figure>
4. **Cluster Initial Master Node** – Specifies the first master node in the cluster, ensuring proper election and stability.<br>

   <figure><img src="/files/y3PE0yGZZBzcWMJWpuIb" alt=""><figcaption></figcaption></figure>

**Now, start and enable Elasticsearch:**

```bash
sudo systemctl stop elasticsearch
sudo systemctl start elasticsearch  
sudo systemctl enable elasticsearch  
```

## Setting Up TheHive&#x20;

### Update Ownership of TheHive Directory

Before modifying TheHive's configuration, update the <mark style="color:yellow;">ownership</mark> of the `/opt/thp`directory by assigning it to the `thehive` user and group:

```bash
chown -R thehive:thehive /opt/thp
```

<figure><img src="/files/dV3c9cW7K10JP4fzo3fI" alt=""><figcaption></figcaption></figure>

### Modify TheHive Configuration

Edit TheHive configuration file:

```
nano /etc/thehive/application.conf
```

<figure><img src="/files/PIz1t2nobKo6ktWMRody" alt="" width="563"><figcaption></figcaption></figure>

**Now, start and enable TheHive:**

```bash
sudo systemctl start thehive
sudo systemctl enable thehive
```

\
\
\
Now, access TheHive by visiting🔗 <http://192.168.64.20:9000\\> <br>

<figure><img src="/files/ypB0i4GZHx14iFyfpXOq" alt=""><figcaption></figcaption></figure>

**Log in to TheHive with the default credentials:**

* **Username**: `admin@thehive.local`
* **Password**: `secret`<br>

  <figure><img src="/files/ITHtJFCCTxyySYmbR7Om" alt="" width="563"><figcaption></figcaption></figure>

**👉 Troubleshooting Hive Login Issues**

* If login fails, check Elasticsearch status: `systemctl status elasticsearch`
* If Elasticsearch is down, create a custom JVM options file:
  * `nano /etc/elasticsearch/jvm.options.d/jvm.options`
  * Set Java memory allocation to **2GB**:

    ```
    -Dlog4j2.formatMsgNoLookups=true
    -Xms2g
    -Xmx2g
    ```
  * **Restart Elasticsearch**:

    ```bash
    systemctl restart elasticsearch
    ```
  * **Check Status**:

    ```bash
    systemctl status elasticsearch
    ```

> Setting Java memory to **2GB** (`-Xms2g -Xmx2g`) prevents crashes, improves performance, and avoids excessive RAM usage. It ensures Elasticsearch runs smoothly without overloading the system

## **👉 Now, we should install Wazuh Agent on Windows 10**

<figure><img src="/files/cwyk6FevBeWIKbYyxS5I" alt="" width="563"><figcaption></figcaption></figure>

* **Select the package to download and install on your system:**<br>

  <figure><img src="/files/Wq1fZni7qU036wn5xUx5" alt="" width="563"><figcaption></figcaption></figure>
* **Assign the Wazuh server IP or FQDN:**&#x20;

  <figure><img src="/files/Wu7W4LSy0oOB56pFaHAt" alt=""><figcaption></figcaption></figure>
* ### **Assign Agent Name (**&#x54;his cannot be changed late&#x72;**):**

  <figure><img src="/files/bgAeVYSIvXPPdPo4GYU4" alt=""><figcaption></figcaption></figure>
* **Run the following commands to download and install the agent:**
  1. Open PowerShell as admin.
  2. Run this command:

     ```powershell
     Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.11.1-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='192.168.64.10' WAZUH_AGENT_NAME='osamaagent' 
     ```
  3. **Start the agent:**

     ```powershell
     NET START WazuhSvc
     ```

<figure><img src="/files/hA1UFxz60l3a7zJeGpwG" alt=""><figcaption></figcaption></figure>

<mark style="color:yellow;">Replace</mark> `<your_wazuh_server_ip>` <mark style="color:yellow;">with your Wazuh server IP and</mark> `<agent_name>` <mark style="color:yellow;">with the name of your Windows machine.</mark><br>

* **To check if the Wazuh agent is running on Windows:**<br>

  <figure><img src="/files/iCZGHmdHn6reEmMpxkiN" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/SQp3IsO6RCl0xusDVOYL" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://osamaa.gitbook.io/osama_homepage/cybersecurity-soc-analyst-labs/automation-lab-home-project/wazuh-and-thehive-installation-configuration-and-optimization.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.