# Wazuh & TheHive: Installation, Configuration, and Optimization

## **What is Wazuh?**

Wazuh is an **open-source Security Information and Event Management (SIEM) solution**. It helps monitor systems, detect threats, and respond to security incidents.

#### **Why Use Wazuh?**

✅ **Threat Detection** – Identifies malware, intrusions, and suspicious activity.\
✅ **Log Analysis** – Collects and analyzes logs from servers, networks, and applications.\
✅ **Compliance Monitoring** – Helps meet security standards (HIPAA, PCI-DSS, GDPR, etc.).\
✅ **Incident Response** – Detects and alerts on security events in real time.\
✅ **File Integrity Monitoring (FIM)** – Tracks changes in critical system files.\
✅ **Vulnerability Detection** – Scans for security weaknesses in systems and software.\
✅ **Free & Open-Source** – No licensing costs, highly customizable.



## **🔹 Wazuh Setup Guide**

#### Step 1: Connect to Your Linux Server via SSH

Open PowerShell or Command Prompt on Windows and run:

```
ssh username@server-ip
```

Replace:

* `username` → Your Ubuntu username (e.g., root or ubuntu).
* `server-ip` → The IP address of your Linux machine.

### **Step 2: Install Wazuh SIEM**

#### **1️⃣ Install Wazuh on Ubuntu**

Run the following command to download and install Wazuh:

```bash
curl -sO https://packages.wazuh.com/4.11/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
```

* This installs Wazuh **Indexers, Server, and Dashboard**.
* Once installed, the dashboard URL and login credentials will be displayed.

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FwfW8kx8jjOxAFSOmY2cE%2F332.png?alt=media&#x26;token=ea1fa395-1e19-450d-8bf7-2c3cdd5c6e3d" alt="" width="563"><figcaption></figcaption></figure>

#### **2️⃣ Access Wazuh Dashboard**

*   Open a web browser and enter:

    ```
    https://<your_wazuh_server_ip>
    ```
* Use the **default username:** `admin`
* The password is **randomly generated** during installation.
*   Now we can access the Wazuh dashboard.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F08YzbrTrDFbALzS9QUBJ%2Fimage.png?alt=media&#x26;token=2d659ae3-8630-433e-b3b5-42cda4b0c5de" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FQ071zcKUyoALOIL7DKFf%2Fimage.png?alt=media&#x26;token=e4494e77-4a26-4ac3-a431-95fafc763ed0" alt="" width="563"><figcaption></figcaption></figure>

## 👉Setting Up TheHive

## **What is TheHive?**

TheHive is an **open-source Security Incident Response Platform (SIRP)** that helps cybersecurity teams **detect, investigate, and respond** to security threats efficiently. It acts as a **central hub** for managing incidents, automating workflows, and enhancing collaboration.

### **Key Features:**

🔹 **Incident & Case Management** – Organize, track, and resolve security incidents effectively.\
🔹 **Alert Ingestion** – Collect alerts from Wazuh, SIEMs, IDS, and emails for centralized analysis.\
🔹 **Collaboration** – Multiple analysts can work together on cases in real time.\
🔹 **Threat Intelligence (Cortex Integration)** – Enrich investigations with automated intelligence gathering.\
🔹 **Automation & API Support** – Automate repetitive tasks to speed up response times.\
🔹 **Dashboards & Reporting** – Gain insights and track security incidents with visual reports.

### **Why Use TheHive?**

✅ Centralized management of security incidents.\
✅ Faster response through automation.\
✅ Improved teamwork and case tracking.\
\


**Now that we know TheHive is a powerful tool for security incident response, let's install and configure it for efficient case management and alert handling 👇**



### 👉 Installation Guide

Follow these steps to install TheHive on your system.

#### 1. Install Dependencies

These are required to ensure system compatibility and allow package installation.

```bash
sudo apt install wget gnupg apt-transport-https git ca-certificates ca-certificates-java curl software-properties-common python3-pip lsb-release
```

#### 2. Install Java 11 (Amazon Corretto)

TheHive requires Java 11 to run properly.

```bash
wget -qO- https://apt.corretto.aws/corretto.key | sudo gpg --dearmor -o /usr/share/keyrings/corretto.gpg
echo "deb [signed-by=/usr/share/keyrings/corretto.gpg] https://apt.corretto.aws stable main" | sudo tee /etc/apt/sources.list.d/corretto.list
sudo apt update
sudo apt install -y java-11-amazon-corretto-jdk
echo 'JAVA_HOME="/usr/lib/jvm/java-11-amazon-corretto"' | sudo tee -a /etc/environment
source /etc/environment
```

#### 3. Install Apache Cassandra (Database)

Cassandra is used to store case data and observables.

```bash
wget -qO - https://downloads.apache.org/cassandra/KEYS | sudo gpg --dearmor -o /usr/share/keyrings/cassandra-archive.gpg
echo "deb [signed-by=/usr/share/keyrings/cassandra-archive.gpg] https://debian.cassandra.apache.org 40x main" | sudo tee /etc/apt/sources.list.d/cassandra.sources.list
sudo apt update
sudo apt install -y cassandra
```

#### 4. Install Elasticsearch (For Data Indexing)

Elasticsearch indexes and searches case data efficiently.

```bash
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elasticsearch-7.x.list
sudo apt update
sudo apt install -y elasticsearch
```

#### 5. Install TheHive

This installs TheHive from the official repository.

```bash
wget -O- https://archives.strangebee.com/keys/strangebee.gpg | sudo gpg --dearmor -o /usr/share/keyrings/strangebee-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/strangebee-archive-keyring.gpg] https://deb.strangebee.com thehive-5.2 main' | sudo tee -a /etc/apt/sources.list.d/strangebee.list
sudo apt update
sudo apt install -y thehive
```

### 👉 Cassandra Configuration&#x20;

We need to edit **Cassandra’s config file** so TheHive can connect properly.\
\
**Open the file in Nano:**

```bash
sudo nano /etc/cassandra/cassandra.yaml
```

*   **Cluster Name** – Must match across nodes.\
    &#x20;

    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Fn272xcLenimXiKxckWvk%2F5.png?alt=media&#x26;token=02a28c10-5789-4c6f-8b37-30f93f8fe536" alt="" width="563"><figcaption></figcaption></figure>
*   **Seed Nodes** – Helps nodes discover each other.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F0ibpLuIcIuQ5fl8Z4MdJ%2F5.png?alt=media&#x26;token=e292604e-dd8a-4e36-a831-a92dc7099112" alt="" width="563"><figcaption></figcaption></figure>
*   **Listen Address** – Defines the IP address of the machine where TheHive is installed, ensuring proper communication.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Fx7AQ3lMvJjk034zFduFV%2F5.png?alt=media&#x26;token=c220897a-49e9-43cc-8a60-f0c7cfca433a" alt="" width="563"><figcaption></figcaption></figure>
*   **RPC Address** – Allows client connections.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FBtRPqkHUQj29j78eIfsU%2F5.png?alt=media&#x26;token=a3d8f368-92a7-49fd-a332-8a5d4382077c" alt="" width="563"><figcaption></figcaption></figure>

**🔔Without these steps, TheHive won’t store or retrieve data correctly.**&#x20;

### Now, we should restart Cassandra service:

```bash
sudo systemctl stop cassandra 
sudo systemctl start cassandra  
sudo systemctl enable cassandra  
```

### 👉We need to edit **Elasticsearch’s configuration** to:

open the config file:

```bash
nano /etc/elasticsearch/elasticsearch.yml
```

We need to edit these in **Elasticsearch** to ensure proper setup and stability:

1.  **Cluster Name** – Identifies your Elasticsearch cluster. All nodes must have the same name to communicate.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FC2uuqKZDesu0vz39P50Z%2Fimage.png?alt=media&#x26;token=d7e4ad10-65b1-4686-a6ed-13a2281b822a" alt=""><figcaption></figcaption></figure>
2.  **Node Name** – Gives each node a unique identity for tracking and troubleshooting.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Fn0K3E2K5xI1ZRB5mHnPZ%2Fimage.png?alt=media&#x26;token=94d37c6a-e776-4ccd-bf6d-dbfdb4aac931" alt=""><figcaption></figcaption></figure>
3.  **Network Host** – Defines the IP address Elasticsearch binds to, allowing remote access if needed.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FnNMgTqdhZnw2gBcTSvj0%2Fimage.png?alt=media&#x26;token=666ae5ad-5617-4f40-98f0-82eeffcd07e7" alt=""><figcaption></figcaption></figure>
4.  **Cluster Initial Master Node** – Specifies the first master node in the cluster, ensuring proper election and stability.\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FGnfmYbumik3Afq8Ay542%2Fimage.png?alt=media&#x26;token=181173d3-adf9-430b-9bbd-d2e7c6177fbb" alt=""><figcaption></figcaption></figure>



**Now, start and enable Elasticsearch:**

```bash
sudo systemctl stop elasticsearch
sudo systemctl start elasticsearch  
sudo systemctl enable elasticsearch  
```



## Setting Up TheHive&#x20;

### Update Ownership of TheHive Directory

Before modifying TheHive's configuration, update the <mark style="color:yellow;">ownership</mark> of the `/opt/thp`directory by assigning it to the `thehive` user and group:

```bash
chown -R thehive:thehive /opt/thp
```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Ff5iJ6Mqn2yDmmkOkWFWb%2F5.png?alt=media&#x26;token=b44ecd19-00a4-4eb2-a288-d77062d61845" alt=""><figcaption></figcaption></figure>

### Modify TheHive Configuration

Edit TheHive configuration file:

```
nano /etc/thehive/application.conf
```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F3PemxiE56iKTirT2nk28%2F5.png?alt=media&#x26;token=5d8cff9e-ada3-4267-9d32-644bbeefcf91" alt="" width="563"><figcaption></figcaption></figure>

**Now, start and enable TheHive:**

```bash
sudo systemctl start thehive
sudo systemctl enable thehive
```

\
\
\
Now, access TheHive by visiting🔗 http://192.168.64.20:9000\
\


<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FHfDZRs8yku2zPb9hqXev%2Fimage.png?alt=media&#x26;token=99ef202a-4407-43c6-a841-d90f2458d470" alt=""><figcaption></figcaption></figure>

**Log in to TheHive with the default credentials:**

* **Username**: `admin@thehive.local`
*   **Password**: `secret`\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F57MT7rgraybLjdrEEdEY%2Fimage.png?alt=media&#x26;token=62ceff54-eaa6-40d6-890f-83b4e9f24a77" alt="" width="563"><figcaption></figcaption></figure>

**👉 Troubleshooting Hive Login Issues**

* If login fails, check Elasticsearch status: `systemctl status elasticsearch`
* If Elasticsearch is down, create a custom JVM options file:
  * `nano /etc/elasticsearch/jvm.options.d/jvm.options`
  *   Set Java memory allocation to **2GB**:

      ```
      -Dlog4j2.formatMsgNoLookups=true
      -Xms2g
      -Xmx2g
      ```
  *   **Restart Elasticsearch**:

      ```bash
      systemctl restart elasticsearch
      ```
  *   **Check Status**:

      ```bash
      systemctl status elasticsearch
      ```



> Setting Java memory to **2GB** (`-Xms2g -Xmx2g`) prevents crashes, improves performance, and avoids excessive RAM usage. It ensures Elasticsearch runs smoothly without overloading the system



## **👉 Now, we should install Wazuh Agent on Windows 10**

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FoCBTH8UITQosoRXfvVDJ%2F4.png?alt=media&#x26;token=0e1dcdfc-b336-48c6-adf0-68bfbf20ce81" alt="" width="563"><figcaption></figcaption></figure>

*   **Select the package to download and install on your system:**\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FZ05xHqXR2gqNGmC4H2Iz%2F4.png?alt=media&#x26;token=a4b102c0-4406-4ebd-b979-59dcbaf60186" alt="" width="563"><figcaption></figcaption></figure>
*   **Assign the Wazuh server IP or FQDN:**&#x20;

    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FCM3d5beSLwtXWTjBpnUB%2Fimage.png?alt=media&#x26;token=ad9e103b-26e1-4dac-bf8b-15f5f97e7b25" alt=""><figcaption></figcaption></figure>
*   ### **Assign Agent Name (**&#x54;his cannot be changed late&#x72;**):**

    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FUnNUAUsRoySLQOodce43%2Fimage.png?alt=media&#x26;token=380c6d5e-f428-4371-8775-6fda90d09f9c" alt=""><figcaption></figcaption></figure>
* **Run the following commands to download and install the agent:**
  1. Open PowerShell as admin.
  2.  Run this command:

      ```powershell
      Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.11.1-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='192.168.64.10' WAZUH_AGENT_NAME='osamaagent' 
      ```
  3.  **Start the agent:**

      ```powershell
      NET START WazuhSvc
      ```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FxJ9WV9V03rNMKHrXCueI%2Fimage.png?alt=media&#x26;token=8f75fa8f-97b1-489a-b72f-8a36904d3e32" alt=""><figcaption></figcaption></figure>

<mark style="color:yellow;">Replace</mark> `<your_wazuh_server_ip>` <mark style="color:yellow;">with your Wazuh server IP and</mark> `<agent_name>` <mark style="color:yellow;">with the name of your Windows machine.</mark>\


*   **To check if the Wazuh agent is running on Windows:**\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FN0UPliu490oHc82FeWyz%2Fimage.png?alt=media&#x26;token=618b94f8-51e1-4d99-a509-16a5b6ce83d4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FySYbabJLVYuDK0rWftCo%2F1.png?alt=media&#x26;token=528e0fe1-517a-473e-a30a-16114e582a7c" alt=""><figcaption></figcaption></figure>

