Command monitoring
The most effective way to collect information about an endpoint is to run specific commands on the given endpoint, such as netstat (for network connections on Windows), ps (to collect process information from Linux machines), and so on. This information plays a vital role in collecting IOCs and running a successful threat-hunting program. The good news is that Wazuh has a built-in feature to monitor the output of specific Windows/Linux commands and show that output as log content. In this section, we will learn the following:
- How does command monitoring work?
- Monitoring Linux commands
- List of Linux commands for threat hunting and security Investigations
How does command monitoring work?
Wazuh runs commands on the endpoints using the Command and Logcollector modules, and then sends the results to the Wazuh server for examination. The following steps describe the process of command monitoring.
Step 1 – configuration
The process...
