This analyst reference collects the tools used across Labs 0 through 9 and identifies the files, directories, registry keys, event channels, and commands that matter on each laboratory host. It is organized by machine because analysts normally begin with the system in front of them and ask where a setting, log, or executable resides on that platform.
Paths described as vendor-supplied or generated should be read but not edited because package upgrades can overwrite them. Entries that are specific to the Alerts to Answers laboratory are identified as lab-build paths. Vendor documentation is consolidated in Section G.7 and should be consulted when behavior differs from the version-pinned course environment.
How to Use This Reference
- Start with the host on which you are working.
- Locate the tool, configuration file, log, registry key, event channel, or command in that host section.
- Confirm whether the item is vendor-managed, generated, or intended for local customization before making a change.
- When expected telemetry does not reach Wazuh, use Section G.6 to trace the data source back to its ingest point.
- Use the version-pinned links in Section G.7 when vendor documentation is required.
Chapter and Lab Alignment
| Section | Primary purpose | Principal alignment |
|---|---|---|
| G.1 WAZUH-SRV | Manager, indexer, dashboard, rules, decoders, and integrations | Chapters 2–9; Labs 0–9 |
| G.2 UB2604 | Wazuh agent, Suricata sensor, Linux telemetry, and analysis tools | Chapters 3–6 and 9; Labs 0–9 |
| G.3 WIN11 | Endpoint telemetry, Sysmon, Defender, PowerShell, and forensic tools | Chapters 3–8; Labs 0, 0A, and 2–9 |
| G.4 SO14 | Security Onion host-level services and sensor access | Chapters 3, 5–7, and 9; Labs 0, 4, 6, 7, and 9 |
| G.5 Cross-Platform Tools | Tools and paths that appear on more than one host | Chapters 3–9; Labs 0–9 |
| G.6 Wazuh Data-Source Map | Telemetry source, host, ingest point, and configuration location | Chapters 2, 4–6, 8, and 9; Labs 0–9 |
| G.7 Vendor Documentation | Version-pinned product and platform documentation | All chapters and labs |