Analyst Tools
Every detection in this book begins with a file or channel the agent is configured to read. This table maps each source to its ingest point, which is the first thing to verify when an expected alert does not appear.
| Source | Host | Ingest Point | Configured In |
|---|---|---|---|
| Suricata alerts and flows | UB2604 | /var/log/suricata/eve.json |
ossec.conf — <location>, json format |
| Linux authentication | UB2604 | /var/log/auth.log |
ossec.conf — <location>, syslog format |
| Linux authentication | WAZUH-SRV | /var/log/secure |
ossec.conf — <location>, syslog format |
| Kernel audit trail | UB2604 | /var/log/audit/audit.log |
ossec.conf — <log_format>audit</log_format> |
| Sysmon telemetry | WIN11 | Microsoft-Windows-Sysmon/Operational |
ossec.conf — eventchannel |
| Windows security events | WIN11 | Security |
ossec.conf — eventchannel |
| PowerShell script blocks | WIN11 | Microsoft-Windows-PowerShell/Operational |
ossec.conf — eventchannel |
| Defender detections | WIN11 | Microsoft-Windows-Windows Defender/Operational |
ossec.conf — eventchannel |
| Osquery scheduled results | UB2604 | /var/log/osquery/osqueryd.results.log |
ossec.conf — <wodle name="osquery"> |
| File integrity changes | All agents | syscheck database | ossec.conf — <syscheck> |
| YARA scan output | All agents | active-response script output | ossec.conf — <active-response> |
Windows Osquery ingestion
On WIN11, the Wazuh Osquery wodle defaults to C:\Program Files\osquery\log\osqueryd.results.log. Check the configured <log_path> and the Osquery filesystem logger settings together; a custom installation may use a different location. The Linux path in the table applies to UB2604, not WIN11.
Source: Wazuh Osquery wodle configuration.