Appendix
Appendix B — Wazuh Administrator Command Reference
B.1 Purpose
This appendix is a quick-reference for the file paths, log locations, and commands you will use constantly once you move past guided labs and start operating and troubleshooting the SOC on your own. Every path and command below has been verified against the official Wazuh 4.14.x, Suricata, and Emerging Threats Open documentation. Keep this appendix open in a second window during labs — it is meant to be looked up, not memorized.
B.2 Top Wazuh File Paths and What They Do
| Category | File / Directory | Default Path | Purpose |
|---|---|---|---|
| Configuration | Main manager/agent config | /var/ossec/etc/ossec.conf |
Primary configuration file for the Wazuh Manager or Agent — log collection, rule paths, integrations, alert thresholds. |
| Configuration | API configuration | /var/ossec/api/configuration/api.yaml |
Configuration for the Wazuh Server RESTful API (port 55000). |
| Custom Rules | Local rules file | /var/ossec/etc/rules/local_rules.xml |
Where you write custom detection rules. Persists across upgrades. |
| Custom Rules | Local rules directory | /var/ossec/etc/rules/ |
Additional custom rule files for larger, structured changes (multiple XML files loaded automatically). |
| Custom Decoders | Local decoder file | /var/ossec/etc/decoders/local_decoder.xml |
Where you write custom decoders. Persists across upgrades. |
| Custom Decoders | Local decoder directory | /var/ossec/etc/decoders/ |
Additional custom decoder files. |
| Vendor Ruleset | Default rules | /var/ossec/ruleset/rules/ |
Out-of-the-box Wazuh rules. Never edit — overwritten on every upgrade. |
| Vendor Ruleset | Default decoders | /var/ossec/ruleset/decoders/ |
Out-of-the-box Wazuh decoders. Never edit — overwritten on every upgrade. |
| Logs | Manager operational log | /var/ossec/logs/ossec.log |
The first place to look when anything misbehaves — startup errors, rule compilation errors, agent connection issues. |
| Logs | Alerts (JSON) | /var/ossec/logs/alerts/alerts.json |
Every generated alert (rule level ≥ 3 by default) in structured JSON. |
| Logs | Alerts (human-readable) | /var/ossec/logs/alerts/alerts.log |
Same alerts as above, plain-text format. |
| Logs | Archives (all events) | /var/ossec/logs/archives/archives.json |
Every event received, whether or not it generated an alert. Must be enabled in ossec.conf (the [logall_json] setting). Essential for threat hunting. |
| Binaries | Administrative tools | /var/ossec/bin/ |
Contains wazuh-control, manage_agents, agent_control, wazuh-logtest, agent_upgrade, and other CLI utilities. |
| Runtime | Internal sockets | /var/ossec/queue/sockets/ |
Unix sockets used for inter-daemon communication. Rarely touched directly, but relevant when diagnosing daemon-level failures. |
B.3 Wazuh Commands Every Administrator Should Know
| Task | Command | Notes |
|---|---|---|
| Check all daemon status | sudo /var/ossec/bin/wazuh-control status |
Reports the status of every Wazuh sub-daemon (analysisd, remoted, etc.), not just the systemd unit. |
| Start / stop / restart (control script) | sudo /var/ossec/bin/wazuh-control start |
stop |
| Start / stop / restart (systemd, Manager) | sudo systemctl start | stop |
| Start / stop / restart (systemd, Agent) | sudo systemctl start | stop |
| Check version | /var/ossec/bin/wazuh-control info |
Prints WAZUH_VERSION, WAZUH_REVISION, WAZUH_TYPE. Run on both Manager and Agent when troubleshooting version mismatches. |
| Test a rule/decoder against a sample log | /var/ossec/bin/wazuh-logtest |
Interactive sandbox — paste a log line, see exactly which decoder and rule matched, without generating live traffic. Use -v for verbose output. |
| List all agents and their status | /var/ossec/bin/agent_control -l |
Shows Active / Pending / Disconnected / Never connected for every registered agent. |
| Add, remove, or list agents (legacy CLI) | /var/ossec/bin/manage_agents |
Interactive menu-driven tool; still fully supported, though the Dashboard or API is more common for day-to-day management. |
| Upgrade a specific agent | /var/ossec/bin/agent_upgrade -a [agent_id] |
Remotely upgrades an agent’s package version; agent must be Active. |
| Tail the operational log live | sudo tail -f /var/ossec/logs/ossec.log |
Your first move whenever something “isn’t working” and you don’t know why yet. |
| Tail alerts live | sudo tail -f /var/ossec/logs/alerts/alerts.json |
Confirms whether alerts are actually being generated, independent of the Dashboard. |
B.4 Top Linux IP and Networking Commands
These are the commands you’ll reach for constantly while validating the Ubuntu sensor’s dual-NIC configuration and troubleshooting Suricata visibility.
| Task | Command | Notes |
|---|---|---|
| Show all interfaces and IP addresses | ip addr (or ip -br addr for a compact view) | Replaces the deprecated ifconfig. Confirms both NICs are up and correctly addressed. |
| Show link-layer state (including promiscuous mode) | ip link show [interface] | Look for the PROMISC flag on your monitoring interface (e.g., ens192). |
| Enable promiscuous mode manually | sudo ip link set [interface] promisc on | Needed if the monitoring interface isn’t capturing mirrored traffic — Suricata cannot see what the NIC doesn’t accept. |
| Show the routing table | ip route | Confirms which interface handles the default route versus which is dedicated to monitoring only. |
| Show interface statistics | ip -s link show [interface] | Packet/byte/error counters — useful for confirming traffic is actually arriving on the monitoring NIC. |
| Test basic connectivity | ping -c 4 [IP] | Always test in this order: gateway → Wazuh Server → public IP → DNS hostname, to isolate the failing layer. |
| Show open ports and listening sockets | ss -tulnp | Modern replacement for netstat; confirms Wazuh Manager is listening on 1514/1515 and the Dashboard on 443. |
| Capture live packets on an interface | sudo tcpdump -i [interface] | The ground-truth check: if tcpdump sees no packets, Suricata cannot possibly generate an alert — the problem is upstream of Suricata entirely. |
| Test a specific TCP port is reachable | nc -vz IP port | Quick pass/fail check, e.g., nc -vz 192.168.1.30 1514 to confirm the Wazuh Agent port is reachable. |
| Show DNS resolution | resolvectl status (Ubuntu 26.04, systemd-resolved) | Confirms which DNS servers are in use and whether resolution is functioning. |
B.5 Top Suricata File Paths and Commands
| Category | File / Directory | Default Path | Purpose |
|---|---|---|---|
| Configuration | Main config file | /etc/suricata/suricata.yaml |
Controls interfaces, HOME_NET/EXTERNAL_NET, rule paths, logging, and performance tuning. |
| Rules | Custom/local rules | /etc/suricata/rules/local.rules |
Where you write your own signatures. Never overwritten by suricata-update. |
| Rules | Downloaded/compiled ruleset | /var/lib/suricata/rules/suricata.rules |
The combined, active ruleset produced by suricata-update (includes Emerging Threats Open by default). |
| Logs | Structured event/alert log | /var/log/suricata/eve.json |
The most important Suricata output file — structured JSON alerts and metadata, monitored by the Wazuh Agent. |
| Logs | Simplified alert log | /var/log/suricata/fast.log |
Lightweight, single-line-per-alert log (if enabled in suricata.yaml). |
| Logs | Operational log | /var/log/suricata/suricata.log |
Startup messages, rule-loading errors, and engine diagnostics — check this first if Suricata won’t start. |
| Logs | Runtime statistics | /var/log/suricata/stats.log |
Periodic engine performance counters (packets processed, dropped, etc.). |
| Task | Command | Notes |
|---|---|---|
| Test configuration syntax | sudo suricata -T -c /etc/suricata/suricata.yaml |
Always run before restarting the service after any config change. |
| Check package version | suricata --build-info |
Shows version, build options, and capture method. |
| Check service status | sudo systemctl status suricata | Confirms the process is running — but not proof it’s inspecting packets. |
| Restart after a config or rule change | sudo systemctl restart suricata | Required to load new rules or config changes. |
| Watch live alerts | sudo tail -f /var/log/suricata/eve.json |
The definitive test: generate traffic, watch for a new JSON record here. |
| Query the running engine (uptime, stats) | sudo suricatasc -c uptime | Talks to the Suricata unix socket for live engine queries without restarting. |
B.6 Top Emerging Threats (ET Open) File Paths and Commands
| Category | File / Directory | Default Path | Purpose |
|---|---|---|---|
| Rule source config | suricata-update configuration | /etc/suricata/update.yaml |
Controls which rule sources (including ET Open) suricata-update downloads. |
| Enabled/staged rules | Staging directory | /var/lib/suricata/update/ |
Intermediate location where suricata-update stages downloaded rules before compiling them into suricata.rules. |
| Final compiled ruleset | Active rules | /var/lib/suricata/rules/suricata.rules |
The file Suricata actually loads at runtime — the combined output of every enabled source, including ET Open. |
| Task | Command | Notes |
|---|---|---|
| Download/update rules (includes ET Open by default) | sudo suricata-update | Always follow with a config test and service restart — an update alone does not reload the running engine. |
| List available rule sources | sudo suricata-update list-sources | Shows all community and commercial sources suricata-update can pull from. |
| List currently enabled sources | sudo suricata-update list-enabled-sources | Confirms ET Open is actually active. |
| Enable a specific source | sudo suricata-update enable-source et/open | Explicitly enables Emerging Threats Open if it isn’t already the default. |
| Full safe update workflow | sudo suricata-update && sudo suricata -T -c /etc/suricata/suricata.yaml && sudo systemctl restart suricata |
The complete, safe sequence: update → validate → restart. Never skip the validation step. |
B.7 Best Practice
Bookmark this appendix, but don’t stop here. Run suricata-update --help, wazuh-logtest -h, and man ip yourself early in the course. The fastest way to become a self-sufficient analyst is to get comfortable reading a tool’s own help output instead of relying exclusively on a reference sheet — this appendix is a starting point for muscle memory, not a substitute for it.
Version 5 Page ofAlerts to Answers