Appendix

Appendix D — SOC Operational Readiness Validation (ORV) Troubleshooting and Recovery Guide

Purpose

Use this guide when a step in Appendix C — ORV Validation Procedure and Checklist does not produce the expected result.

Troubleshooting Rule

Always troubleshoot in this order:

Verify the service is running.
Verify the event is generated locally.
Verify the Wazuh Agent is running.
Verify the event appears in the Wazuh Dashboard.

Problem 1 — Wazuh Dashboard Will Not Open

Possible Causes

Wazuh services not running
Incorrect server IP address
Network connectivity problem

Verify

On the Wazuh Server:

::: {custom-style="CodeLabel"} WAZUH-SRV · Terminal :::

sudo /var/ossec/bin/wazuh-control status

Verify all services are running.

Check the server IP address.

::: {custom-style="CodeLabel"} WAZUH-SRV · Terminal :::

ip addr

From WIN11:

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

ping 192.168.1.30

Corrective Action

Restart Wazuh.

::: {custom-style="CodeLabel"} WAZUH-SRV · Terminal :::

sudo /var/ossec/bin/wazuh-control restart

Wait one minute and try the Dashboard again.

Problem 2 — Wazuh Agent Shows “Disconnected”

Possible Causes

Agent service stopped
Network connectivity issue
Incorrect Wazuh Manager IP

Verify

Windows

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Get-Service WazuhSvc

Ubuntu

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo systemctl status wazuh-agent

Expected:

Running

Corrective Action

Restart the agent.

Windows

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Restart-Service WazuhSvc

Ubuntu

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo systemctl restart wazuh-agent

Refresh the Dashboard.

Problem 3 — No Sysmon Events in Event Viewer

Possible Causes

Sysmon not running
Configuration not loaded
Test commands not executed

Verify

::: {custom-style="CodeLabel"} WIN11 · PowerShell (Administrator) :::

Get-Service Sysmon64

Verify the configuration.

::: {custom-style="CodeLabel"} WIN11 · PowerShell (Administrator) :::

cd C:\Sysmon
.\Sysmon64.exe -c

Open:

Event Viewer

Applications and Services Logs Microsoft Windows Sysmon Operational

Verify Event IDs:

Corrective Action

Reload the configuration.

::: {custom-style="CodeLabel"} WIN11 · PowerShell (Administrator) :::

.\Sysmon64.exe -c .\export.xml

Repeat the Sysmon validation commands.

Problem 4 — Sysmon Events Not Visible in Wazuh

Possible Causes

Wazuh Agent not collecting Sysmon
Agent service not restarted
Incorrect ossec.conf configuration

Verify

Confirm ossec.conf contains:

::: {custom-style="CodeLabel"} WIN11 · ossec.conf :::

<localfile>
  <location>Microsoft-Windows-Sysmon/Operational</location>
  <log_format>eventchannel</log_format>
</localfile>

Restart the Wazuh Agent.

::: {custom-style="CodeLabel"} WIN11 · PowerShell (Administrator) :::

Restart-Service WazuhSvc

Wait one minute.

Refresh the Dashboard.

Problem 5 — No Suricata Alert

Possible Causes

Suricata service stopped
Wrong monitoring interface
ET Open rules not installed
eve.json not updating

Verify

Check Suricata.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo systemctl status suricata

Verify packet capture.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo tcpdump -i ens192

Verify eve.json.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo tail /var/log/suricata/eve.json

Corrective Action

Update rules.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo suricata-update

Restart Suricata.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo systemctl restart suricata

Repeat the Nmap scan.

Problem 6 — No Packets in tcpdump

Possible Causes

Wrong network interface
Promiscuous mode disabled
VMware network configuration incorrect

Verify

Identify the interface.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

ip addr

Verify promiscuous mode.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

ip link show ens192

Expected:

PROMISC

Corrective Action

Enable promiscuous mode.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo ip link set ens192 promisc on

Verify the VMware network adapter is connected to the correct virtual network.

Problem 7 — Microsoft Defender Does Not Detect EICAR

Possible Causes

Microsoft Defender disabled
Real-time protection disabled
Incorrect test file downloaded

Verify

Open:

Windows Security

Virus & threat protection

Verify:

Real-time Protection = On

Download:

https://secure.eicar.org/eicar.com.txt

Download:

eicar.com

Corrective Action

Enable Microsoft Defender Real-time Protection and repeat the download.

Problem 8 — Defender Detects EICAR but Wazuh Shows Nothing

Possible Causes

Wazuh Agent disconnected
Defender events not being collected
Delay in log forwarding

Verify

Restart the Wazuh Agent.

::: {custom-style="CodeLabel"} WIN11 · PowerShell (Administrator) :::

Restart-Service WazuhSvc

Wait one minute.

Search the Dashboard for:

Microsoft Defender

EICAR

Corrective Action

Generate a new EICAR detection after restarting the agent.

Problem 9 – Nmap Scan Does Not Generate an ET Alert

Possible Causes

Incorrect destination IP
ET Open rules outdated
Wrong Suricata interface
Scan bypassed the monitored interface

Verify

Confirm the Windows IP address.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

ping 192.168.1.40

Verify packets.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo tcpdump -i ens192

Verify eve.json.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo tail /var/log/suricata/eve.json

Corrective Action

Update rules.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo suricata-update

Restart Suricata.

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo systemctl restart suricata

Repeat the scan.

Quick Health Check Commands

Run these first whenever the lab misbehaves; each verifies one link in the telemetry pipeline.

Command	Verifies
sudo systemctl status wazuh-manager wazuh-indexer wazuh-dashboard	All three server services (on WAZUH-SRV)
sudo systemctl status wazuh-agent	Agent service (Linux endpoints)
sudo systemctl status suricata	Sensor service (UB2604)
sudo tail -f /var/log/suricata/eve.json	Live Suricata event output
sudo tail -n 50 /var/ossec/logs/ossec.log	Manager/agent log for errors
sudo /var/ossec/bin/agent_control -lc	Connected agents (run on the Manager)
Get-Service WazuhSvc, Sysmon64	Windows agent and Sysmon services (PowerShell)

Wazuh Server

::: {custom-style="CodeLabel"} WAZUH-SRV · Terminal :::

sudo /var/ossec/bin/wazuh-control status

Ubuntu (u2604)

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo systemctl status wazuh-agent
sudo systemctl status suricata
sudo tail /var/log/suricata/eve.json
sudo tcpdump -i ens192

Windows 11 (win11)

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Get-Service WazuhSvc Get-Service Sysmon64

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Resolve-DnsName www.microsoft.com

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Invoke-WebRequest https://www.microsoft.com

ORV Troubleshooting Workflow

Step 1

Figure D-1

SOC Troubleshooting Sequence

Operational Best Practice

When troubleshooting any issue in the SOC, always work from the source toward the SIEM:

Verify the service (Wazuh, Sysmon, Suricata, or Microsoft Defender).
Verify the event exists locally (Event Viewer or eve.json).
Verify the Wazuh Agent is running and collecting the event.
Verify the event appears in the Wazuh Dashboard.

Following this process isolates problems quickly and reflects the standard troubleshooting methodology used by Security Operations Centers (SOCs) in enterprise environments.

    Version 5       Page  of

Alerts to Answers