Appendix

Appendix E — Resetting the Lab for a New Investigation

A Step-by-Step Student Walkthrough

This appendix walks you through resetting your lab to a clean state so you can start a new investigation. It is written to be followed exactly, in order, from top to bottom. If you do only what this appendix says, you cannot damage the lab.

Three reset scripts do the work for you. This appendix tells you exactly what to click and type to run them safely.

Read This First: The One Rule That Keeps Your Lab Safe

The three reset scripts clear old alerts and logs. They do not change any settings, rules, or configuration. They were written with safety guards built in:

Each script asks you to type RESET before it does anything. If you type anything else, it cancels and changes nothing.
Each script only ever clears log and alert data. None of them can edit a configuration file, a detection rule, or an agent registration.
The Wazuh Server script checks your password before it clears anything, and it can only ever clear alert data — never the system data the Dashboard needs.

The one rule: run the three scripts as described below, and do not manually edit, move, rename, or delete any other files. As long as you only run these scripts, the lab configuration stays exactly as your instructor set it up.

How This Works (The Short Version)

You do not need to understand every detail to run the reset, but a little context makes the steps make sense.

Your lab produces alerts in three places, which is why there are three scripts:

WIN11 records what happens on the Windows computer (Sysmon events).
UB2604 records what happens on the network (Suricata alerts).
WAZUH-SRV is the Wazuh Server. It collects everything and displays it on the Dashboard.

There is one more thing worth knowing. The Wazuh Server keeps alerts in two places at once: the log files on disk, and a separate search database called the Indexer — and the Indexer is what the Dashboard actually shows you. Clearing the log files alone would not clear the Dashboard, because the Dashboard reads from the Indexer. That is why the Wazuh Server script clears both, and why running all three scripts in order is what gives you a truly clean slate.

What You Need Before You Begin

Check that you have all of these before starting:

The three script files. Your instructor will tell you where to find them. They are:
Reset-Lab-WIN11_v18.ps1 (runs on the Windows machine)
reset-lab-ub2604_v18.sh (runs on the Ubuntu sensor)
reset-lab-wazuh-srv_v18.sh (runs on the Wazuh Server)
All four lab machines powered on — WAZUH-SRV, UB2604, WIN11, and SO14.
The Wazuh Indexer admin password. You will need this for the last script. If you do not have it, see “Getting the Indexer Password” in Section E.3.

Where to Find the Scripts

All three reset scripts are supplied with your course materials:

Script	Runs on
`Reset-Lab-WIN11_v18.ps1`	WIN11
`reset-lab-ub2604_v18.sh`	UB2604
`reset-lab-wazuh-srv_v18.sh`	WAZUH-SRV

Copy each script to the machine it runs on. A folder named LabReset in your home directory or on your Desktop works well, and the examples below assume that name. Your instructor may place them somewhere else — if so, use that path instead wherever an example shows LabReset.

Each script must be copied to its own machine. They are not interchangeable, and running one on the wrong host will simply fail without changing anything.

The Order Matters — Do Not Skip Around

You will reset the machines in this exact order:

WIN11 (the Windows endpoint) — Section E.1
UB2604 (the Ubuntu sensor) — Section E.2
Wait 60 seconds, then WAZUH-SRV (the Wazuh Server) — Section E.3
Verify everything worked — Section E.4

This order clears the machines that produce alerts first, then clears the server that collects them. Doing it in a different order can leave old alerts behind.

E.1 Reset the Windows Endpoint (WIN11)

Step 1 — Log in to WIN11

Switch to the WIN11 virtual machine and log in as you normally do for lab work.

Step 2 — Find the script

Locate the file Reset-Lab-WIN11_v18.ps1. It is supplied with your course materials (see Where to Find the Scripts above). Copy it to the WIN11 machine if it is not already there, and note the folder name — you will need it in a moment.

Step 3 — Open PowerShell as Administrator

This is important. The script needs Administrator rights to clear the log.

Click the Start button.
Type: PowerShell
When “Windows PowerShell” appears, right-click it and choose Run as administrator.
If Windows asks “Do you want to allow this app to make changes?”, click Yes.

You should now see a blue PowerShell window with the word Administrator in its title bar. If it does not say Administrator, close it and repeat this step.

Step 4 — Go to the folder that contains the script

In the PowerShell window, use the cd (“change directory”) command to move into the folder where the script is saved. For example, if the scripts are in a folder called LabReset on your Desktop, type:

::: {custom-style="CodeLabel"} WIN11 · PowerShell (Administrator) :::

cd $HOME\Desktop\LabReset

Press Enter. Replace the path with wherever your scripts actually are.

Step 5 — Allow the script to run (one time, this window only)

By default, Windows blocks PowerShell scripts. Run this command to allow scripts for this window only — it is temporary and safe, and it reverts the moment you close the window:

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

Press Enter. If it asks you to confirm, type Y and press Enter. This does not change any permanent Windows setting; the “-Scope Process” part means it only affects this one PowerShell window.

Step 6 — Run the script

Type the following exactly, including the . at the start, and press Enter:

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

.\Reset-Lab-WIN11_v18.ps1

Step 7 — Type RESET when asked

The script prints a summary of what it will do, then asks you to confirm. Type RESET (all capital letters) and press Enter.

If you type anything other than RESET, the script cancels safely and nothing changes — you can simply run it again.

Step 8 — Confirm success

You should see a green message similar to:

SUCCESS: Sysmon log cleared. (### events removed)

Checkpoint: WIN11 is done. Move on to Section E.2.

E.2 Reset the Ubuntu Sensor (UB2604)

Step 1 — Log in to UB2604

Switch to the UB2604 virtual machine and log in.

Step 2 — Open a terminal

Open a Terminal window (you can press Ctrl+Alt+T, or find Terminal in the applications menu).

Step 3 — Go to the folder that contains the script

Use cd to move into the folder where reset-lab-ub2604_v18.sh is saved. For example:

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

cd ~/LabReset

Press Enter. Replace the path with wherever your scripts actually are.

Step 4 — Make the script runnable (one time)

The first time you use a script on Linux, you must mark it as runnable. Type:

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

chmod +x reset-lab-ub2604_v18.sh

Press Enter. You only need to do this once per script; nothing visible happens, which is normal.

Step 5 — Run the script

Type the following exactly, including the ./ at the start, and press Enter:

::: {custom-style="CodeLabel"} UB2604 · Terminal :::

sudo ./reset-lab-ub2604_v18.sh

The word sudo runs the script with the administrator rights it needs. If Linux asks for your password, type it and press Enter (the password will not appear on screen as you type — that is normal).

Step 6 — Type RESET when asked

The script shows what it will do, then asks you to confirm. Type RESET and press Enter. Anything else cancels safely.

Step 7 — Confirm success

You should see lines similar to:

Emptied: /var/log/suricata/eve.json Emptied: /var/log/suricata/fast.log SUCCESS: eve.json is now empty (0 bytes).

Checkpoint: UB2604 is done. Now go to Section E.3.

E.3 Wait, Then Reset the Wazuh Server (WAZUH-SRV)

Step 1 — Wait 60 seconds

Before touching the Wazuh Server, wait about one minute. This gives any alerts that were still traveling from WIN11 and UB2604 time to arrive. Clearing the server too soon can leave a few old alerts behind. Just wait — do not do anything during this minute.

Step 2 — Log in to WAZUH-SRV and open a terminal

Switch to the WAZUH-SRV virtual machine, log in, and open a Terminal window.

Getting the Indexer Password

The last script needs the Wazuh Indexer admin password. This password was created when the lab was installed. If your instructor already gave it to you, skip ahead to Step 3.

To look it up yourself, type this on the Wazuh Server and press Enter:

::: {custom-style="CodeLabel"} WAZUH-SRV · Terminal :::

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Find the line for the admin user and copy the password shown next to it. Keep it handy for Step 5.

Step 3 — Go to the folder and make the script runnable

Move into the folder with the script, then mark it runnable (one time):

::: {custom-style="CodeLabel"} WAZUH-SRV · Terminal :::

cd ~/LabReset
chmod +x reset-lab-wazuh-srv_v18.sh

Press Enter after each line. Replace the path with wherever your scripts actually are.

Step 4 — Run the script

Type the following exactly and press Enter:

::: {custom-style="CodeLabel"} WAZUH-SRV · Terminal :::

sudo ./reset-lab-wazuh-srv_v18.sh

Step 5 — Enter the Indexer password

The script asks for the Wazuh Indexer admin password. Type (or paste) the password from “Getting the Indexer Password” and press Enter.

The password will not appear on screen as you type. This is normal and is done on purpose so nobody can read it over your shoulder. Just type it carefully and press Enter.

If you typed it wrong, the script stops with a message like “Could not authenticate to the Indexer (HTTP 401)” and changes nothing. Simply run the script again and re-enter the password.

Step 6 — Type RESET when asked

The script shows what it will do, then asks you to confirm. Type RESET and press Enter. Anything else cancels safely.

Step 7 — Confirm success

The script will:

Empty the flat log files.
Clear the indexed alerts (you will see a “Removed ### document(s)” message).
Show the alert indices with a docs.count near 0.
Show the Wazuh services, which should all be running.

Checkpoint: All three machines are reset. Now verify.

E.4 Verify Everything Worked

Step 1 — Open the Dashboard

On any machine with browser access, open the Wazuh Dashboard as you normally do and log in.

Step 2 — Check that old alerts are gone

Go to Security Events. You should see no events from your previous investigation. A clean, empty view means the reset worked.

Step 3 — Prove the lab still works with a test event

You want to confirm the reset cleared old data without breaking anything. Generate one fresh event. On WIN11, open PowerShell and run:

::: {custom-style="CodeLabel"} WAZUH-SRV · PowerShell :::

Resolve-DnsName www.microsoft.com

Within one to two minutes, this should appear in the Dashboard as a new event. If it appears, your lab is fully reset and working. You are ready to begin a new investigation.

If Something Goes Wrong

“…cannot be loaded because running scripts is disabled on this system” (Windows)

You skipped Step 5 in Section E.1, or you opened a new PowerShell window. Run this in the Administrator PowerShell window, then run the script again:

::: {custom-style="CodeLabel"} WAZUH-SRV · PowerShell :::

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

“Permission denied” (Ubuntu / Wazuh Server)

You either forgot sudo or forgot to make the script runnable. Make sure you ran the chmod line and that your command starts with sudo ./.

“command not found” (Ubuntu / Wazuh Server)

You left off the ./ at the start. The command must be sudo ./reset-lab-ub2604_v18.sh, not just the file name.

“Could not authenticate to the Indexer (HTTP 401)”

The Indexer password was wrong. Re-check it using the command in “Getting the Indexer Password,” then run the script again.

The script says “Cancelled. Nothing was changed.”

You typed something other than RESET at the confirmation prompt. This is the safety guard working correctly. Just run the script again and type RESET exactly, in capital letters.

“bad interpreter” or the Ubuntu script will not start at all

The script file may have Windows-style line endings from being copied between systems. Fix it once with the following, then run the script again:

::: {custom-style="CodeLabel"} WAZUH-SRV · Terminal :::

sudo sed -i 's/\r$//' reset-lab-ub2604_v18.sh

The Dashboard still shows old events

Make sure you ran all three scripts, in order, and that you waited the full 60 seconds before the Wazuh Server script. Refresh the Dashboard, and give it a minute to update.

Do Not Do These Things

These actions can break the lab. None of them are ever part of a reset:

Do not edit, rename, move, or delete any file other than by running the three scripts. The scripts handle everything safely on their own.
Do not open or change configuration files such as ossec.conf, suricata.yaml, local_rules.xml, or the Sysmon configuration.
Do not uninstall, reinstall, or reconfigure Sysmon, Suricata, or the Wazuh agent.
Do not remove or re-register any Wazuh agent.
Do not delete anything from the Wazuh Indexer by hand. The server script clears only what is safe to clear.

If you are ever unsure whether something is safe, stop and ask your instructor. Clearing data can always be done again; a changed configuration can be hard to repair.

Reset Quick Reference

Once you are comfortable with the steps, this is the whole reset:

Order	Machine	What you type
1	WIN11 (admin PowerShell)	`Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass then .\Reset-Lab-WIN11_v18.ps1`
2	UB2604 (terminal)	sudo ./reset-lab-ub2604_v18.sh
3	Wait 60 seconds	—
4	WAZUH-SRV (terminal)	sudo ./reset-lab-wazuh-srv_v18.sh
5	Dashboard	Confirm Security Events is empty, then run a test event

At every prompt, type RESET to continue. Anything else cancels safely. Remember the one rule: run the scripts, change nothing else, and your lab stays healthy.

    Version 5       Page  of