The fleet under monitoring
Nine agents reporting into one Wazuh manager, spanning three operating systems. Everything from Ubuntu and Debian to Kali, Windows Server 2019, and Windows 10, all feeding the same console.
What I set out to do
- Stand up a real SIEM for security visibility across the whole lab
- Automate agent deployment wherever it was possible
- Aggregate the agent data for analysis and reporting
- Visualize it to actually see what was happening on the network
- Run a CIS benchmark to find and prioritize the security gaps
The CIS benchmark
A CIS benchmark scores a system against a hardening standard. Running one is how you find out where you stand before you start fixing things, so a first pass against a fresh system is expected to fail plenty. This baseline surfaced exactly what to work on:
CIS Ubuntu Linux 22.04 LTS Benchmark v1.0.0
Baseline scan, Nov 2023
The 104 failures aren't a grade, they're a to-do list. Each one is a specific, named hardening step the benchmark flagged, which is the entire reason to run it: turn a vague sense of "is this secure" into a concrete, prioritized list of gaps to close.
What came out of it
- Real-time security visibility and threat detection across the fleet
- Simplified agent deployment and centralized log management in one console
- Data analysis and visualizations that made network activity legible
- A CIS assessment that mapped the attack surface and gave a clear hardening roadmap
The stack
It running
Screenshots from the deployment: the agent fleet, the CIS benchmark result, and the Proxmox host it all runs on.
01 Nine agents enrolled across Linux, Windows, and macOS, all v4.6.0
02 The CIS Ubuntu 22.04 benchmark result inside Wazuh
03 The Proxmox host, SIEM running as VM 107 alongside the rest of the lab