Monday, 9 September 2024

Monitoring Windows and Active Directory using Wazuh and Zabbix

Wazuh is a great tool for security monitoring (SIEM). Thanks to it, I have a centralized environment that takes care of threat detection, file integrity monitoring, log analysis, vulnerability detection and malware identification.
Zabbix, on the other hand, complements Wazuh. While Wazuh focuses mainly on security, monitoring what's happening from a security perspective on our devices, Zabbix is useful for more administrative tasks. With Zabbix, we can check if anything is happening, if the disks are filling up, if the server temperatures are rising, and so on. From an administrative point of view, it allows us to check everything in one place and keep it handy. Not many people know that Zabbix is also great for security. It can check logs for failed login attempts or changes in files, for example.