01 Wazuh SOC lab overview
The Wazuh server runs inside a pre-built virtual machine (OVA) on VirtualBox — no Linux setup, no installation commands, just import and start. A Wazuh Agent installed on Windows automatically ships Security Event Logs to it. Kali (WSL2) runs attacks against Windows. You detect everything in the Wazuh web dashboard.
monitored endpoint
VirtualBox runs here
:1514
Manager + Indexer
Dashboard :443
nmap · hydra
no Wazuh here
We monitor the Windows machine — specifically its Windows Security Event Logs. The Wazuh Agent reads these automatically and ships them to the Wazuh VM. Wazuh has hundreds of built-in detection rules so alerts fire without writing any rule logic.
| Component | Where it runs | What it does |
|---|---|---|
| Wazuh OVA (VM) | VirtualBox on Windows | The SIEM — Manager + Indexer + Dashboard all pre-installed. Access dashboard at https://<VM-IP> |
| Wazuh Agent | Windows (native service) | Collects Security, System, and App event logs automatically and ships them to the VM on port 1514 |
| Kali Linux (WSL2) | WSL2 only | The attacker — runs nmap and hydra only. Nothing else installed here. |
RAM: 8 GB minimum — 4 GB allocated to Wazuh VM, rest for Windows + WSL2 · Disk: 50 GB free (OVA is ~4 GB, expands to ~20 GB) · OS: Windows 10/11 64-bit · CPU: Hardware virtualisation enabled in BIOS (Intel VT-x or AMD-V) · WSL2 with Kali installed
02 Wazuh OVA, VirtualBox and agent downloads
Everything is free. No accounts or licences required.
wazuh-agent-4.9.2-1.msi file from the link in Section 02.Wazuh OVA → wazuh-4.14.4.ova (~4 GB)
VirtualBox — Windows → VirtualBox-7.2.6a-Win.exe
VirtualBox — macOS Intel → VirtualBox-7.2.6-OSX.dmg
VirtualBox — macOS Apple Silicon → VirtualBox-7.2.6-macOSArm64.dmg
Wazuh Agent (Windows) → wazuh-agent-4.9.2-1.msi
nmap and hydra → installed via apt on Kali, no download needed
03 Install the Wazuh OVA and connect the Windows agent
Download and run the VirtualBox installer for Windows hosts. Accept all defaults during installation. Restart Windows if prompted.
If VirtualBox shows an error about virtualisation not being enabled, restart your PC, enter BIOS/UEFI settings, and enable Intel VT-x or AMD-V. The option is usually under Advanced CPU settings.
Download the OVA file from the link in Section 02. It is approximately 4 GB — this will take a few minutes.
Once downloaded, import it into VirtualBox:
File → Import Appliance → browse to the downloaded wazuh-4.14.4.ova file → Next → Import
The import takes 2–5 minutes. Leave all settings at their defaults during import.
After import, select the VM → Settings → Display → Graphics Controller → change to VMSVGA. Using any other controller will freeze the VM window.
The Wazuh VM must be on the same network as your Windows machine so the agent can reach it. Set the network adapter to Bridged:
Select the Wazuh VM → Settings → Network → Adapter 1 → Attached to: Bridged Adapter → Name: select your active Windows network adapter → OK
Click Start in VirtualBox to boot the Wazuh VM. Wait for the boot to complete (1–2 minutes) until you see the login prompt.
Log in to the VM console with these credentials:
Username: wazuh-user Password: wazuh
Once logged in, get the VM's IP address — you need this for the agent and the dashboard:
ip addr show | grep "inet " | grep -v 127.0.0.1
Note the IP shown (e.g. 192.168.x.x). This is your Wazuh Server IP — write it down. You will use it in the agent installation and to access the dashboard.
On your Windows machine, open a browser and navigate to the Wazuh VM's IP address:
https://192.168.x.x
Your browser will show a certificate warning — click Advanced → Proceed. This is expected for the self-signed lab certificate.
Username: admin Password: admin
You see the Wazuh home screen with the Overview panel. It will show 0 agents connected — that is correct at this stage. The agent comes next.
Open PowerShell as Administrator and run the silent install. Replace 192.168.x.x with your Wazuh VM IP from Step 4:
# Install the agent — replace 192.168.x.x with your Wazuh VM IP
msiexec.exe /i wazuh-agent-4.9.2-1.msi /q `
WAZUH_MANAGER="192.168.x.x" `
WAZUH_AGENT_NAME="Windows-Lab"
Start the agent service:
NET START WazuhSvc
Verify it is running:
Get-Service WazuhSvc
Go to Wazuh Dashboard → Agents. You should see Windows-Lab listed with status Active within 1–2 minutes. Windows Security Events will begin flowing immediately once the agent connects.
Open your Kali WSL2 terminal. This is the only thing installed on Kali for this lab:
sudo apt update && sudo apt install -y nmap hydra
Every attack command targets the Windows machine IP. Get it from Kali:
cat /etc/resolv.conf | grep nameserver
The IP shown (usually 172.x.x.x) is your Windows host. Write it down — every attack command uses this IP.
Wazuh VM IP (Step 4, e.g. 192.168.x.x) — used when installing the agent and accessing the dashboard.
Windows host IP (Step 8, e.g. 172.x.x.x) — used as the attack target in hydra and nmap commands.
04 Attack with Kali, detect in the Wazuh dashboard
This lab simulates real attacker behaviour instead of brute force noise. Each exercise represents a stage of an attack lifecycle.
powershell -ExecutionPolicy Bypass -Command "Start-Process cmd"
data.win.system.eventID: 4688
schtasks /create /tn "Updater" /tr "cmd.exe" /sc minute /mo 5
data.win.system.eventID: 4698
net user backdoor P@ssword123 /add net localgroup administrators backdoor /add
data.win.system.eventID: 4720 OR data.win.system.eventID: 4732
sc.exe create "WindowsUpdateHelper" binPath= "C:\Windows\Temp\update.exe" start= auto
data.win.system.eventID: 7045
wevtutil cl Security
data.win.system.eventID: 1102
05 Uninstall the Wazuh agent and VM
Run through these steps after your test run to get back to a clean slate. Once done, the machine will be in exactly the same state as before — ready to redo the lab in class.
Stop the agent before uninstalling it, and power off the VM before deleting it. Skipping the stop steps can leave orphaned processes.
# Stop the agent service NET STOP WazuhSvc # Uninstall the agent via MSI — finds and removes it automatically $agent = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Wazuh Agent*" } if ($agent) { msiexec.exe /x $agent.IdentifyingNumber /qn /norestart Write-Host "Wazuh Agent removed." } else { Write-Host "Wazuh Agent not found." }
Or uninstall manually: Settings → Apps → search "Wazuh" → Wazuh Agent → Uninstall
# Remove agent installation folder Remove-Item -Path "C:\Program Files (x86)\ossec-agent" -Recurse -Force -ErrorAction SilentlyContinue # Confirm it is gone Test-Path "C:\Program Files (x86)\ossec-agent" # Should return: False
1. Right-click the Wazuh VM in the list → Close → Power Off (if it is running)
2. Right-click the VM → Remove → Delete all files
This deletes the VM and all its disk files. The OVA download file itself is kept — you can reimport it for the next session without re-downloading.
# Check agent service is gone — should return an error Get-Service WazuhSvc -ErrorAction SilentlyContinue # Check agent folder is gone — should return False Test-Path "C:\Program Files (x86)\ossec-agent"
Get-Service returns nothing (or "not found") and Test-Path returns False. The VM is deleted in VirtualBox. The machine is back to its original state.
# Remove attack tools if you want a fully clean attacker machine
sudo apt remove -y nmap hydra && sudo apt autoremove -y
| # | Action | How | Done? |
|---|---|---|---|
| 1 | Stop Wazuh Agent service | NET STOP WazuhSvc | ☐ |
| 2 | Uninstall Wazuh Agent | MSI script or Settings → Apps | ☐ |
| 3 | Delete agent folder | Remove-Item C:\Program Files (x86)\ossec-agent | ☐ |
| 4 | Power off Wazuh VM | VirtualBox → Close → Power Off | ☐ |
| 5 | Delete Wazuh VM | VirtualBox → Remove → Delete all files | ☐ |
| 6 | Verify clean state | Get-Service + Test-Path return empty / False | ☐ |
| 7 | Remove Kali tools (optional) | sudo apt remove nmap hydra | ☐ |
The OVA file is still on your disk. For the next session: re-import it into VirtualBox (Step 2–5 of Installation), reinstall the agent pointing to the new VM IP, and you are back to a fresh lab in under 10 minutes.
06 Wazuh lab FAQ
The questions people search for most before and during this lab. Every answer points back to the section that covers it in full.
What are the Wazuh OVA default credentials?
Two logins. The VM console (VirtualBox window) is wazuh-user / wazuh. The Wazuh dashboard at https://<VM-IP> is admin / admin. Both are documented in section 03. Change them if the VM is reachable from anything other than your own machine.
Where do I download the Wazuh OVA for VirtualBox?
From the official Wazuh site: the file is wazuh-4.14.4.ova, about 4 GB. Section 02 has the direct link. Import it with VirtualBox → File → Import Appliance. The OVA already contains the Wazuh Manager, Indexer and Dashboard, so there is no Linux install to do.
What are the system requirements for the Wazuh VM?
Windows 10 or 11 (64-bit) with hardware virtualisation enabled in the BIOS, 8 GB RAM (4 GB goes to the Wazuh VM), and about 50 GB free disk. The OVA is 4 GB on download and expands to roughly 20 GB once imported.
Which Windows event IDs does this Wazuh lab detect?
Section 04 walks through five: 4625 failed logons from a hydra brute force, 4688 process creation for PowerShell abuse, 4698 scheduled task creation, 7045 a new service installed, and 1102 the Security log being cleared. Wazuh's built-in Windows rules alert on each of them, so you do not write any custom rules.
How does the Windows agent connect to the Wazuh VM?
The agent runs as the WazuhSvc Windows service and ships Security, System and Application event logs to the VM's IP on port 1514. The dashboard is served on port 443. If nothing appears, check NET START WazuhSvc and confirm the manager IP in the agent config matches the VM IP.
Is the Wazuh SOC lab free?
Yes. Wazuh, VirtualBox, Kali Linux, nmap and hydra are all free and open source. No accounts, trials or licences are needed, and section 05 shows how to remove everything cleanly afterwards.