# SIEM and Log Management

## Wazuh (Open-Source SIEM/XDR)

Three components:
- Wazuh Indexer (OpenSearch-based)
- Wazuh Server (decoder/rule engine)
- Wazuh Dashboard (web UI)

Capabilities: log analytics, intrusion detection, FIM, configuration assessment, vulnerability detection, compliance.

Collects via agents (logs, system activity, file changes) and agentless (Syslog/SSH/APIs).

- Platform: https://wazuh.com/platform/siem/
- Threat hunting: https://documentation.wazuh.com/current/getting-started/use-cases/threat-hunting.html
- Guide: https://medium.com/@sadashivpole/wazuh-complete-guide-to-hids-siem-and-enterprise-threat-detection-120d376bfbc0
- Deploy 2025: https://www.onlinehashcrack.com/guides/tutorials/howto-deploy-wazuh-siem-2025-monitor-hosts.php

## Volatility Memory Forensics

V3 replaced V2. Supports Windows, Linux, macOS memory dumps. Detects fileless malware, kernel rootkits, process injection, in-memory C2.

Workflow: process triage (pstree, psscan) -> network triage (netscan) -> suspicious process analysis (dlllist, malfind) -> command history (cmdline, linux.bash)

- Guide: https://www.cyberforensicacademy.com/blog/volatility-framework-complete-memory-forensics-guide
- Cheat sheet: https://medium.com/@0x0Aleem/practical-memory-forensics-with-volatility-2-3-windows-and-linux-cheat-sheet-ef5eee325863

## Container Security Scanning

### Trivy
Comprehensive: vulnerabilities, misconfigs, secrets, SBOM generation. Broader scope, slightly slower.

### Grype
Focused vuln scanner, 30-40% faster than Trivy. Pairs with Syft for SBOM.

Both produce false positives/negatives. Do not treat as authoritative alone.

- Grype: https://github.com/anchore/grype
- Comparison: https://www.stakater.com/post/open-source-container-security-a-deep-dive-into-trivy-clair-and-grype

## Supply Chain

- SLSA Framework: four levels of build integrity assurance
- Reproducible builds: https://reproducible-builds.org/
- SBOM to SLSA guide: https://petronellatech.com/blog/from-sbom-to-slsa-securing-your-software-supply-chain/