Wazuh gives visibility to EVERYTHING

Wazuh gives visibility to EVERYTHING

by John Hammond

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 John Hammond 👥 2.2M 📅 November 24, 2025 ⏱ 19 min 👁 133K 📄 tutorial 🧭 2026-08-16
Available in: English (current) Français

Keywords

WazuhSIEMXDRIT HygieneThreat Hunting

Summary

In this video, John Hammond provides an in-depth tutorial on Wazuh, an open-source security platform that combines SIEM and XDR capabilities. He begins by introducing Wazuh’s features, such as endpoint detection, response, and log analysis. He then demonstrates the new IT Hygiene dashboard in version 4.14.1, which offers a comprehensive inventory of all connected agents, including operating system details, installed software, running processes, network information, and services. To illustrate its utility, he simulates a compromised host with a malicious PowerShell script that creates a backdoor via a web server on port 8080. Using Wazuh’s IT Hygiene features, he triages the incident by examining processes, network listeners, and services, ultimately identifying a rogue service managed by NSSM. He stops the service, eliminating the backdoor. The video also covers additional features like browser extension monitoring and Microsoft Graph API integration. The tutorial is practical and hands-on, suitable for cybersecurity professionals and enthusiasts.

150 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable practical insights into using Wazuh for IT hygiene and threat hunting. The demonstration of a simulated attack and subsequent triage using Wazuh’s features is highly instructive, showing real-world application. The argumentation is solid, as the presenter logically walks through the process of identifying and mitigating the threat. The value lies in the actionable knowledge for deploying and utilizing Wazuh effectively.

Scientific Rigor, Source Quality, Title Accuracy

The video is scientifically rigorous in its demonstration, with clear explanations and accurate technical details. The sources cited are primarily the Wazuh platform itself and related tools like Chocolatey and NSSM, which are relevant. The title accurately reflects the content, as the video indeed shows Wazuh’s broad visibility. The presenter does not cite external academic sources, but the tutorial is based on direct experience and official documentation.

146 words

Title / Content Match

The title accurately reflects the content, as the video demonstrates how Wazuh provides comprehensive visibility across an environment.

Quality & Reliability

8/10

The video is a practical tutorial demonstrating Wazuh's IT Hygiene features. The presenter shows real-time usage and a simulated attack scenario, providing concrete examples. The information is accurate and up-to-date (version 4.14.1), and the presenter clearly explains the steps. However, the video is not a formal study and relies on anecdotal evidence, so a slight deduction is made.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • Wazuh — The main platform demonstrated in the video.
  • CodeCrafters — Affiliate link mentioned in the description.
  • CyberDefenders — Affiliate link for blue team training.
  • OpenVPN — Affiliate link for VPN hosting.
  • Just Hacking Training — Training platform by the presenter.
  • Newsletter — Sign-up for the presenter's newsletter.

Concurring Sources

  • Wazuh Documentation — Official documentation confirming the features and capabilities of Wazuh.

Contribution & Novelties

The video offers a fresh perspective on using Wazuh’s IT Hygiene features for proactive threat hunting and incident response. It demonstrates a practical workflow for triaging a compromised host using the inventory data, which is a novel approach compared to traditional SIEM usage. The inclusion of tools like NSSM and Chocolatey adds educational value.

Pour aller plus loin :

  • Wazuh Documentation — Official documentation for Wazuh, providing detailed guides and references.
  • NSSM - Non-Sucking Service Manager — Official site for NSSM, an open-source tool for managing Windows services.
  • Chocolatey — Official site for Chocolatey, a package manager for Windows.

99 words

Radar Profile

The radar profile shows high scores in information quantity and quality, reflecting the comprehensive and accurate content. The technical level is moderately high, suitable for intermediate users. The overall reliability is strong, as the tutorial is based on direct demonstration and official tools.

Reliability 8/10

💬 Très positif. Sur les 30 commentaires analysés, la majorité exprime une forte appréciation, avec des remerciements et des retours d'expérience positifs sur l'utilisation de Wazuh.