ไธๅบฆใง็ตใใใใSIEMๆง็ฏ๏ผWazuhใจELKใๆดป็จใใในใฌใใใใณใใฃใณใฐใฎ็ฌฌไธๆญฉ๏ผๅบ็ค๏ผ
็่ซใใ็พๅ ดใธ๏ผWazuh+ELK SIEMๆง็ฏใง่จผๆใใใปใญใฅใชใใฃๅฐ้ๅฎถใฎๆ ธๅฟ่ฝๅ ใปใญใฅใชใใฃ็ฎกๅถใฎๆ ธๅฟใงใใในใฌใใใใณใใฃใณใฐ๏ผThreat Hunting๏ผใทในใใ ใ็ดๆฅ่จญ่จใใ้็จใใพใใๅฎ้ใฎๆปๆใทใใชใชใซๅบใฅใใๅฎ็ฟใ้ใใฆใๅฎๅ็พๅ ดใงๅณๆฆๅใจใใฆๆๆใๅบใใๅฐ้ใปใญใฅใชใใฃใจใณใธใใขใธใจๆ้ทใใฆใใ ใใใ
ๅ่ฌ็ 142ๅ
้ฃๆๅบฆ ๅ็ด
ๅ่ฌๆ้ ็กๅถ้
ใ็ฅใใ
5 ไปถ
ใใใซใกใฏZerominiใงใใ
่ฟฝๅ ๅ่่ณๆใจใใฆDocker็ฐๅขใงใฎWazuhๆง็ฏใจSOAR้ฉ็จๆฆ่ฆใซใคใใฆ็ฐกๅใช่ณๆใ
ๅ ฑๆใใใฎใงใๅญฆ็ฟใซๆณจๆใใฆใใ ใใใ
่ฉฒๅฝๆดป็จ่ฌ็พฉใซใคใใฆใฏไปๅพใขใใใญใผใใใใฆใใใ ใใพใใ
ใใใซใกใฏZerominiใงใ
ไปฅไธใฎใใญใฐใๅ็ งใใฆWazuhใๅบๆฌ็ใซๆไพใใใซใผใซ+ Chainsaw + SigmaRuleใๆดป็จใใฆๅนๆ็ใซ่ ๅจใใณใใฃใณใฐใ่กใใใใฎ็ตๆใWazuh Agentใ้ใใฆELKใง็ขบ่ชใๅฏ่ฝใงใใ
ใใใซใกใฏZerominiใงใ
ใชใผใใณใฝใผในใๆดป็จใใฆไฝ็ณปใๆง็ฏใงใใใใใซ็ฐกๆฝใซใพใจใใใใญใฐใงใใไธๅบฆๅ่ใซใใฆใใ ใใ
ใใใใจใ
ๆณจใชใณใฏ๏ผ
ใใฎใณใณใใณใใฏใๅ่ฌ็๏ผAirmanใใ๏ผใใใฉใใซใทใฅใผใใฃใณใฐใซ้ขใใๅ ๅฎนใๅ ฑๆใใฆใใใพใใใ
ใใฉใใซใทใฅใผใใฃใณใฐใฎๆฆ่ฆ๏ผLinuxใฎใคใณในใใผใซๆใซใ่ฑ่ชใใงใคใณในใใผใซใใ๏ผใจใณใณใผใใชใฉใฎใใใคใใฎๅ้กใฎใใใ unattended.sh ๏ผใทใงใซในใฏใชใใ๏ผใๆญฃๅธธใซๅไฝใใชใ
ใฏใฉในใฎ้ไธญใงไปฅไธใฎใณใใณใใๅฎ่กใใฆunattendedใคใณในใใผใซใๅฎ่กใใใใใซๆ็คบใใพใใใใ่ฑ่ชไปฅๅคใฎ่จ่ชใงUbuntuใใคใณในใใผใซใใๅ ดๅใใจใฉใผใ็บ็ใใใคใณในใใผใซไธญใซไธญๆญใใใพใใ curl -so ~/ unattended-installation.sh https://packages.wazuh.com/resources/4.2/open-distro/unattended-installation/unattended-installation.sh && bash ~/ unattended-installation.sh -i ใฟใผใใใซ output ๏ผใทใงใซในใฏใชใใๅ ใฎ332่ก็ฎใซใชใใฉใณใใใใใพใใใๅ้กใฎๅๅ ๏ผใทใงใซในใฏใชใใใฎ331่ก็ฎใงfree -gใณใใณใใๅฎ่กใใฆMemใจใใๆๅญๅใ่ฆใคใใฆใใใใง2็ช็ฎใฎๅผๆฐใฎๅคใ่ฆใคใใใจใใๅ ๅฎนใใใใพใใ ใใพใ่งฃๆฑบ็ญใจใใฆใฏใๆๅใใUbuntuใใคใณในใใผใซใใใจใใซ่ฑ่ชใงใคใณในใใผใซใใพใใใใๅฅใฎ่จ่ชใงUbuntuใใคใณในใใผใซใใๅ ดๅใฏใไปฅไธใฎๆ้ ใง่ฑ่ชใซๅคๆดใใฆcurl ~~ใณใใณใใๅฎ่กใใใใจใใๅงใใใพใใ locale -aใณใใณใใงen_US.UTF-8ใใใใใฉใใใ็ขบ่ชใใพใใใใๅ ดๅ) sudo update-locale LANG=en_US.UTF-8
ๅญๅจใใชใๅ ดๅ) sudo locale-gen en_US.UTF-8 ๅฎ่กๅพ sudo update-locale LANG=en_US.UTF-8 ๅฎ่ก
ๅ่ตทๅใๅฟ ่ฆใจใใใซใทในใใ ๅคๆดใ้ฉ็จใใ*
ๅญๅจใใใใฉใใใซใใใใใใๆๅพใซๆฌกใฎใณใใณใใๅฎ่กใใพใ๏ผsource /etc/default/locale
ใใกใใใ่จ่ชใใใใฆๅคใใใซในใฏใชใใใฎๅ ๅฎนใ free -g | awk 'NR==2{print $2}' ใใฎใใใซๅคๆดใใใใจใใงใใพใใใ้ขๅใซใทใงใซในใฏใชใใใฎ่ฉฒๅฝๅ ๅฎนใๆขใใใใชใใใใงใใๅคฑๆใจใฉใผใ่กจ็คบใใใๅพใbash ~/ unattended-installation.sh -i โoverwriteใใใๅๅบฆ overwrite ใชใใทใงใณใ่ฟฝๅ ใใฆๅฎ่กใใพใใ๏ผใจ่จใใพใใใใใใใ็ตๅฑใฏใฏใชใผใณใคใณในใใผใซใใใกใใจใงใใใไฝใใคใณในใใผใซใซใชใฃใฆใใชใใจใจใฉใผใไฝๅบฆใ็พใใพใใ
่งฃๆฑบๆนๆณใฏใ่ฌ็พฉๅ่ฌ็ๅใCPใใๅ ๅฎนใๅ ฑๆใใฆใใใพใใใ
ใงใใชใๅ ดๅใฏใไปฅไธใฎๆนๆณใง่งฃๆฑบใใฆใใ ใใใ
Edit > Virtual Network Editor ใซๅ ฅใใ bridged to ใ automatic ใงใฏใชใ็พๅจไฝฟ็จไธญใฎใใใใฏใผใฏใ้ธๆ
