Get started with Security Compliance

View as Markdown

Get a node’s security agent reporting to Security Compliance, where it counts as an active agent and has its own dashboard of security events, vulnerabilities, and MITRE ATT&CK tactics.

You need a running Linux node in Delhi that you can sign in to over SSH. Security Compliance covers Delhi nodes other than FortiGate nodes, nodes attached to a VPC with Custom CIDR, and nodes on the older Xen hypervisor.

Turn on Security Compliance for the node

Open the node’s actions. In the node list, open the node’s Actions menu. On the node’s own page, open Actions, then Security.
Click Enable Security Compliance. A dialog opens and shows the charge per node per month.
Turn on I want to start Security Compliance for this Node.
The node’s monthly Compliance License starts when you click Enable, before the agent connects. E2E charges any part of a month as a whole month; for prices, see E2E’s pricing page. Click Enable.

The node is now registered with E2E’s compliance server, and the same dialog shows the setup commands to run inside it. To turn Security Compliance off later, see Enable Security Compliance on a node.

Run the setup commands inside the node

The commands install the Wazuh agent 4.8.2 and point it at the compliance server. They name the agent after your node and give it this node’s own registration key, so they work only on this node. The agent connects out from the node to E2E’s compliance server on TCP ports 1514 and 1515. If a firewall inside the node limits outbound traffic, allow those two ports.

In the dialog, choose the tab that matches your distribution’s package manager: Yum package Manager, APT package Manager, or Zypp package manager.
Sign in to the node over SSH.
Run the commands in the order shown. They remove any Wazuh agent installed before, add Wazuh’s package signing key and repository, install and register the agent, and start it.
To keep routine package updates from upgrading the agent, run the last step too, which MyAccount marks as recommended. It turns Wazuh’s repository off again, so the agent stays at the version you installed.
To check that the agent is running, run:
```
systemctl status wazuh-agent
```
A running agent shows active (running).
To check that the agent has connected to the server, read its log:
```
tail -fn100 /var/ossec/logs/ossec.log
```
Once the agent has connected, the log shows a line with Connected to the server. The command keeps printing new lines as they arrive. Press Ctrl+C to stop it.
In the dialog, click Close. The Security Compliance page opens.

If you close the dialog before you have copied the commands, open them again from the commands link on the node’s page.

Check that the agent is active

The Security Compliance page shows four counts: Total agents, Active agents, Disconnected agents, and Never connected agents. Your node counts under Never connected agents until its agent connects, then under Active agents. The page reads the counts when it opens, so to see the latest, open Security Compliance from the side menu again.

Once an agent is active, the page lists the six views under Security Information Management, Threat Detection And Response, and Regulatory Compliance. The node’s own page now reads Security Compliance is active on your Node.

If your node stays under Never connected agents, see The agent shows as never connected.

Open your agent’s dashboard

On the Security Compliance page, select the link beside Active agents. The agent list opens, with your node’s name under Agent name.
Select your agent. Its dashboard opens, with Security Events, Vulnerabilities, and MITRE ATT&CK at the top, and More … for the other views.

The dashboard covers the last 90 days. To look at a shorter period, choose one under Select Period, such as Last 24 Hour. A chart with nothing to show for the period says its data is not found.

What to do next

Read the Security Compliance dashboard: filter and export security alerts, and find the vulnerable packages on a node.
What Security Compliance checks: what each view reports, and how to change what the agent watches inside the node.
Enable Security Compliance on a node: turn it off for a node you no longer need to watch, which ends its charge.