Moving from current Wazuh to SO

[zbalkan]

Hi,

I invested into Wazuh for half a year. I made some customizations and managed to end up with limitations of Wazuh. Now I needed to move on with other capabilities that I do not want to add one by one and use SO instead. I did some search but I hope I am not asking too simple questions that could have been found with a little more effort.

So,

• Which version of Wazuh is currently included as a part of SO?
• Will the custom rules & decoders work as is by just copying into the new location?
• Is there another way in SO to collect syslogs? Or is it handled by Wazuh too? (Wazuh pre-decoding mechanism and default rules create issues when collecting syslog, so we had to use rsyslog on Wazuh server nodes and make Wazuh server read logs from files created by rsyslog)
• Is there a documentation anywhere to help a smoother migration?
• How can we move the logs to SO from OpenSearch (Wazuh Indexer)?
• If we purchase premium support, would that also include the migration?

[dougburks]

• If we purchase premium support, would that also include the migration?

If you have questions about purchasing premium support, please reach out via the Premium Support page at https://securityonionsolutions.com/support/.

Thanks!

[zbalkan]

Hi,

I requested the generic quote and got my answer for that specific questions. Do you have any ideas/suggestions/comments on others?

[dougburks]

Which version of Wazuh is currently included as a part of SO?

3.13:
https://docs.securityonion.net/en/2.3/wazuh.html

Will the custom rules & decoders work as is by just copying into the new location?

You can try it and see.

Is there another way in SO to collect syslogs?

Yes, there are multiple ways of collecting syslog:
https://docs.securityonion.net/en/2.3/host.html