Cybersecurity Made Simple Made Powerful - Medium

Cyberkarta - Medium

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*te2pOq3ToyE53yNtdeXSgg.png"></figure>For years, we’ve been warned that infostealers (malware designed to scavenge your computer for data) are after your passwords and credit card numbers. But as we move into 2026, a chilling new trend has emerged. Hackers aren’t just looking for your login; they are looking for your AI context.
Hi, I’m Ismail — CEO of Cyberkarta, one of the fastest-growing cybersecurity companies in Indonesia. If you have ideas, insights, or challenges in cybersecurity that you’d like to explore together, feel free to reach out through the comments or connect with me on LinkedIn. I’d love to hear from you and collaborate on building a safer and more resilient digital ecosystem.
<ul>
<li>LinkedIn Profile — <a href="https://www.linkedin.com/in/ismail-hakim/">https://www.linkedin.com/in/ismail-hakim/</a>
</li>
<li>Company Website — <a href="https://cyberkarta.com/">https://cyberkarta.com</a>
</li>
</ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*giaq6qmaLGebjuS-tq3JaA.png"><figcaption>Attack Surface Detected (<a href="https://declawed.io/#dashboard">Declawed</a>)</figcaption></figure>Recent reports from <a href="https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/">Hudson Rock</a> and <a href="https://declawed.io/#dashboard">Declawed</a> have identified a groundbreaking infection involving OpenClaw (the popular agentic AI platform formerly known as ClawdBot). This isn’t just another data breach; it’s the first documented case of an infostealer “harvesting the soul” of a personal AI agent.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*E_E-rHtHJ7E-H3tVwCErfw.png"><figcaption>Clawdbot Github Stars Jumped Significantly After January 25th.</figcaption></figure><h3>What Happened?</h3>
Cybersecurity researchers detected a live infection where a variant of the Vidar infostealer successfully exfiltrated a victim’s entire OpenClaw configuration environment.
Interestingly, the malware didn’t even need a “specialized” module to do this. It used a broad “file-grabbing” routine to sweep for sensitive file extensions and directory names. When it stumbled upon the .openclaw directory, it hit the jackpot.
<h3>What Was Stolen?</h3>
By grabbing just a few small files, the attacker essentially cloned the victim’s digital identity:
<ul><li>
openclaw.json (The Gateway): This file contains the “Gateway Token.” With this, an attacker can remotely connect to the victim’s local AI instance or masquerade as them in authenticated requests.</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/925/0*WXEGeFrs0oG25H1V.png"><figcaption>Sensitive Information on openclaw.json (<a href="https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/">Hudson Rock</a>)</figcaption></figure><ul><li>
device.json (The Keys): This file contains the private cryptographic keys used for secure pairing. With these, a hacker can bypass “Safe Device” checks and sign messages as if they were the victim.</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/920/0*NgFNVsZiioyjNToH.png"><figcaption>Sensitive Information on device.json (<a href="https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/">Hudson Rock</a>)</figcaption></figure><ul><li>
soul.md and memory.md (The Identity): This is where it gets personal. These files contain the AI’s “personality” and the history of its interactions. This includes daily logs, private messages, and upcoming calendar events, providing a literal blueprint of the user’s life.</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/925/0*eJE1wws7Z00gZoNH.png"><figcaption>Sensitive Information on soul.md (<a href="https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/">hudson rock</a>)</figcaption></figure><h3>Why This Matters</h3>
As AI agents like OpenClaw become more integrated into our professional lives, they become “super-apps” that hold the keys to our email, Slack, and cloud storage.
This marks a significant milestone in the evolution of malware: the transition from stealing credentials to harvesting the identities of personal AI agents. Today, the malware did this “inadvertently,” but tomorrow, infostealer developers will likely release dedicated modules specifically designed to decrypt and parse these AI files, much like they currently do for Google Chrome or Telegram.
<h3>The Bigger Picture: A Growing Threat Surface</h3>
The OpenClaw ecosystem is facing a “perfect storm” of security challenges right now:
<ol>
<li>
Malicious “Skills”: Researchers found that over 300 “Skills” (AI plugins) on the ClawHub marketplace were actually decoys designed to deliver malware.</li>
<li>
Exposed Instances: SecurityScorecard recently found hundreds of thousands of OpenClaw instances exposed to the public internet, leaving them vulnerable to Remote Code Execution (RCE).</li>
<li>
Persistence Issues: Once an agent account is created on community forums like Moltbook, it currently cannot be deleted, creating a permanent footprint for a user’s AI identity.</li>
</ol>
<h3>How to Stay Safe</h3>
If you are using OpenClaw or any local AI agent, it’s time to level up your security:
<ol>
<li>
Audit Your Skills: Only download Skills from trusted sources and be wary of “too good to be true” functionality.</li>
<li>
Isolate the Agent: Run your AI models in isolated environments (sandboxes) rather than giving them full access to your primary OS.</li>
<li>
Monitor Exposure: Ensure your local gateway ports aren’t exposed to the public internet.</li>
<li>
Stay Updated: OpenClaw has recently partnered with VirusTotal to improve threat detection, so keep your software updated to the latest version.</li>
<li>The era of the AI assistant has arrived, but so has the era of the AI-stealer. Don’t let your “digital soul” fall into the wrong hands.</li>
</ol>
<h3>Source</h3>
<ol>
<li><a href="https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/">https://www.infostealers.com/article/hudson-rock-identifies-real-world-infostealer-infection-targeting-openclaw-configurations/</a></li>
<li><a href="https://thehackernews.com/2026/02/infostealer-steals-openclaw-ai-agent.html">https://thehackernews.com/2026/02/infostealer-steals-openclaw-ai-agent.html</a></li>
<li><a href="https://declawed.io/#dashboard">https://declawed.io/#dashboard</a></li>
</ol>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=be685f675849" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/the-soul-stealer-why-your-ai-assistant-is-the-newest-target-for-malware-be685f675849">The “Soul” Stealer: Why Your AI Assistant is the Newest Target for Malware</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

The “Soul” Stealer: Why Your AI Assistant is the Newest Target for Malware

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*LELcY5zXrG2rnR4liQL5ag.png"></figure>In cybersecurity, the single biggest blind spot is often the lack of comprehensive endpoint visibility. You can deploy the most advanced firewalls and anti-malware solutions, but if you don’t know exactly what is running on every machine in your environment, you are inherently vulnerable. This blind spot gives rise to dangerous situations, such as:
<ul>
<li>
Forgotten Services: An old test server or a deprecated application that was never fully decommissioned, leaving an exposed entry point.</li>
<li>
Unauthorized Open Ports: A developer momentarily opens a high-risk port (like RDP or Telnet) for troubleshooting and forgets to close it, creating an accidental backdoor.</li>
<li>
Shadow IT: Unknown processes or services running outside of management oversight.</li>
</ul>
These hidden elements represent a massive and often unnecessary attack surface just waiting to be exploited.
Wazuh effectively eliminates these blind spots through its powerful System Inventory capability. This feature is driven by the Syscollector module integrated directly into the lightweight Wazuh agent, turning every monitored endpoint into an active information source.
Hi, I’m Ismail — CEO of Cyberkarta, one of the fastest-growing cybersecurity companies in Indonesia. If you have ideas, insights, or challenges in cybersecurity that you’d like to explore together, feel free to reach out through the comments or connect with me on LinkedIn. I’d love to hear from you and collaborate on building a safer and more resilient digital ecosystem.
<ul>
<li>LinkedIn Profile — <a href="https://www.linkedin.com/in/ismail-hakim/">https://www.linkedin.com/in/ismail-hakim/</a>
</li>
<li>Company Website — <a href="https://cyberkarta.com/">https://cyberkarta.com</a>
</li>
<li>Wazuh Ambassador Profile — <a href="https://wazuh.com/ambassadors/ismail-hakim/">https://wazuh.com/ambassadors/ismail-hakim/</a>
</li>
</ul>
<h3>What Readers Will Learn</h3>
This article will guide you through the process of establishing complete endpoint visibility using Wazuh’s Syscollector. By the end of this read, you will understand:
<ul>
<li>How to leverage Wazuh to automatically map Services and running processes.
</li>
<li>The mechanics of capturing active Ports (listening and established) and their associated Protocols (TCP/UDP).</li>
<li>The direct security value of this inventory data, turning passive asset lists into an active defense tool for threat hunting and vulnerability detection.</li>
</ul>
<h3>System Inventory: Pillars of Visibility</h3>
In a security context, System Inventory refers to the ongoing process of collecting and maintaining a real-time, comprehensive record of all software, hardware, and network configurations across an endpoint. This turns a dispersed set of assets into a structured and transparent environment, providing the foundational data required to accurately assess risk. In Wazuh, system inventory can be enriched through multiple detection sources, including Hardware, OS details, Installed Packages, Open Ports, Running Processes, Windows Updates, Users, Groups, Services, and Browser Extensions. For this blog post, however, we will focus specifically on the three primary pillars of detection.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/686/1*pmsmm5uir3epgKIqsLOkCQ.jpeg"></figure>First Pillar: Services (Identifying the Living Applications)
A Service (or daemon on Linux/macOS) represents the fundamental background work being performed on a machine. From a security perspective, every running service is a potential point of compromise if it is outdated, misconfigured, or unnecessary.
<ul>
<li>
Goal: Identifying every running process and service (e.g., Apache, Nginx, SSH daemon).</li>
<li>
Security Value: You can quickly identify unapproved or forgotten services that consume resources and pose a risk, such as an old FTP server or an unauthorized remote desktop utility.</li>
</ul>
Second Pillar: Ports (Mapping the Entryways)
Ports are the communication endpoints that allow services to send and receive data over the network. The state of an endpoint’s open ports is the single best indicator of its network attack surface.
<ul>
<li>
Goal: Mapping every open port and its critical status.</li>
<li>
Security Value: This allows you to immediately spot unnecessary LISTENING ports, which are potential vulnerabilities, and trace unauthorized ESTABLISHED connections that might indicate compromise or data exfiltration</li>
</ul>
Third Pillar: Protocols (Defining the Communication Language)
Every network communication relies on a defined Protocol. Understanding the protocol associated with an open port is crucial for determining its risk level and the nature of the data being transmitted.
<ul>
<li>
Goal: Determining the associated network protocol for each connection.</li>
<li>
Security Value: Knowing the protocol helps in defining appropriate network segmentation and security policies (e.g., ensuring a critical service only communicates via secured TCP connections).</li>
</ul>
<h3>Wazuh Syscollector Module</h3>
The foundation of Wazuh’s data collection is the Wazuh Agent. This small piece of software is installed directly on every endpoint you wish to monitor (whether it’s Windows, Linux, or macOS).
By running locally, the agent has the necessary permissions and access to query the operating system’s kernel, file system, and network stack. This ensures the collected data on services, ports, and protocols is accurate and real-time, not relying on external network scanning which can miss internal details.
The Syscollector module is an integral part of the Wazuh Agent, dedicated solely to gathering system inventory:
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*mG1jEx0OI62CuUuUfRhxaQ.png"></figure>Enabling the core services, ports, and protocols inventory is remarkably straightforward (and it is enabled by default). It only requires adding a simple configuration block to the agent’s main configuration file (ossec.conf). You can find the Syscollector configuration in the Wazuh Agent configuration file at:
<ul>
<li>
/var/ossec/etc/ossec.conf for Linux endpoints.</li>
<li>
C:\Program Files (x86)\ossec-agent\ossec.conf for Windows endpoints.</li>
<li>
/Library/Ossec/ossec.conf for macOS endpoints.</li>
</ul>
Wazuh Agent Configuration
<pre>&lt;!-- System inventory --&gt; &lt;wodle name="syscollector"&gt; &lt;disabled&gt;no&lt;/disabled&gt; &lt;interval&gt;1h&lt;/interval&gt; &lt;scan_on_start&gt;yes&lt;/scan_on_start&gt; &lt;hardware&gt;yes&lt;/hardware&gt; &lt;os&gt;yes&lt;/os&gt; &lt;network&gt;yes&lt;/network&gt; &lt;packages&gt;yes&lt;/packages&gt; &lt;ports all="no"&gt;yes&lt;/ports&gt; &lt;processes&gt;yes&lt;/processes&gt; &lt;users&gt;yes&lt;/users&gt; &lt;groups&gt;yes&lt;/groups&gt; &lt;services&gt;yes&lt;/services&gt; &lt;browser_extensions&gt;yes&lt;/browser_extensions&gt; &lt;!-- Database synchronization settings --&gt; &lt;synchronization&gt; &lt;max_eps&gt;10&lt;/max_eps&gt; &lt;/synchronization&gt; &lt;/wodle&gt;</pre>
Potential Configuration
<figure><img alt="" src="https://cdn-images-1.medium.com/max/868/1*qPkADLUnsZnrDK005jZWBA.png"></figure>‘* Positive values that contain suffix characters indicating a time unit, e.g. 1s (1 second) or 3h (3 hours), etc.
System inventory is a must-have functionality during day-to-day Security Operation Center (SOC). It is enabled by default in Wazuh, and gives us the capability to detect anomalies and a starting point for vulnerability detection and threat hunting.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*5IvPftTkDHEQAQohRcn6qQ.png"></figure><h3>System Inventory into Threat Hunting</h3>
The true power of Wazuh’s System Inventory is realized when you move beyond compliance checks and use the data for proactive threat hunting. Threat hunting is a defensive discipline where security analysts actively and iteratively search through network and endpoint data to detect and isolate advanced threats that have evaded existing security controls. System inventory data is the ideal starting point for this hunt. By maintaining a clean, up-to-date baseline of every authorized service, every approved port, and every legitimate protocol across your endpoints, any deviation immediately becomes a high-priority anomaly. When a hidden process starts, or an unauthorized port opens, the Syscollector data acts as your forensic foundation, allowing you to quickly isolate the system, investigate the change, and eliminate the potential threat before it escalates into a full breach.
A. Hunting Malicious Processes and Persistence
The Top running processes list is crucial for detecting malware and unauthorized persistence mechanisms, as attackers often disguise malicious services to blend in.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*yMId6MLVX3t1CH9mfIvx3g.png"></figure>‘* It is recommended to use Wazuh’s File Integrity Monitoring (FIM) on these directories (<a href="https://cyberkarta.com/blog/Defending-Against-Threat-Actors-Persistence-Through-File-Integrity-Monitoring-FIM-in-Wazuh-0aba8db8574e">https://cyberkarta.com/blog/Defending-Against-Threat-Actors-Persistence-Through-File-Integrity-Monitoring-FIM-in-Wazuh-0aba8db8574e</a>)
Initial threat hunting for detecting potential persistence mechanisms can begin in the Processes tab of Wazuh’s IT Hygiene module. The Top 5 Processes bar chart and the Process Start Time graph provide an immediate overview of the most active processes and when they were launched. Below these visualizations, the detailed process table offers full visibility into each process, including its name, PID, parent PID, and command line. This information allows analysts to spot unusual activity and identify potential anomalies.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*_IYfu7tyB5KHNFTI_rfcbg.png"></figure>When conducting threat hunting, we have the flexibility to create a new column based on the specific information required. The process.args field provides valuable data for identifying suspicious processes.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*7ZTeMiozNodFV8uIIjYnbA.png"></figure>The following image displays “Python3”, a widely-used programming language. The question remains: is the presence of this process in our system suspicious?
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*RxuJ66RaHhTHVRM9Uld8tQ.png"></figure>If an entry in the database catches your attention, click the Inspect details button. This action provides more information about the attack, such as the crucial process.pid and process.parent.pid which are valuable for deeper investigation.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*5pHH6u5yuwsX8fQyjLZU4Q.png"></figure>B. Hunting Unauthorized Ports and Backdoors
The Ports inventory reveals your attack surface and is the fastest way to detect a potential backdoor — a hidden entry point for remote access.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*QxELbiQur8WVT_7O9-1DoA.png"></figure>A critical aspect of detecting network anomalies involves establishing a prior baseline of which ports are typically open.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*dmGsHt3Cra-ysJTXq0f-XQ.png"></figure>An open port, as illustrated in the image below, represents an anomaly of the established baseline and serves as a starting point for immediate investigation.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*uWfT9lpj-iVRqtN297ev9g.png"></figure>Detailed information about the anomaly is always available via the Inspect details button. Wazuh identifies the process name as nc, which stands for netcat. Netcat is a well-known tool often implicated in Command and Control (C2) scenarios for opening ports and establishing system backdoors, such as a reverse shell.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*ylZlQvekztQgzPWo-mrrSQ.png"></figure>To effectively investigate or initiate threat hunting, begin by reviewing established connections in the Traffic tab. A crucial first step is to establish a Blacklist IP Database, which can then be used to compare and identify suspicious established connections.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*7UFuK42ObfszY28bOvlXtA.png"></figure><h3>System Inventory into Vulnerability Detection</h3>
While the primary function of System Inventory is to establish baseline visibility and hunt for real-time threats, its data provides the essential foundation for one of the most critical security tasks: Vulnerability Detection. You can’t patch software you don’t know you have. By meticulously collecting the inventory of all installed packages and operating system versions across every endpoint, the Wazuh Syscollector module provides a comprehensive list of assets. This data is then automatically fed into the Vulnerability Detection module, where it is cross-referenced against global, regularly updated databases of known security flaws (CVEs). This correlation transforms a simple asset list into a prioritized, actionable report, telling you exactly which endpoints are running which vulnerable pieces of software, allowing you to move instantly from discovery to remediation.
The Installed Packages list is the inventory data source for Wazuh’s Vulnerability Detection module, allowing you to proactively hunt for exploitable software.
<ul>
<li>
Correlation: Wazuh automatically correlates every package name and version with the constantly updated Common Vulnerabilities and Exposures (CVE) databases.</li>
<li>
Action: Regularly review the Vulnerability Detection module. Any package on your endpoint that has a known, high-severity CVE is a high-risk security gap. The inventory data allows you to generate a prioritized list of patches needed to drastically reduce your attack surface.</li>
</ul>
The system inventory includes a list of all installed packages, detailing information about their respective publishers.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*GeV2Ra8i03mPAxulkMoUUQ.png"></figure>The data collected by the package system inventory is utilized by the Wazuh Vulnerability Detection module.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*q7BGWfuRy6sBoKXY3-9DaA.png"></figure>The Vulnerability Module is now an integral part of Wazuh CTI in the latest version of Wazuh. For more information, please visit the Wazuh CTI website: <a href="https://cti.wazuh.com/">https://cti.wazuh.com</a>.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*pI_h-zc0W-nbUMVPO_7yrg.png"></figure><h3>Closing</h3>
By integrating the Syscollector module, Wazuh transforms a static asset list into a dynamic, real-time security ledger. This unparalleled visibility across services, ports, and protocols not only hardens your environment against Shadow IT and misconfigurations but also provides the essential, granular data needed to fuel both proactive Threat Hunting and continuous Vulnerability Detection. Ultimately, Wazuh’s System Inventory moves your security operations from a reactive posture to an informed, active defense, ensuring your team can preemptively address anomalies and security gaps before they result in a compromise.
<h3>Source</h3>
<ol>
<li>System Inventory Configuration (<a href="https://documentation.wazuh.com/current/user-manual/capabilities/system-inventory/configuration.html#wazuh-agent-configuration">https://documentation.wazuh.com/current/user-manual/capabilities/system-inventory/configuration.html#wazuh-agent-configuration</a>)</li>
<li>Cyberkarta Blog about FIM (File Integrity Monitoring) in Wazuh (<a href="https://cyberkarta.com/blog/Defending-Against-Threat-Actors-Persistence-Through-File-Integrity-Monitoring-FIM-in-Wazuh-0aba8db8574e">https://cyberkarta.com/blog/Defending-Against-Threat-Actors-Persistence-Through-File-Integrity-Monitoring-FIM-in-Wazuh-0aba8db8574e</a>)</li>
<li>Wazuh Cyber Threat Intelligence (CTI) (<a href="https://cti.wazuh.com/">https://cti.wazuh.com</a>)</li>
</ol>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=f0952719c57b" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/wazuh-system-inventory-services-ports-and-protocols-f0952719c57b">Wazuh System Inventory: Services, Ports, and Protocols</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Wazuh System Inventory: Services, Ports, and Protocols

Attackers often tamper with critical files to gain long-term access to systems. These changes can remain hidden without proper detection. File Integrity Monitoring (FIM) addresses this risk by checking for unauthorized file modifications. Wazuh FIM helps to detect threats early and supports compliance efforts.
Hi, I’m Ismail — Wazuh Ambassador from Indonesia. If you have ideas, feedback, or Wazuh features you’d like to explore together, you can contact me through this blog comment or LinkedIn post below. I’d love to hear from you and collaborate on making the most of Wazuh’s capabilities.
Ismail Hakim (ID) — <a href="https://wazuh.com/ambassadors/ismail-hakim/">https://wazuh.com/ambassadors/ismail-hakim/</a> LinkedIn Post — <a href="https://www.linkedin.com/posts/ismail-hakim_defending-against-threat-actors-persistence-activity-7340978876409384960-KcPX?utm_source=share&amp;utm_medium=member_desktop&amp;rcm=ACoAACTENPsBAAWogztM2BrCauDd9TlgPC9Tt_M">here</a>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/941/1*saSmSVxFcbtAWyw0KDNOxQ.png"></figure><h3>Purpose of File Integrity Monitoring</h3>
The primary purposes of FIM in Wazuh include:
● Detecting unauthorized file modifications that may indicate a security breach, such as changes to configuration files, binaries, or scripts.
● Ensuring compliance with standards like PCI DSS, HIPAA, and ISO 27001 that mandate regular monitoring of system integrity.
● Monitoring system-critical files, including boot scripts, user profiles, and application binaries to prevent unauthorized tampering.
<h3>MITRE ATT&amp;CK — TA0003 Persistence</h3>
Persistence refers to post-exploitation tactics that adversaries use to maintain their foothold in a system across reboots, credential changes, or other interruptions. Under the MITRE ATT&amp;CK framework, persistence tactics include modifying autorun configurations, scheduled tasks, or implanting malicious binaries that relaunch malware upon system startup.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/940/1*VbZ2qhp1j9BzQ14yR_ho3A.png"><figcaption>Image: MITRE ATT&amp;CK (<a href="https://attack.mitre.org/">https://attack.mitre.org/</a>)</figcaption></figure>FIM in Wazuh is a powerful tool to detect such persistence tactics by:
● Monitoring files commonly abused for persistence, such as .bashrc, rc.local, systemd unit files, crontabs, and Windows registry hives.
● Generating alerts when persistence mechanisms are created or altered, helping SOC analysts swiftly investigate and remediate threats.
● Correlating file changes with user activity and system logs to build a complete picture of the intrusion path.
<h3>Configuring FIM in Wazuh Server</h3>
In this segment, our task is to add a syscheck entry inside ossec.conf to enable our Wazuh FIM. The location of ossec.conf is in /var/ossec/etc/ossec.conf.
<pre>sudo su nano /var/ossec/etc/ossec.conf</pre>
As example, this is configuration that I add to Wazuh server via /var/ossec/etc/ossec.conf.
<pre>&lt;ossec_config&gt; ... &lt;syscheck&gt; ... &lt;disabled&gt;no&lt;/disabled&gt; &lt;!-- Frequency that syscheck is executed every 15 minutes --&gt; &lt;frequency&gt;900&lt;/frequency&gt; &lt;scan_on_start&gt;yes&lt;/scan_on_start&gt; &lt;!-- Generate alert when new file detected --&gt; &lt;alert_new_files&gt;yes&lt;/alert_new_files&gt; &lt;!-- Don't ignore files that change more than 'frequency' times --&gt; &lt;auto_ignore frequency="10" timeframe="3600"&gt;no&lt;/auto_ignore&gt; &lt;!-- Directories to check (perform all possible verifications) --&gt; &lt;directories&gt;/etc,/usr/bin,/usr/sbin&lt;/directories&gt; &lt;directories&gt;/bin,/sbin,/boot&lt;/directories&gt; &lt;!-- FIM on SSH Authorized Keys --&gt; &lt;directories check_all="yes" realtime="yes"&gt;/home/*/.ssh/authorized_keys,/root/.ssh/authorized_keys&lt;/directories&gt; &lt;!-- FIM on Users Configurations --&gt; &lt;directories check_sha256sum="yes" realtime="yes"&gt;/etc/shadow,/etc/passwd,/etc/hosts,/etc/hostname,/etc/resolv.conf&lt;/directories&gt; &lt;!-- FIM on critical user-defined script --&gt; &lt;directories check_sha256sum="yes" check_perm="yes" check_owner="yes"&gt;/home/ubuntu/autobackup.sh&lt;/directories&gt; ... &lt;syscheck&gt; ... &lt;/ossec_config&gt;</pre>
This Wazuh ossec.conf configuration implements a File Integrity Monitoring (FIM) policy that balances periodic scanning and real-time monitoring across critical areas of the system. Syscheck is enabled with a scan frequency of every 15 minutes, and it performs an immediate scan upon agent startup. New file creation is explicitly monitored, and auto-ignore is disabled to ensure frequent changes aren’t silently overlooked. Core system directories such as /etc, /usr/bin, /usr/sbin, /bin, /sbin, and /boot are monitored to detect unauthorized modifications.
Real-time monitoring is applied to sensitive SSH key files (authorized_keys in both user and root .ssh directories), allowing for immediate alerting on persistence attempts. Additionally, key user and system configuration files like /etc/shadow, /etc/passwd, /etc/hosts, /etc/hostname, and /etc/resolv.conf are monitored using SHA256 checksums for strong integrity assurance. The configuration also includes targeted monitoring of a custom backup script (autobackup.sh), verifying its content, permissions, and ownership to detect unauthorized changes.
Before we fully implement that configuration it is recommended to test the rule file. This is helpful for detecting mistakes and typos, such as duplicate Rule ID and unclosed tags.
<pre>/var/ossec/bin/wazuh-logtest</pre>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/941/1*S-K1OyEdcNg_BedXxBH4Sw.png"><figcaption>Image: Troubleshooting using wazuh-logtest binary. It is an intended error, we can see that there are errors in the directories tag on the ossec.conf</figcaption></figure>Finally, to fully operate the FIM, wazuh-manager must be restarted.
<pre>sudo systemctl restart wazuh-manager</pre>
<h3>Configuring FIM for Wazuh Agent</h3>
Even though FIM is configured for the Wazuh agent, it can be done using centralized configuration through the Wazuh Dashboard. This is the beauty of the centralized architecture of Wazuh. To enable and configure FIM through dashboard, we can replicate these steps.
Go to https://&lt;wazuh-ip&gt;/app/endpoint-groups#/manager/?tab=groups, change &lt;wazuh-ip&gt; to your server IP or URL and choose the corresponding group to be configured.
Choose Files tab to show all files related to Wazuh configuration.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/940/1*6X7bntQFxLX4qb-BHgUztA.png"><figcaption>Image: Editing Wazuh configuration for agents (based on group)</figcaption></figure>Input configuration below. Remember that all FIM configurations must be inside &lt;syscheck&gt; tag.
<pre>&lt;agent_config&gt; ... &lt;syscheck&gt; &lt;disabled&gt;no&lt;/disabled&gt; &lt;!-- Common FIM paths --&gt; &lt;directories check_all="yes" realtime="yes"&gt;/etc&lt;/directories&gt; &lt;directories check_all="yes" realtime="yes"&gt;/bin,/sbin,/usr/bin,/usr/sbin&lt;/directories&gt; &lt;!-- FIM on Wazuh Agent --&gt; &lt;directories check_all="yes" realtime="yes"&gt;/var/ossec/etc&lt;/directories&gt; &lt;!-- FIM on SSH Authorized Keys --&gt; &lt;directories check_all="yes" realtime="yes"&gt;/home/*/.ssh/authorized_keys,/root/.ssh/authorized_keys&lt;/directories&gt; &lt;!-- FIM on Users Configurations --&gt; &lt;directories check_sha256sum="yes" realtime="yes"&gt;/etc/shadow,/etc/passwd,/etc/hosts,/etc/hostname,/etc/resolv.conf&lt;/directories&gt; &lt;!-- FIM on critical user-defined script --&gt; &lt;directories check_sha256sum="yes" check_perm="yes" check_owner="yes"&gt;/home/ubuntu/autobackup.sh&lt;/directories&gt; &lt;/syscheck&gt; ... &lt;/agent_config&gt;</pre>
This agent_config enables File Integrity Monitoring (FIM) on Wazuh agents with real-time monitoring for common system directories such as /etc, /bin, /sbin, and their subdirectories. It also includes monitoring of the Wazuh agent’s configuration directory at /var/ossec/etc. SSH authorized_keys files for both regular users and root are monitored in real time, while sensitive system configuration files like /etc/shadow, /etc/passwd, and DNS or hostname settings are verified using SHA256 checksums. Additionally, a specific user-defined script (/home/ubuntu/autobackup.sh) is monitored for changes in content, permissions, and ownership.
<h3>On Attack Perspective</h3>
This segment will demonstrate an attacker that has an initial foothold to the server. His goal is to gain permanent access on the server, so that he won’t need to re-exploit the vulnerability later on. Persistence tactics could be dangerous for the server because the attacker can still have access to the server, even after the vulnerability has been patched.
One simple persistence method is to add an attacker-owned public key to .ssh/authorized_key. After a successful attack, the attacker will gain ssh access to the server.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/940/1*hBVtRFC1FRx-afm5naq8AQ.png"><figcaption>Image: The attacker include his public key to /root/.ssh/authorized_keys</figcaption></figure>Of course because we have already configured File Integrity Monitoring, this will create an alert for the SOC analysts. Rule ID 550 (syscheck.modified) triggered during the attack.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/940/1*QoHPRRAVTgYsPHYHn-2bDQ.png"><figcaption>Image: Real-time detection of the attack</figcaption></figure>If we want to know more details about the attack, Wazuh provides us with complete information.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/471/1*JcjrFjBTtuw_-YTm6hzQ_A.png"><figcaption>Image: Full log of alert generated by modifying authorized_keys.</figcaption></figure><h3>Closing</h3>
While prevention mechanisms such as firewalls, antivirus, and hardening measures are essential, they are not infallible. Attackers often find ways to bypass defenses and maintain undetected access to critical systems. This is where defense-in-depth becomes vital — layering detection and monitoring alongside preventive controls. Wazuh’s File Integrity Monitoring (FIM) adds a crucial layer of visibility, enabling early detection of tampering and persistence attempts. By continuously tracking sensitive file changes and correlating them with system behavior, organizations gain the ability to detect what prevention might miss. In a modern threat landscape, where compromise is a matter of when — not if — FIM ensures that you are not blind to the warning signs hiding in plain sight.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=0aba8db8574e" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/defending-against-threat-actors-persistence-through-file-integrity-monitoring-fim-in-wazuh-0aba8db8574e">Defending Against Threat Actor’s Persistence Through File Integrity Monitoring (FIM) in Wazuh</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Defending Against Threat Actor’s Persistence Through File Integrity Monitoring (FIM) in Wazuh

In the ever-evolving landscape of cybersecurity, organizations need powerful tools that can detect threats, ensure compliance, and provide real-time visibility into their infrastructure. Wazuh is an open-source security platform that integrates SIEM (Security Information and Event Management), log analysis, intrusion detection, vulnerability detection, and security configuration assessment into a unified solution. It helps businesses of all sizes monitor their systems, detect anomalies, and respond to incidents efficiently — making it a critical component of any modern security operations center (SOC).
Hi, I’m Ismail — Wazuh Ambassador from Indonesia. If you have ideas, feedback, or Wazuh features you’d like to explore together, feel free to comment this blog on this Medium or via LinkedIn post. I’d love to hear from you and collaborate on making the most of Wazuh’s capabilities.
Ismail Hakim (ID) — <a href="https://wazuh.com/ambassadors/ismail-hakim/">https://wazuh.com/ambassadors/ismail-hakim/</a> LinkedIn Post URL — <a href="https://www.linkedin.com/posts/ismail-hakim_introduction-to-wazuh-activity-7338069461909811201-5K8N?utm_source=social_share_send&amp;utm_medium=member_desktop_web&amp;rcm=ACoAACTENPsBAAWogztM2BrCauDd9TlgPC9Tt_M">click me</a>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*HjaLJLrLbzogLblUejWwkQ.png"></figure><h3>Real-World Use Cases</h3>
Wazuh is widely adopted across various industries due to its comprehensive features and adaptability. In the financial sector, Wazuh helps institutions meet regulatory requirements like PCI DSS by monitoring logs, detecting unauthorized access, and maintaining audit trails. In healthcare, it plays a crucial role in protecting sensitive patient data and supporting HIPAA compliance through continuous monitoring and file integrity checking.
For organizations operating in the cloud, Wazuh offers native integration with platforms such as AWS, Azure, and Google Cloud, allowing for seamless monitoring of cloud workloads and infrastructure. In DevSecOps environments, it empowers teams to integrate security into the CI/CD pipeline by detecting misconfigurations and vulnerabilities early in the development cycle. Whether you’re securing an enterprise network, cloud-native application, or hybrid infrastructure, Wazuh provides the visibility and control needed to manage risk effectively.
<h3>Wazuh Architecture</h3>
Wazuh is built on a modular and scalable architecture designed to support a wide range of deployment scenarios, from small setups to complex enterprise environments. The platform is composed of several core components: the Wazuh Manager, Wazuh Agents, the Wazuh Indexer, and the Wazuh Dashboard. Each component plays a critical role in collecting, processing, storing, and visualizing security data across monitored systems.
The Wazuh Manager serves as the brain of the platform, receiving and analyzing data from the agents. It applies decoding rules, generates alerts, and executes active responses when necessary. Wazuh Agents are lightweight programs installed on endpoints — including servers, workstations, and cloud instances — that collect security event data such as logs, file integrity checks, and configuration assessments.
The Wazuh Indexer, based on OpenSearch, is responsible for storing and indexing event data to enable efficient search and correlation. It ensures that vast volumes of data can be queried quickly, supporting threat detection and forensic analysis. Finally, the Wazuh Dashboard provides an intuitive web interface for managing configurations, visualizing alerts, and gaining insights into the security posture of your environment.
<h3>System Requirements</h3>
Hardware requirements vary significantly depending on the number of endpoints and cloud workloads being monitored. This directly impacts the volume of data processed and the number of security alerts that need to be stored and indexed.
The quickstart deployment installs the Wazuh server, indexer, and dashboard on a single host—suitable for environments with up to 100 endpoints and 90 days of searchable alert data. The table below outlines the recommended hardware specifications for this type of deployment.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*oRjQqDSNpOBNsYjn3pljJQ.png"><figcaption>Table: Server Specification for Running Wazuh Server</figcaption></figure><h3>Wazuh Server Quick Start Installation</h3>
To get the most out of Wazuh, it is recommended to explore the official<a href="https://documentation.wazuh.com/"> Wazuh Documentation</a>.
One of Wazuh’s key advantages is how easy it is to get up and running. Despite its wide range of features, the installation process is straightforward and well-documented. Wazuh has several installation options, but the most simplistic way is by issuing these commands.
<pre>curl -sO https://packages.wazuh.com/&lt;4.x&gt;/wazuh-install.sh &amp;&amp; sudo bash ./wazuh-install.sh -a * notes: change placeholder &lt;4.x&gt; to the newest version of Wazuh</pre>
Wait until the installation is complete and save the admin username and password as your login credentials to Wazuh Server.
<pre>INFO: --- Summary --- INFO: You can access the web interface https://&lt;IP_ADDRESS&gt; User: admin Password: &lt;PASSWORD&gt; INFO: Installation finished.</pre>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/718/1*Kf5hieQTVj62t6zBm7RNgQ.png"><figcaption>Image: It is expected that browsers will throw a warning, browser still doesn’t trust the certificate of our server. Verify your address and proceed next.</figcaption></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/712/1*A1-rwUI9WSkbxmgMdxnL9w.png"><figcaption>Image: Wazuh login page, use Wazuh admin username and password here.</figcaption></figure><h3>Wazuh Dashboard</h3>
The Wazuh Dashboard serves as the central interface for monitoring, analyzing, and responding to security events across your infrastructure. Designed for clarity and efficiency, it offers real-time visibility into agent activity, threat detections, compliance status, and system health. To better understand how this dashboard supports security operations, we’ll explore it in two key segments: the Agents &amp; Alerts Overview, which highlights the current state of your environment and recent incidents, and the Functionality Segment, which dives into Wazuh’s powerful tools for endpoint protection, threat intelligence, cloud monitoring, and compliance management.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/940/1*8Tq9P506beU-1CbLCYMvWQ.png"><figcaption>Image: Agents &amp; alerts overview segment</figcaption></figure>The Agents Summary panel provides a quick overview of the current status of all connected Wazuh agents. In this example, there are two active agents and none are disconnected, indicating that all monitored endpoints are communicating properly with the Wazuh server. This immediate visibility is crucial for ensuring full coverage and avoiding blind spots in security monitoring.
Next to it, the Last 24 Hours Alerts panel categorizes recent security events based on their severity levels. There are no Critical (rule level 15+) or High (rule level 12–14) severity alerts, suggesting no major threats have been detected in the last day. However, the system has logged 2 Medium severity alerts (rule level 7–11) and 3 Low severity alerts (rule level 0–6), which may include benign or informational events. This segmentation allows analysts to prioritize investigations and respond effectively to threats based on risk levels.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/940/1*wnhLs8wDyNogQrAp5XCQ_A.png"><figcaption>Image: Functionality segment of Wazuh Dashboard.</figcaption></figure>The Functionality segment of the Wazuh Dashboard showcases the platform’s core capabilities, organized into intuitive categories that cover every aspect of modern security operations. From endpoint protection and threat intelligence to cloud workload monitoring and compliance reporting, each module is designed to help security teams detect, investigate, and respond to threats efficiently. This section provides a deeper look into these built-in tools, demonstrating how Wazuh empowers organizations to maintain visibility, enforce policies, and meet regulatory requirements — all from a single, unified interface.
Endpoint Security
<ol>
<li>
Configuration Assessment — scans assets for misconfigurations by auditing them against security policies, making it ideal for hardening and compliance checks.</li>
<li>
Malware Detection — identifies indicators of compromise based on behavior patterns or known signatures, allowing early detection of malicious activity.</li>
<li>
File Integrity Monitoring — keeps track of critical file changes — including permissions, ownership, and content — alerting security teams to potential tampering or unauthorized modifications.</li>
</ol>
Threat Intelligence
<ol>
<li>
Threat Hunting — allows analysts to manually investigate security alerts, identify patterns, and detect hidden threats across the environment.</li>
<li>
MITRE ATT&amp;CK — maps alert data to adversary tactics and techniques, helping security teams understand attack strategies and improve detection coverage.</li>
<li>
Vulnerability Detection — identifies software with known CVEs, offering severity ratings and affected system details to help prioritize remediation.</li>
</ol>
Security Operations
Compliance-focused dashboards with modules like PCI DSS, GDPR, HIPAA, and NIST 800–53 assist organizations in aligning with global regulatory standards, providing real-time insights and reports that support audits. The TSC module is particularly useful for organizations pursuing SOC 2 certification, covering trust service criteria such as confidentiality, availability, and processing integrity.
Cloud Security
Extensive Cloud Security visibility across modern infrastructure. The Docker module captures events such as container lifecycle operations to detect abnormal behavior in containerized environments. For cloud service providers, AWS and Google Cloud modules collect API-driven logs to monitor IAM activity, policy changes, and resource access. Office 365 integration provides oversight into user activity and configuration changes across collaboration tools, while the GitHub module enables audit log analysis for version control systems — making it a critical piece in securing DevOps pipelines.
<h3>Wazuh Agent</h3>
The Wazuh Agent is a lightweight and powerful component installed on endpoints — such as servers, workstations, or cloud instances — to collect security-relevant data and forward it to the Wazuh Manager for analysis. It plays a crucial role in monitoring system activity, detecting anomalies, tracking file integrity, and enforcing security policies across diverse environments. To get started with deploying Wazuh agents, simply navigate to https://&lt;your-wazuh-ip&gt;/app/endpoints-summary#/agents-preview/deploy on your Wazuh Dashboard. You need to change &lt;your-wazuh-ip&gt; with your Wazuh Server IP address or URL. This section provides pre-configured installation commands tailored for different operating systems.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/940/1*UJffO4yEGv888n9LOqQFDQ.png"><figcaption>Image: Wazuh Agent deployment helper. You should choose your operating system, filling out the server name, and assigning an agent-name.</figcaption></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/940/1*88avth0YrAlj7iRi6HYqxw.png"><figcaption>Image: After filling out the necessary information, Wazuh will recommend several commands to be included in your Agent installation.</figcaption></figure><h3>Alerts</h3>
Wazuh generates security alerts through the collaboration between its agents and server. When installed on an endpoint, the Wazuh Agent monitors system activities — such as login attempts, file changes, and network behavior — and sends this data to the Wazuh Server. The server then analyzes it using a powerful rules engine to detect suspicious patterns or malicious activity. For example, if an attacker attempts a brute-force attack by making multiple failed login attempts in a short period, Wazuh can detect this behavior and generate a high-severity alert based on predefined rules.
These alerts are automatically forwarded to the Wazuh Dashboard, where they can be investigated in real time. You can access and analyze alerts by navigating to<a href="https://wazuh.ip/app/data-explorer/discover"> </a>Explore &gt; Discover in the side panel of the dashboard. This interface allows you to search, filter, and visualize alert data based on severity level, rule ID, source IP, or other criteria — enabling security teams to quickly identify threats and take appropriate action.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*CjKYODhCioQ9gJHQ"><figcaption>Image: You can access and analyze alerts by navigating to<a href="https://wazuh.ip/app/data-explorer/discover"> </a>Explore &gt; Discover in the side panel of the dashboard.</figcaption></figure><h3>Closing</h3>
This blog post is dedicated to exploring the fundamentals of Wazuh, including what makes it powerful and how to get it up and running. The deep dive into Wazuh Alerts — where we break down how to interpret, investigate, and act on security events — will be featured in a follow-up post. Stay tuned for more insights and hands-on guidance in the upcoming entries!
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=9cd8195e42ac" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/introduction-to-wazuh-9cd8195e42ac">Introduction to Wazuh</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction to Wazuh

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*fbGN4ye84IRApyI4"></figure>A Wazuh Custom Dashboard is a personalized set of visualizations that you build inside the Wazuh Dashboard to monitor and analyze specific security data that matters to you. Instead of relying only on the default dashboards that come pre-packaged (like PCI DSS, HIPAA, Vulnerability, FIM, etc.), you can design your own dashboard panels, filters, and queries to track your organization’s unique use cases.
Hi, I’m Ismail — CEO of Cyberkarta, one of the fastest-growing cybersecurity companies in Indonesia. If you have ideas, insights, or challenges in cybersecurity that you’d like to explore together, feel free to reach out through the comments or connect with me on LinkedIn. I’d love to hear from you and collaborate on building a safer and more resilient digital ecosystem.
LinkedIn Profile — <a href="https://www.linkedin.com/in/ismail-hakim/">https://www.linkedin.com/in/ismail-hakim/</a> Company Website — <a href="https://cyberkarta.com/">https://cyberkarta.com</a>
<h3>The Benefit</h3>
The benefits of a custom dashboard in Wazuh come down to visibility, efficiency, and alignment with your needs. Here are the main advantages:
<ol>
<li>
Better communication with management — Create high-level KPI dashboards for executives, for example, to show attack trends, risk scores, or vulnerability counts in a simplified view.</li>
<li>
Faster incident response — Tailored panels make it easier to spot anomalies and attacks quickly. For example, a widget showing the top 10 most recent cases of malware infection.</li>
<li>
Adaptability to the environment — Every organization has unique log sources (firewall, EDR, cloud, and applications). Custom dashboards allow integrated and consistent visualization of this data.</li>
</ol>
<h3>Configuring Your First Wazuh Custom Dashboard</h3>
Creating dashboards in Wazuh is a simple and practical process once you know where to begin. In this section, we’ll walk through Configuring Your First Wazuh Custom Dashboard, guiding you from the initial screen to a working security view.
[STEP 1] Initial Configuration of Wazuh Dashboard
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*lYkkz_p-gbnaiSmT"></figure><ol>
<li>To begin with, locate the hamburger menu in the top corner of your dashboard.</li>
<li>Under the explore sub-menu, select the “Dashboards” option.</li>
<li>To enrich the data collected in the Wazuh Custom Dashboard, it is recommended to install some sample data.
</li>
</ol>
[STEP 2] Adding Sample Data
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*aX45d2NxC9xHD09r"></figure><ol>
<li>On this page, you can choose different sample datasets to populate your Wazuh Custom Dashboard. For the purpose of this blog, there are no issues with selecting all available sample data.</li>
<li>If the data is added successfully, an “INSTALLED” label will appear at the top of each box.</li>
</ol>
[STEP 3] Creating The First Wazuh Custom Dashboard
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*rQ8YHQmQAFxxICwV"></figure>After all necessary data has been added, you can return to the dashboard creation menu from “STEP 1” and click the “Create new dashboard” button.
[STEP 4] Adding the First Object to Your Wazuh Custom Dashboard
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*uJ3xWhSpOpQvLH-_"></figure><ol>
<li>Initially, your custom dashboard is empty. To start adding object(s), locate the “Create new” button.</li>
<li>For example, choose a pie object.</li>
<li>Choose “wazuh-alerts-*” as the data source.</li>
</ol>
[STEP 5] Configuring Pie Object
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*YnPKUxUPMZuiPfDx"></figure><ol>
<li>The data can be aggregated based on count, sum, top hit, or unique count. For now, we’ll stick to count-based aggregation. For naming conventions, you can define a custom label for your object.</li>
<li>For a pie chart object, it is recommended to choose the “Split slices” option. Then, select the field based on the Wazuh Alerts field name. For example, if you choose “rule.description”, Wazuh will classify and count the alert percentage based on the rule description. Additionally, it is important to decide the size of the pie chart segment. In this example we choose the top 10 most alerts based on the rule description.</li>
<li>After filling in all the required fields, click the “Update” button.</li>
<li>Don’t forget to “Save” your pie chart object.</li>
</ol>
[STEP 6] Saving Object
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*ZwEKBBLNy8jDcN5w"></figure>This step involves creating a title and description for the object. Once the object is saved, it will appear on your custom dashboard.
[STEP 7] Optionally, Other Objects can be Added to the Custom Dashboard
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*XOhxnu348diiLI_F"></figure>In this step, we create a metric object and add it to the custom dashboard. It’s useful to display the total alerts generated by Wazuh on your dashboard, right?
[STEP 8] Defining Time Range
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*_We9SqSP-ZR73Szb"></figure>The Wazuh Custom Dashboard is a special feature. You can define a time range, and all metrics on the dashboard will adjust accordingly. Here are the sub-steps to customize the time range:
<ol>
<li>Locate the time selection in the top menu bar.</li>
<li>
Choose a time range suitable for your dashboard.</li>
<li>
Update the time range.</li>
</ol>
[STEP 9] Saving Dashboard and Other Additional Features
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*0NrftyvGMNDx4FEf"></figure>To finish all dashboard customization, save your progress by clicking the Save button in the top corner. Additionally, you can create a visual report based on the custom dashboard by clicking the Reporting button.
If you want to create other dashboards, use the Create new menu in the top-right corner.
<h3>Closing</h3>
By following these steps, you’ve created your first Wazuh Custom Dashboard and learned how to add objects, apply filters, and adjust time ranges. A custom dashboard gives you clear visibility into alerts, compliance, and security trends — tailored to your own needs.
You can continue refining your dashboard with new visualizations, integrate more data sources, and build reports that communicate insights effectively to both technical teams and management. With Wazuh, your dashboard becomes a powerful window into the security posture of your environment.
For more information, you can always refer to the documentation about Wazuh Custom Dashboard <a href="https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/creating-custom-dashboards.html">https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/creating-custom-dashboards.html</a>.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=a94528bf2e23" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/wazuh-custom-dashboard-attack-statistics-a94528bf2e23">Wazuh Custom Dashboard &amp; Attack Statistics</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Wazuh Custom Dashboard &amp; Attack Statistics

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*6OGvC_IapoOhPXIq"></figure>In late 2022, AI shocked the world by chatting like a human. By 2023, it could paint digital masterpieces, compose music, and even write code. Fast-forward to 2025 — AI isn’t just answering our questions, it’s planning our trips, monitoring our health, predicting market shifts, and designing the next skyscraper. It’s woven so seamlessly into our lives that we barely notice when it’s there… until it surprises us.
But behind the headlines, AI is still a field of mathematics, data, and logic — not magic. This guide is your map to understanding it from the ground up.
Hi, I’m Ismail — CEO of Cyberkarta, one of the fastest-growing cybersecurity companies in Indonesia. If you have ideas, insights, or challenges in cybersecurity that you’d like to explore together, feel free to reach out through the comments or connect with me on LinkedIn. I’d love to hear from you and collaborate on building a safer and more resilient digital ecosystem.
LinkedIn Profile — <a href="https://www.linkedin.com/in/ismail-hakim/">https://www.linkedin.com/in/ismail-hakim/</a> Company Website — <a href="https://cyberkarta.com/">https://cyberkarta.com</a>
<h3>So, What Exactly Is AI?</h3>
Artificial Intelligence (AI) is the ability of a machine to perform tasks that typically require human intelligence — such as learning, reasoning, problem-solving, and decision-making.
Think of it as teaching a computer how to “think” without explicitly telling it every single step.
<ul>
<li>Not magic: AI doesn’t “understand” like we do.</li>
<li>Not conscious: It processes patterns and probabilities, not feelings.</li>
</ul>
<h3>The Three Main Types of AI</h3>
Narrow AI (ANI) AI built for a single purpose, meaning it is designed and trained to excel in one specific domain or solve one narrowly defined problem without the flexibility to apply its knowledge outside of that scope. For example, a convolutional neural network trained to classify cats vs. dogs, a gradient boosting model scoring credit card transactions for fraud, your music recommendation system, spam filter, or face unlock feature — all are narrow AI, powerful in one domain but unable to operate outside their trained scope.
General AI (AGI) The hypothetical “holy grail” of AI — representing the vision of a machine with the flexibility, adaptability, and cognitive depth of human intelligence, capable of learning any task, applying reasoning across completely different fields, and improving itself over time. For example, an AGI could read a complex legal case, design a building plan, debug a large software system, and hold a nuanced philosophical debate — all without retraining — showing human-like reasoning and adaptability across domains. We’re not there yet, and experts debate when (or if) we’ll reach it.
Generative AI A special branch of AI that creates, focusing on generating new and original outputs rather than just analyzing or classifying existing data. Text, images, code, video, and music — all generated from learned patterns in massive datasets. For example, large language models can draft legal contracts, diffusion models can render photorealistic concept art from text prompts, and code generation models can produce fully functional scripts from a few lines of natural language. This is the technology behind tools like GPT-5, Midjourney, and DALL·E.
<h3>How AI Works in 2025</h3>
At its core, AI works in three big steps:
<ol>
<li>
Neural Networks Inspired by the human brain’s structure, these are layers of “neurons” that transform data step by step. For example, in image recognition, a convolutional neural network might take raw pixel data, detect edges and shapes in early layers, identify complex features like eyes or wheels in deeper layers, and finally classify the image as a cat, car, or any other category.</li>
<li>
Training Data AI learns patterns by analyzing huge datasets — but the quality and diversity of this data determine how fair, accurate, and useful the AI will be. For example, a sentiment analysis model trained only on English-language tweets might perform poorly when analyzing slang-heavy posts in Spanish, and an image recognition model trained on daylight photos may misclassify objects in low-light images.</li>
<li>
Inference Once trained, the AI applies what it learned to make predictions, answer questions, or generate new content. For example, a language model might take a question about climate change, use its trained parameters to retrieve relevant patterns from its knowledge, and generate a coherent paragraph; or an image classifier could instantly label a new photo as a Labrador retriever after seeing thousands of dog breeds during training.</li>
</ol>
<h3>AI in Your Daily Life (2025 Edition)</h3>
Even if you never “use” AI intentionally, it’s everywhere:
Personal Learning Tutors Example: A student learning French uses LinguaFlex AI, which listens to their pronunciation, identifies recurring grammar mistakes, and changes the lesson flow instantly. If the AI notices the student struggles with past tense verbs, it shifts to more exercises on that topic — even generating custom dialogues based on the student’s favorite hobbies.
Copilots for Work Example: A project manager opens SlideCraft AI and simply types: “Make a 10-slide presentation summarizing our Q2 sales, focusing on Asia-Pacific growth.” Within seconds, the AI pulls real sales data, creates charts, writes bullet points, and applies the company’s branding — ready for a quick human review before the meeting.
Health Devices Example: A runner wears a BioTrack 5 smartwatch. Over months, the AI notices subtle changes in heart rate recovery and sleep patterns that might indicate early cardiovascular stress. Before symptoms appear, the device sends a notification: “Consider a check-up — unusual patterns detected over the past two weeks.”
Smart City Systems Example: In Singapore’s downtown district, CityFlow AI controls traffic lights in real time. It analyzes live camera feeds, public transport schedules, and even upcoming weather changes. When rain is detected, it automatically extends crossing times for pedestrians and reroutes buses to avoid congested intersections — cutting commute times by 18%.
<h3>AI Myths</h3>
<ul>
<li>
Myth: AI understands like a human. Reality: It predicts the next best word, pixel, or decision based on patterns in data.</li>
<li>
Myth: AI will replace all jobs. Reality: It will automate parts of many jobs — the winners will be those who learn to work with it.</li>
</ul>
<h3>Why Understanding AI Matters</h3>
<ul>
<li>Knowing AI’s capabilities and limits will help you adapt in almost any profession.</li>
<li>
Awareness of bias, privacy risks, and misuse is essential.</li>
<li>In a world where AI shapes information, knowing how it works helps you trust (or question) its outputs.
</li>
</ul>
<h3>Closing Thoughts</h3>
AI in 2025 isn’t the distant sci-fi dream we imagined — it’s here, embedded in our homes, offices, cars, and phones. The better you understand it, the more you can shape how it works for you, not against you.
The next time an AI answers your question, draws your idea, or automates a boring task — you’ll know what’s happening under the hood. And maybe, you’ll see not just what AI is, but what it could become.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=ee39ae97f08e" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/ai-101-for-2025-the-beginners-guide-for-the-post-chatgpt-era-ee39ae97f08e">AI 101 for 2025: The Beginner’s Guide for the Post-ChatGPT Era</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

AI 101 for 2025: The Beginner’s Guide for the Post-ChatGPT Era

<h3>Leveraging Wazuh for Compliance with Bank Indonesia and OJK Cybersecurity Regulation (Part 2) — Auditor Guidelines</h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*AfdvsypGEGbAvgvE"></figure>This article is part of a multi-part series on leveraging Wazuh to meet Bank Indonesia and OJK cybersecurity requirements. If you haven’t read the first installment, which introduces the regulatory landscape and explains how Wazuh aligns with those mandates, you can access it here: <a href="https://medium.com/cyberkarta/leveraging-wazuh-for-compliance-with-bank-indonesia-and-ojk-cybersecurity-regulation-part-1-2e6fd3b0a780">https://medium.com/cyberkarta/leveraging-wazuh-for-compliance-with-bank-indonesia-and-ojk-cybersecurity-regulation-part-1-2e6fd3b0a780</a>.
Hi, I’m Ismail — CEO of Cyberkarta, one of the fastest-growing cybersecurity companies in Indonesia. If you have ideas, insights, or challenges in cybersecurity that you’d like to explore together, feel free to reach out through the comments or connect with me on LinkedIn. I’d love to hear from you and collaborate on building a safer and more resilient digital ecosystem.
LinkedIn Profile — <a href="https://www.linkedin.com/in/ismail-hakim/">https://www.linkedin.com/in/ismail-hakim/</a> Company Website — <a href="https://cyberkarta.com/">https://cyberkarta.com</a>
<h3>Introduction</h3>
In the context of a Cybersecurity &amp; Information System Resilience audit, reviewing the configuration of a Security Information and Event Management (SIEM) platform is a critical step. A SIEM is more than just a centralized log repository — its configuration determines how effectively it can detect, alert, and respond to potential threats in real time. An improperly tuned SIEM may still collect data, but it could fail to generate actionable alerts, leaving security incidents undetected until it’s too late.
Wazuh exemplifies this broader role. Beyond basic log collection, it provides a comprehensive security monitoring framework that includes threat detection, vulnerability assessment, compliance monitoring, and active response capabilities. This combination makes Wazuh a pivotal tool for organizations aiming to meet regulatory obligations while enhancing their security posture.
From a regulatory standpoint, Indonesia’s financial and payment system sectors operate under stringent security requirements. Regulations such as PBI №2/2024 and PADG №24/2024 from Bank Indonesia, along with POJK №11/03/2022, SEOJK №21/MRTI, and SEOJK №29/SEOJK.03/2022 from Otoritas Jasa Keuangan (OJK), explicitly mandate robust security event monitoring and incident detection capabilities. These rules aim to ensure that financial institutions can swiftly identify, analyze, and respond to threats — objectives that a properly configured Wazuh deployment is well-suited to fulfill.
<h3>Understanding the Auditor’s Objective</h3>
When assessing Wazuh as part of a Cybersecurity &amp; Information System Resilience audit, the auditor’s primary goal is to determine whether the platform is deployed, configured, and maintained in a way that meets both regulatory obligations and organizational security needs.
<ol>
<li>A key focus is on coverage. Wazuh must actively monitor all critical assets — including servers, endpoints, network devices, and applications — to ensure no blind spots exist in the organization’s security posture. This requires verifying not just the presence of agents, but also their proper configuration and operational status.</li>
<li>From an audit perspective, it is also important to classify assets based on their business function and criticality. For example, core banking systems, payment gateways, and customer data repositories will require a higher level of monitoring and alerting sensitivity compared to non-critical systems.</li>
<li>Finally, the evaluation should go beyond simply confirming that Wazuh is running. The real test is in its effectiveness — whether it detects relevant security events, generates timely alerts, and supports appropriate responses. A fully operational Wazuh instance that fails to catch actual threats offers a false sense of security and would be considered non-compliant from both a regulatory and operational standpoint.</li>
</ol>
<h3>Audit Preparation</h3>
Before conducting the technical review, an auditor should ensure that the necessary context, documentation, and baseline information are in place. This preparation phase is essential for understanding the current Wazuh deployment, identifying potential compliance gaps, and focusing the audit on the most critical areas.
<ol>
<li>
Request the Wazuh Architecture Diagram Obtain a clear visual representation of the Wazuh environment, including servers, indexers, dashboards, and agents. This will help verify whether the deployment matches the organization’s documented design and supports high availability, scalability, and security requirements.</li>
<li>
Ask for the List of Monitored Assets &amp; Agent Coverage Request an inventory of all monitored assets and confirm the Wazuh agent installation status for each. The goal is to ensure complete coverage of critical systems, including servers, endpoints, network devices, and business-critical applications, with no unmonitored gaps.</li>
<li>
Obtain Policies &amp; Procedures Review documented alert management, tuning, and escalation procedures. This ensures that Wazuh alerts are handled consistently, false positives are managed effectively, and critical events receive timely attention.</li>
<li>
Check Regulatory Requirements vs. Implementation Compare regulatory requirements (e.g., PBI 2/2024, PADG 24/2024, POJK 11/03/2022, SEOJK guidelines) with the company’s current security monitoring practices. Note that Wazuh and other security tools can complement each other in fulfilling compliance requirements, so it is important to assess them as an integrated monitoring ecosystem.</li>
<li>
Check Version &amp; Update History Verify the version and update history for both the Wazuh server and agents. Outdated versions may have known vulnerabilities and lack features required for effective monitoring and compliance reporting.</li>
</ol>
<h3>Audit Scope and Audit Controls</h3>
This audit scope focuses on evaluating the deployment, configuration, and operational effectiveness of Wazuh as part of the organization’s security monitoring and incident detection framework based on PBI №2/2024 and PADG №24/2024 from Bank Indonesia, along with POJK №11/03/2022, SEOJK №21/MRTI, and SEOJK №29/SEOJK.03/2022 from Otoritas Jasa Keuangan (OJK). It covers core deployment checks to verify system health, coverage, secure communications, and infrastructure readiness; configuration reviews of agents, groups, and server settings to ensure alignment with security requirements; rules and detection capabilities to confirm coverage of organization-specific threats and detection accuracy; compliance and vulnerability modules to validate regulatory alignment and vulnerability identification; and alert management and response processes to assess classification, notification, escalation, and automated response effectiveness. This scope ensures Wazuh is not only running but delivering actionable, compliant, and timely security intelligence. The following audit controls are designed to guide auditors in systematically evaluating Wazuh’s deployment.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*RgUtnfJE2RNbic4prLimLg.png"><figcaption>Core deployment — audit controls &amp; objectives</figcaption></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*_TE3joA6EAiVmCgxNuwYww.png"><figcaption>Configuration audit — controls &amp; objectives</figcaption></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*U6GcmX7mCQNvuXHPG28Phw.png"><figcaption>Rules &amp; detection — audit controls &amp; objectives</figcaption></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*9b8yk0v6vlzJZ1FWVH-dNg.png"><figcaption>Compliance &amp; vulnerability modules — audit controls &amp; objectives</figcaption></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*CfRkcGntxMOPyBPJHXzYXA.png"><figcaption>Alert management &amp; response — audit controls &amp; objectives</figcaption></figure><h3>Audit Evidence Collection</h3>
To ensure transparency, traceability, and verifiability of audit findings, auditors should collect and retain supporting evidence for each control tested. This documentation not only substantiates audit conclusions but also provides a reference for remediation and follow-up reviews. For each audit check performed, evidence should include:
<ol>
<li>
Screenshot from Wazuh Dashboard Capture relevant screens showing system status, configurations, alerts, or scan results. Screenshots should clearly display timestamps, asset identifiers, and any relevant filter criteria applied.</li>
<li>
Configuration File Excerpt Extract the specific portion of the configuration file (e.g., /var/ossec/etc/ossec.conf, decoder XML files, rules) that demonstrates the control setting or parameter being audited. Redact any sensitive information not essential to the audit record.</li>
<li>
Command Output (with Date/Time) Include terminal output from commands executed during the audit (e.g., cluster status checks, service health commands, rule validation tests). Ensure that the output includes the date and time to confirm the context and validity of the evidence.</li>
</ol>
<h3>Common Audit Findings</h3>
During Wazuh configuration and effectiveness audits, several recurring issues are often identified. These findings highlight gaps that can reduce the platform’s ability to provide timely and accurate threat detection:
<ol>
<li>
Missing Agent on Critical Systems Critical servers, endpoints, or network devices are not covered by a Wazuh agent, creating blind spots in monitoring and alerting.</li>
<li>
FIM Not Monitoring Sensitive Application Directories File Integrity Monitoring (&lt;syscheck&gt;) is either disabled or not configured to cover critical application paths, allowing unauthorized changes to go undetected.</li>
<li>
Outdated or Unmaintained Detection Rules Wazuh still operates with the initial ruleset configuration without periodic updates, resulting in missed detection of new threats or vulnerabilities.</li>
<li>
Outdated Wazuh Version Running an older version of Wazuh exposes the environment to known vulnerabilities and prevents access to the latest detection capabilities and features.</li>
<li>
Alerts Not Integrated into Incident Response Workflow Generated alerts are not linked to documented escalation or response processes, leading to delays in containment and remediation efforts.</li>
</ol>
<h3>Conclusion and Recommendations</h3>
A well-configured and actively maintained Wazuh deployment is essential for meeting regulatory requirements and ensuring strong Cybersecurity &amp; Information System Resilience. Continuous monitoring and periodic configuration reviews are critical to sustaining detection accuracy, reducing false positives, and maintaining full asset coverage.
It is recommended to conduct quarterly Wazuh health checks to validate deployment status, review rule effectiveness, and confirm alignment with evolving threats and compliance obligations. This should include checks on version currency, agent coverage, ruleset updates, and integration with incident response processes.
To improve oversight and executive awareness, organizations should also implement automated compliance reporting within Wazuh. These reports can provide management with a clear view of monitoring coverage, detected vulnerabilities, and compliance posture, enabling informed decisions and proactive risk mitigation.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=51ded924ebe2" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/leveraging-wazuh-for-compliance-with-bank-indonesia-and-ojk-cybersecurity-regulation-part-2-51ded924ebe2">Leveraging Wazuh for Compliance with Bank Indonesia and OJK Cybersecurity Regulation (Part 2) —…</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Leveraging Wazuh for Compliance with Bank Indonesia and OJK Cybersecurity Regulation (Part 2) —…

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*Yf-CNUOiu3J2KALr"></figure>As cyber threats continue to evolve in complexity and impact, Bank Indonesia and the Financial Services Authority (OJK) have issued updated regulatory frameworks to enhance the security posture and operational resilience of entities in the financial sector.
Hi, I’m Ismail — CEO of Cyberkarta, one of the fastest-growing cybersecurity companies in Indonesia. If you have ideas, insights, or challenges in cybersecurity that you’d like to explore together, feel free to reach out through the comments or connect with me on LinkedIn. I’d love to hear from you and collaborate on building a safer and more resilient digital ecosystem.
LinkedIn Profile — <a href="https://www.linkedin.com/in/ismail-hakim/">https://www.linkedin.com/in/ismail-hakim/</a> Company Website — <a href="https://cyberkarta.com/">https://cyberkarta.com</a>
<h3>Introduction</h3>
Bank Indonesia, as the central bank of the Republic of Indonesia, is responsible for maintaining monetary stability, payment system security, and financial system resilience. It regulates cybersecurity for payment systems and financial market players through:
<ul>
<li>
PBI No. 2 of 2024 on Cybersecurity and Information System Resilience,</li>
<li>
PADG No. 24 of 2024 as the implementing technical guideline for PBI 2/2024.</li>
</ul>
Otoritas Jasa Keuangan (OJK) is the Financial Services Authority of Indonesia, overseeing financial institutions such as banks, insurance companies, and fintech entities. It provides regulatory guidance on IT risk and innovation through:
<ul>
<li>
POJK No. 11/03/2022 on the Information Technology Provider for Banking Industry,</li>
<li>
SEOJK No. 21/MRTI as the implementing circular of POJK 11/03/2022,</li>
<li>
SEOJK No. 29/SEOJK.03/2022 on Risk Management in the Use of Information Technology by Commercial Banks.</li>
</ul>
These regulations require financial institutions, payment system operators, and other regulated entities to:
<ul>
<li>Establish strong cybersecurity governance,</li>
<li>Identify and mitigate cyber risks,</li>
<li>Detect and respond to cyber incidents effectively,</li>
<li>Maintain maturity in cybersecurity practices,</li>
<li>Report incident and maturity assessments in strict formats and timelines,</li>
<li>Demonstrate compliance and audit readiness.</li>
</ul>
Wazuh, an open-source Security Information and Event Management (SIEM) solution, offers a comprehensive suite of features that can support financial institutions in meeting these obligations, including:
<ul>
<li>Real-time threat detection and correlation</li>
<li>File Integrity Monitoring (FIM)</li>
<li>Centralized log collection and secure storage</li>
<li>Auditd-based activity monitoring</li>
<li>Vulnerability detection</li>
<li>Custom rule creation for regulation-specific monitoring</li>
<li>Automated incident response and alerting</li>
</ul>
In this blogpost, we will explore how Wazuh can help your organization align with Indonesia’s most up-to-date cybersecurity and IT governance regulations — PBI 2/2024, PADG 24/2024, POJK 11/03/2022, SEOJK 21/MRTI, and SEOJK 29/SEOJK.03/2022 — through concrete use cases and compliance mappings.
<h3>Understanding the Regulations</h3>
To effectively build a compliant and secure infrastructure, financial institutions in Indonesia must first understand the scope and intent of the prevailing regulations issued by Bank Indonesia and Otoritas Jasa Keuangan (OJK). These regulations establish a standardized framework to govern cybersecurity risk, operational resilience, incident response, and auditability in the financial sector.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*lpX6oBRVQqZXShqr"><figcaption>Images: Regulations covered in this blogpost.</figcaption></figure><h3>Bank Indonesia Regulations</h3>
<ol><li>
PBI No. 2 of 2024 — Cybersecurity and Information System Resilience
</li></ol>
<ul>
<li>Focuses on protecting confidentiality, integrity, and availability of financial systems and data.</li>
<li>Covers governance, prevention, detection, response, and recovery from cyber incidents.</li>
<li>Requires reporting cyber incidents within 1 hour (initial notification) and full reporting within 3 calendar days.</li>
<li>Applies to payment system operators, financial market players, and supporting institutions.</li>
</ul>
PBI No. 2 of 2024 emphasizes:
<ul>
<li>Cyber incident prevention (identification, protection, detection)</li>
<li>Response and recovery readiness</li>
<li>Logging and documentation of incidents</li>
<li>Periodic maturity assessments</li>
</ul>
2. PADG No. 24 of 2024 — Technical Guideline for PBI 2/2024
<ul>
<li>Serves as the implementation framework for PBI 2/2024.</li>
<li>Details operational procedures, reporting templates, incident classification, and technical assessments.</li>
<li>Outlines periodic reporting (e.g., annual cybersecurity maturity assessments).</li>
<li>Requires technical controls such as:</li>
<li>Continuous monitoring and alerting</li>
<li>Incident logging and forensic support</li>
<li>Response workflows with reporting structures</li>
</ul>
<h3>OJK Regulations</h3>
1. POJK No. 11/03/2022 — Information Technology Provider for Banking Industry
<ul>
<li>Requires integration of IT risk into enterprise-wide risk management.</li>
<li>Covers system development, operations, third-party risk, data protection, and continuity planning.</li>
</ul>
POJK No. 11/03/2022 mandates:
<ul>
<li>Secure logging and monitoring of IT infrastructure</li>
<li>Regular internal/external IT audits</li>
<li>Risk-based access control and configuration management</li>
</ul>
2. SEOJK No. 21/SEOJK.03/2017 (MRTI) — IT Risk Management for Financial Institutions
<ul><li>Provides technical instructions on how to apply several controls in POJK 11/03/2022.</li></ul>
SEOJK No. 21/SEOJK.03/2017 (MRTI) emphasizes:
<ul>
<li>Early risk identification and real-time threat detection</li>
<li>Vendor risk monitoring</li>
<li>Backup and disaster recovery planning</li>
</ul>
3. SEOJK No. 29/SEOJK.03/2022 — Cybersecurity and Information System Resilience
<ul>
<li>Tailored specifically for commercial banks under OJK supervision.</li>
<li>Clarifies roles of IT Steering Committees and CISO.</li>
</ul>
SEOJK No. 29/SEOJK.03/2022 Emphasizes:
<ul>
<li>Centralized logging and secure storage</li>
<li>Continuous system monitoring</li>
<li>Cyber incident readiness and rapid response coordination</li>
</ul>
<h3>Regulation-to-Capability Mapping</h3>
These mappings illustrate how Wazuh can directly support compliance with BI and OJK mandates, helping institutions simplify regulatory alignment through automated controls and audit-ready features.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1015/1*--v0baCbVg3ot279Apq9yA.png"><figcaption>Table: Regulation-to-Capability Mapping</figcaption></figure><h3>Supporting BCP/DRP (Business Continuity Planning / Disaster Recovery Planning)</h3>
Wazuh plays a strategic role in supporting BCP and DRP initiatives by enabling:
<ul>
<li>
Real-Time Alerting: Helps organizations respond to early indicators of compromise or service disruption.</li>
<li>
System Audit Logs: Maintains a historical trail of events across systems to support root cause analysis and forensic investigation.</li>
<li>
Resource Usage Monitoring: Tracks system health and capacity, which is critical during failover or recovery scenarios.</li>
<li>
Custom Alert Rules: Detects key failures or anomalies that may impact the continuity of critical business services.</li>
<li>
Log Retention: Ensures access to security events and alerts before, during, and after incidents for DR documentation and evaluation.</li>
</ul>
These capabilities empower IT and cybersecurity teams to integrate Wazuh as part of their risk-based BCP/DRP plans, ensuring faster incident response and recovery coordination.
<h3>Enabling Data Classification and Information System Security (Klasifikasi Data dan Keamanan Sistem Informasi)</h3>
National standards emphasize the importance of protecting different classes of data based on sensitivity and business impact. Wazuh helps enforce and monitor data classification policies through:
<ul>
<li>
File Integrity Monitoring (FIM): Tracks changes to files containing classified or sensitive data.</li>
<li>
Access Monitoring: Identifies unauthorized access attempts to sensitive directories or databases.</li>
<li>
Auditd and Sysmon Integration: Enables visibility into user actions, process execution, and access logs.</li>
<li>
Custom Decoders and Rules: Tailor detection to match the organization’s classification scheme and sensitivity levels.</li>
<li>
Security Configuration Assessment (SCA): Assesses compliance of endpoints and servers with hardening policies.</li>
</ul>
By aligning Wazuh’s monitoring capabilities with internal data classification policies and information system controls, organizations can reinforce the confidentiality, integrity, and availability (CIA) of their critical assets.
<h3>Conclusion</h3>
As the cybersecurity landscape continues to grow more complex, financial institutions and payment system operators in Indonesia must proactively align with the regulatory expectations set forth by Bank Indonesia and OJK. The combination of PBI 2/2024, PADG 24/2024, POJK 11/03/2022, SEOJK 21/MRTI, and SEOJK 29/SEOJK.03/2022 provides a clear mandate for robust governance, technical controls, and operational resilience.
Wazuh, as a powerful and flexible open-source SIEM solution, offers the visibility, automation, and audit-readiness required to meet these demands. From real-time detection to vulnerability management, log centralization, and compliance reporting, Wazuh delivers actionable insights and operational assurance across all layers of security.
By integrating Wazuh into their cybersecurity architecture, institutions can not only ensure compliance but also strengthen their ability to detect threats, respond swiftly to incidents, and maintain business continuity under pressure.
In a regulatory environment that prioritizes maturity, accountability, and responsiveness, Wazuh is a strategic enabler of secure, compliant, and future-ready financial infrastructure in Indonesia.
💡 Coming Up Next: Real-World Examples
The next part of this blog series will focus on practical examples and use cases that illustrate how Wazuh can be applied in real operational environments. These scenarios will highlight the relevance of Wazuh’s capabilities in supporting day-to-day cybersecurity operations and regulatory compliance efforts within Indonesia’s financial sector.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=2e6fd3b0a780" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/leveraging-wazuh-for-compliance-with-bank-indonesia-and-ojk-cybersecurity-regulation-part-1-2e6fd3b0a780">Leveraging Wazuh for Compliance with Bank Indonesia and OJK Cybersecurity Regulation (Part 1)</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Leveraging Wazuh for Compliance with Bank Indonesia and OJK Cybersecurity Regulation (Part 1)

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*oMov4wL2zWMDXRmgQUOmKg.png"><figcaption>Ruby Sinatra Application</figcaption></figure>Ruby might not always be the loudest voice in the room these days, but it’s still a solid favorite for developers who love clean syntax and rapid development. As of 2025, Ruby ranks in the top 20 most loved languages according to the Stack Overflow Developer Survey — proof that its charm hasn’t worn off. And while Rails often steals the spotlight, Sinatra continues to quietly power thousands of lightweight apps, APIs, and internal tools around the world.
Simple, fast, and incredibly flexible, Sinatra is still a go-to for developers who want to build web apps without all the extra noise. Whether you’re prototyping an idea, building a microservice, or just learning the ropes of web development in Ruby, Sinatra makes it easy to get started.
In this blog, we’re diving into a key skill every Ruby (and Sinatra) developer should have in their toolkit: debugging. Let’s set up rdbg and walk through how to trace, break, and inspect your Ruby code like a pro — even in a minimal Sinatra app.
<h3>Quick Break</h3>
Alright, cybersecurity’s a wild ride, right? Quick heads-up, I’m with Cyberkarta.
We’re all about that research-backed security, diving deep into your systems for audits or keeping an eye out for threats around the clock. Wanna know more? Check us out at<a href="https://cyberkarta.com/"> https://cyberkarta.com</a> or shoot us an email at <a href="mailto:business@cyberkarta.com">business@cyberkarta.com</a>.
<h3>Firing Up VSCode for Ruby Remote Debugging</h3>
On our successful remote debugging, we used VSCode rdbg Ruby Debugger by Koichi Sasada (<a href="https://marketplace.visualstudio.com/items?itemName=KoichiSasada.vscode-rdbg">https://marketplace.visualstudio.com/items?itemName=KoichiSasada.vscode-rdbg</a>).
To connect our remote debugger in VSCode to the debugee inside the docker container, we can configure .vscode/launch.json file.
<pre>{ "version": "0.2.0", "configurations": [ { "name": "Remote Debug Sinatra", "type": "rdbg", "request": "attach", "debugPort": "localhost:12345", "localfsMap": "/app/:${workspaceFolder}/app/", } ] }</pre>
Hovering these variables in VSCode, will help you to restructure key:value required. VSCode will also mark incorrect key:value combinations during your restructuring effort.
<h3>`rdbg` For Remote Debugging</h3>
First of all, make sure all of your code is in the testing environment. Then, you can include this line inside Gemfile, or install it on the testing environment.
<pre>gem 'debug'</pre>
To execute remote debugging, you can utilize rdbg. It is the built-in debugger for Ruby, introduced in Ruby 3.1. It gives you a powerful, interactive way to inspect and control your Ruby code while it’s running.
<pre># inside Dockerfile RUN rdbg --open --host "0.0.0.0" --port 12345 -- /your/ruby/file.rb EXPOSE 12345</pre>
Finally you can build and run the docker container. Don’t forget to expose the debugging port.
<pre>docker build -t sinatra_debug . docker run -p 80:80 -p 12345:12345 -it sinatra_debug</pre>
<h3>Testing</h3>
Remote debugging testing.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*UfVgCcvyG6VViSsT"><figcaption>Our remote debugger has successfully set a breakpoint.</figcaption></figure>Source Code Navigation.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*eXmASytdUmDA1QHJ"><figcaption>The variables are clearly visible to us.</figcaption></figure><h3>Closing</h3>
Debugging might not be the flashiest part of development, but it’s where the real understanding happens. With `rdbg` in your toolkit, you’ve got a powerful way to dig into your Ruby or Sinatra app, fix bugs faster, and even spot potential security issues before they become problems. Whether you’re building something new or hunting down a weird edge case, solid debugging skills will always have your back.
Happy coding — and happy bug hunting!
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=cee53338ed61" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/remote-debugging-ruby-sinatra-application-using-docker-and-vscode-cee53338ed61">Remote Debugging Ruby Sinatra Application using Docker and VSCode</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Remote Debugging Ruby Sinatra Application using Docker and VSCode

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*XIgv0Lg0l_rnzEJsVhsMUg.png"></figure>A Fake BTS (Base Transceiver Station) Attack is a type of man-in-the-middle (MITM) attack where an attacker sets up a rogue cellular tower (BTS) to intercept mobile communications. This attack is commonly used for eavesdropping, location tracking, SMS interception, and even injecting malicious payloads into a victim’s device.
Historically, in 2017 fake-BTS attacks were used to distribute banking trojans called “Swearing Trojan”. A trojan that specialized in stealing financial information from online banking systems. It’s a dangerous form of trojan horse malware that can lead to identity theft and other types of fraud.
<h3>How Fake BTS Attacks Happen</h3>
Every mobile network technology is susceptible to fake BTS attacks. However GSM/2G networks are the most vulnerable because of several reasons.
<ol>
<li>GSM does not require mutual authentication between BTS and the mobile device.</li>
<li>Weak encryption (A5/1, A5/2) can be easily cracked or even disabled by a rogue BTS.</li>
</ol>
In Indonesia, SMS services are still supported over 2G networks. While many operators have phased out 3G services to reallocate resources to more advanced technologies like 4G and 5G, 2G networks continue to operate to support basic services such as voice calls and SMS.
Since mobile phones always connect to the strongest available BTS, the rogue BTS may overpower legitimate signals, forcing nearby devices to connect. Once connected, the attacker can intercept calls, SMS, and data traffic, even downgrade encryption (e.g., force 2G with weak encryption) to make decryption easier.
Finally, the attacker can redirect calls, send spoofed SMS, or even deploy malicious software to targeted devices.
<h3>Recent Recorded Attack by Leveraging Fake BTS</h3>
On 6 March 2025, there was one sample of threat actors who leverage fake BTS attacks to send fraudulent links. Deceptively, the link was sent using 83355, a number used by Bank Mandiri to send financial activity notifications to the user.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/630/1*9z76yg21AIFxCjIocEbEEg.jpeg"></figure>The fraudulent message starts with a very convincing word “Mandiri: ”. As if the actor knew that the message would be received by a non-Mandiri user.
<h3>Analyzing the Link</h3>
By proxying traffic from Android to Burp, we can bypass some limitation that may apply (e.g. User-Agent limitation). The link pointed to https[://]qmandiri[.]top/id.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*0HrKAR3PUeeExQUW8bJNdA.png"></figure>If we deep dive more to analyze the fraudulent link, we can find that the link was pointed to 124[.]156[.]199[.]25. This IP comes from Tencent cloud network. There are three open ports (22, 80, and 443) and the same IP is used by domain mandiris[.]top.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*NarHn0kVmX5ikocq52imXg.png"></figure>Even though multiple connection attempts were made, no HTTP responses were returning interesting results. The campaign may either pause or be hidden under a random directory path.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*ukfLuv3fZD8tiMZLbesryg.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*9HI5dn1EzBq0dOSWcvzYOQ.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*iHF9HxLZIJZtpzU70fW6Cw.png"></figure><h3>Closing</h3>
Traditional SMS messaging is still used as delivery method of information and even authentication method (such as SMS OTP). Without any action to the current state of the national-scale network or any other prevention, the impact of fake BTS attacks can be serious in the near future.
More blog at <a href="https://cyberkarta.com/blog">https://cyberkarta.com/blog</a>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=439b9764465c" width="1" height="1" alt=""><hr>
<a href="https://medium.com/cyberkarta/fake-bts-attack-was-leveraged-to-send-bank-mandiri-sms-phishing-aka-smshing-attack-439b9764465c">Fake BTS Attack was Leveraged to Send Bank Mandiri SMS Phishing aka SMShing Attack</a> was originally published in <a href="https://medium.com/cyberkarta">Cyberkarta</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.

Blog Keamanan Siber