RivedixRivedix Academy
Wazuh SIEMPaySphere Lab Integration

PaySphere Lab — Wazuh SIEM Setup

MIT WPU × Rivedix Cybersecurity Career Accelerator Bootcamp. Complete guide to deploying Wazuh Manager, connecting the PaySphere app as an agent, and streaming live attack alerts to the dashboard.

App Server — t3.micro
10.0.1.165
Docker (PaySphere)
Wazuh Agent
vsftpd (FTP lab)
JSON logs
alerts
Wazuh Server — t3.medium
10.1.0.228
Wazuh Manager
Wazuh Indexer (OpenSearch)
Wazuh Dashboard
Filebeat
App writes JSON → /var/log/paysphere/app.log→Agent forwards → Wazuh Manager→Manager fires rules → Filebeat → OpenSearch→Dashboard shows live alerts
Part 1 of 6SSH into 10.1.0.228

Wazuh Server Setup

Run on Wazuh Server — 10.1.0.228

1

Download the Wazuh installer and config template:

packages.wazuh.com
curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh
curl -sO https://packages.wazuh.com/4.7/config.yml
2

Edit config.yml and set all three node IPs to 10.1.0.228:

nano config.yml
3

The config.yml should have these values:

nodes:
  indexer:
    - name: node-1
      ip: 10.1.0.228
  server:
    - name: wazuh-1
      ip: 10.1.0.228
  dashboard:
    - name: dashboard
      ip: 10.1.0.228
4

Run the all-in-one installer:

sudo bash wazuh-install.sh -a
Warning: Save the admin password printed at the end — you cannot recover it without a reset.
5

Verify all three services started successfully:

sudo systemctl status wazuh-manager
sudo systemctl status wazuh-indexer
sudo systemctl status wazuh-dashboard