🎯 EDR, IDS, NSM, SIEM

📖 Quick glossary
* IDS (Intrusion Detection System) watches network or host activity and alerts when something looks suspicious. It doesn’t fix anything by itself
* NIDS / HIDS network IDS vs host IDS. NIDS watches traffic on the wire; HIDS watches files, processes, logs on the machine
* EDR (Endpoint Detection & Response) agent on endpoints that collects telemetry (processes, files, network), detects malicious behavior, and helps investigate & respond (isolate, kill process, etc.)
* NSM (Network Security Monitoring) full network visibility for hunting and historical packet analysis. More about forensic than just alerts
* SIEM (Security Information and Event Management) central system that aggregates logs/alerts from many sources, normalizes data, runs detections, and keeps searchable history
* Vulnerability scanner finds known CVEs in images, packages, OS. Not a detector; it’s preventive
* Audit tool checks systems against security baselines and compliance rules

🔧 What a real EDR needs
1. Endpoint agents collecting process, file, network, and logs
2. Central store + search
3. Detection rules + ability to add custom rules
4. Integration with network telemetry for context
5. Some response options (isolate host, kill process, quarantine file)
6. Vulnerability and config data to prioritise alerts
7. Long-term history for investigations

🧩 How to cover EDR
* Wazuh core of the endpoint story. Agents, log collection, file integrity, alerting, and a centralized manager. Acts like SIEM + HIDS. Good starting point for EDR capabilities
* OSQuery run SQL-like queries on hosts. Great for investigation and periodic inventory. Works well alongside Wazuh (feed OSQuery results into Wazuh)
* ClamAV basic malware scanning on files. Useful for quick scans and quarantine
* Falco runtime detection for containers / Kubernetes. Detect suspicious syscalls, container escapes. Use in any containerised infra
* Security Onion network side: IDS/NSM (Suricata/Zeek/Elastic). Gives packet-level visibility and network alerts to correlate with endpoint telemetry
* Trivy scan container images and repo dependencies (npm, pip). Run in CI and before deploy. Good for supply-chain CVE detection
* OpenVAS / GVM scheduled vulnerability scans of hosts and network services. Good for asset-level risk scoring
* OpenSCAP / Lynis regular configuration audits and compliance checks (CIS, etc.). Use for hardening and evidence for audits

✅ Combinations

1️⃣ EDR-like stack
* Wazuh (agents + manager) — collection, detections, alerts.
* OSQuery — deepen host visibility and hunting.
* ClamAV — file scans.
* Trivy theoretically can be used for for supply chain issue un runtime

2️⃣ Container / Kubernetes + endpoints
1 + Falco (runtime container detection) and Trivy (CI image scanning).

3️⃣ Network-aware, SOC setup
Security Onion + Wazuh + OSQuery + Falco + Trivy + OpenVAS.

4️⃣ Compliance & hardening
Run OpenSCAP / Lynis regularly and feed results into Wazuh.


🤔Final thoughts
Open-source combo gets you close to EDR, but it’s not a commercial EDR out of the box. Things that are harder with OSS and requires some efforts. But wazuh looks like an entry point into that world

#security #research