FortiGate, Sophos and Kaspersky logs in one Wazuh dashboard

AlRayah Market's head office already had three layers of protection, all of them working: a FortiGate firewall at the edge of the network, and Sophos and Kaspersky across the machines and servers. All three run, and all three record what they see — each in its own console.

Which is the problem that only shows when you need it: who opens three consoles every morning? None of them sees what the others see, so a login attempt the firewall blocks and then the same attempt repeating on a machine inside stay two separate events in two separate places, and nobody joins them. The protection was there; what was missing was the layer that reads all three together.

We installed the Wazuh platform on a server of its own at the head office, then pointed the three sources at it: the FortiGate logs, and the Sophos and Kaspersky events from each of their consoles — each source in the way it exports its events, over Syslog or through the product's own event feed.

On top of that we deployed the Wazuh agent across more than one server and more than one workstation, because the log arriving from a security product tells you what that product saw, while the agent on the machine itself tells you what happened on the machine: who signed in, which file changed, which account was added, which service stopped.

Then the part that takes the real time: tuning the rules. Straight after installation Wazuh raises a great many alerts, most of which concern nobody, and anyone who leaves the defaults stops reading the dashboard inside a week. We built the rules around what normal looks like in this particular office, and what falls outside that is what alerts.

It helped that we had built the network itself earlier: the cabling labelled at both ends and the racks ordered, so connecting the sources was reading a known plan rather than a voyage of discovery.

What became available at the head office once it was running:

• One dashboard carrying what the firewall sees, what the endpoint protection sees and what happens on the servers, instead of three consoles that do not talk to each other
• An event at the edge of the network and an event on a machine inside appear in one place in time order, and read as one story
• Repeated failed logins show up as they happen, not afterwards
• A file changed on the servers that matter is recorded, with who and when
• A record to go back to when it is needed, rather than logs each machine overwrites as it fills

The dashboard was handed over on an account in the company's name rather than ours, with a sheet listing every alert rule enabled and why — because a rule nobody knows the reason for is a rule that gets switched off the first time it annoys somebody.