EDR Basics "Activity 35 Error"

Career Paths SOC Analyst
1

I am performing activity 31 to 35 multiple times but Wazuh not generating any new alert and I need this alert to answer 2nd and 4th task

Can anyone help this out

2

image
image1058×754 14.2 KB

PFA - I’m performing all steps right and also Artomic is running

3

I am having the same issue not able to get the last answer the attack doesn’t work

4

I just ran through the lab, and it does work as written:

image
image1245×276 4.79 KB

Some gotchas are to be sure you have the agent installed, be sure you have updated ossec.conf to send sysmon data, and be sure the wazuh service is running after you restart it. If not there is a syntax error in ossec.conf.

5

Thank you so much for your advice I will do it again

6

I got the same result, but it appears the system is not accepting the number one answer. What’s the name of the agent running on windows?

7

[redacted by admin]

I am having trouble getting mine to work to answer number 4.