Execution in Windows guided excercise

Career Paths SOC Analyst
1

I dont know what I am doing wrong but my dashboard in wazuh is only showing the disconnected agent and not active,please help.

2

Be sure to follow all the steps in the Getting Started section…

  1. From the dock at the bottom of the screen, click the Terminal Emulator icon to open a new terminal window.

  2. At the command prompt, type ip a and press Enter to display the network configuration for the Wazuh server.

Take note of the IP address. You will need this information in a few minutes.

  1. From the Machines tab, connect to the Windows server.

  2. On the taskbar, right-click the Start icon and select Windows PowerShell (Admin) to open a PowerShell window with admin privileges.

When prompted, click Yes to continue.

  1. At the prompt, type notepad C:\Windows\System32\drivers\etc\hosts and press Enter to open the etc/hosts file in Notepad.

  2. In the etc/hosts file, replace 10.91.2.130 with the IP address for the Wazuh server, then save your changes and close Notepad.

  3. In the PowerShell window, type ping wazuh and press Enter to confirm you can reach the Wazuh server by name.

  4. At the PowerShell prompt, type net stop wazuh and press Enter to stop the local Wazuh agent for Windows.

  5. At the PowerShell prompt, type net start wazuh and press Enter to re-start the Wazuh agent.

Please show the contents of your hosts file, the ping results, and the the net start results if you still have an issue.

3

Thanks Joseph ,I managed to get it right.

1 Like