Windows Event Logs guided exercise - cannot edit hosts file to connect to Wazuh

Career Paths SOC Analyst
1

Going through the Windows Event Logs guided exercise, which requires to connect the Windows server machine to a Linux server with Wazuh SIEM.

Step 6 in the Getting Started section directs me to edit the etc/hosts file on the Windows machine in Notepad with the Linux server IP. The problem is that when I save the file, I get the “You don’t have permission to save in this location, contact administrator” message. Which means I cannot put in the correct IP for the Wazuh SIEM.

Furthermore, both “net start wazuh” and “net stop wazuh” in Windows Powershell give me the message “System error 5 has occured. Access is denied.” - System error 5 also typically has to do with admin privileges. “Ping wazuh” obviously does nothing, since it’s the wrong IP in the etc/hosts file.

xxClip
xxClip1486×821 242 KB

Restarting the exercise and resetting all virtual machines has no effect.

EDIT - without connecting the machines, one cannot complete Task 4 within the guided exercise. If you complete the following challenge exercise, then you can get the answer that works in Task 4 as well. Still, something is wrong here. END EDIT

Thanks in advance for looking into this.

2

You need to use the elevated PowerShell window:

image

3

Thank you for responding…

…to clarify, instead of left-clicking on Power Shell, I should have right-clicked “Run as Administrator”. That works. Brain too fried to have thought of that on my own.

Thanks again.

4

image
image253×384 2.64 KB