Installation &

first steps

Install OwlH Node

  • Requirements
  • Install OwlH Node
  • Install additional services
    • Internal dummy interface
    • Suricata from sources
    • Zeek from sources
    • Wazuh agent

Install OwlH Master

  • Requirements
  • Install OwlH Master
  • Install OwlH User Interface
  • Install additional services
    • Internal dummy interface
    • Moloch


First Steps

  • Access to OwlH User Interface and verify API connection
  • Setup your first ruleset
  • Register Nodes
  • Configure Node Services
    • Suricata stand-alone
    • Zeek stand-alone
    • Wazuh localfile configuration
  • Configure Node Monitoring


Wazuh and ELK integration

  • Install and register Wazuh agent
  • Wazuh Agent localfile configuration
  • Wazuh Manager rules
    • Add Zeek rules
  • Filebeat on Wazuh Manager
    • Install OwlH Module
  • Elasticsearch and kibana
    • Import OwlH template
    • Import OwlH dashboards

Final checks

  • Verify OwlH dashboards
  • OwlH User Interface checks
  • Traffic quality analysis

What's next?

  • OpenRules create custom rulesets and clone, disable/enable or edit rules
  • Traffic transport configuration
    • socket to network or network to socket
  • Traffic dispatcher configuration
    • set standalone nodes
    • set analyzer nodes pools
  • PCAP analyzer
  • Groups and clusters configuration
  • API for devops

Email us - support@owlh.net