Yoshee08

Fixing Wazuh Indexer Plugin Error: Unable to load plugin class [org.opensearch.securityanalytics.SecurityAnalyticsPlugin]

October 17, 2025 by yoshee08 Leave a Comment

Overview After restarting a Wazuh Indexer Node, you may encounter the following startup error: This prevents the node from fully starting. Root Cause This issue occurs when the OpenSearch Security Analytics plugin JAR is missing from: In recent cases, Bitdefender has falsely flagged this JAR file as a threat —Trojan.GenericKD.77203252 — and quarantined or deleted … [Read more…]

Wazuh Load Balancing Issues with Nginx: Why All Agents Hit One Manager

August 14, 2025 by yoshee08 Leave a Comment

TL;DRAll Wazuh agents were ending up on a single manager because the load balancer was using IP-hash stickiness. Because every agent connection passed through a Cloudflare Tunnel, the hash consistently mapped them to the same backend. Changing the 1514 upstream to least_conn balanced new connections across managers and fixed the skew. 1515 (registration) remained pointed … [Read more…]

Web Sign In issues with UAC prompt, while keeping the “Passwordless” functionality

May 27, 2025 by yoshee08 Leave a Comment

Web sign in is a new feature enabled by Microsoft, to allow users to login to their PC using the standard windows login prompt. Users also get any MFA prompts sent my this login, as well as enforcing conditional access policies for signin. Organizations adopting Microsoft’s Web Sign-in (passwordless) feature often leverage the PreferredTenantDomainName setting … [Read more…]

Remove Biometrics and Pin, and Disable Password Login options

April 30, 2025 by yoshee08 Leave a Comment

On Azure AD–joined Windows 10/11 devices, users can sign in offline using the Primary Refresh Token (PRT) that’s cached locally. If you’ve already revoked their PRT from the cloud, they may still be able to unlock the device with a cached password—or, if they use Windows Hello for Business (WHfB), with a PIN or biometric. … [Read more…]

Log All Bash Commands from All Users on Ubuntu

April 18, 2025 by yoshee08 Leave a Comment

You may want to log all commands run by a user in a shell. Even just for yourself, this can be helpful in going back to figure out what you did wrong, or what command you ran 2 months ago to get something to work. Edit /etc/bashrc: and add this line: Run the following to … [Read more…]

Setup an SSH Key on Ubuntu with Ed25519 Encryption

March 12, 2025 by yoshee08 Leave a Comment

This guide walks you through securely setting up SSH keys on your Ubuntu server using the Ed25519 algorithm, known for robust security and efficiency. Step 1: Generate an Ed25519 SSH Key on the Ubuntu Server On your Ubuntu server, generate an Ed25519 SSH key pair: Press Enter to confirm the default location (~/.ssh/id_ed25519). Ensure you … [Read more…]

Installing Wazuh’s MS-Graph API Integration – Transitioning from O365 Integration

August 22, 2024 by yoshee08 Leave a Comment

As someone who’s been working with Wazuh for a while, I’ve come to rely on its powerful capabilities for monitoring and security. Initially, I had the Office 365 (O365) integration enabled in my Wazuh setup. However, I quickly realized that my needs went beyond what O365 integration could offer. Specifically, I wanted to track user … [Read more…]