Overview

This project documents the design and deployment of a centralized detection and visibility environment for FinEdge, an international fintech startup that recently expanded to a mixed on premise and cloud footprint. The objective was to give FinEdge real time insight into user activity, authentication failures, network anomalies, and suspicious host behavior across endpoints, servers, and cloud workloads. The implementation used Wazuh as the primary threat monitoring and detection platform, augmented with Suricata for network intrusion detection on the on premise web server, and an AWS pipeline that forwards CloudTrail events into Wazuh through S3. The solution was validated with offensive testing from a simulated attacker to ensure alerts, logs, and detection rules behaved as expected.

image.png

The Challenge

FinEdge faced three short term visibility gaps that increase business risk for a payments oriented company

• Minimal telemetry across on premise servers and cloud resources which limits the ability to detect abuse of payment APIs and access to user data

• No consolidated place to observe failed login attempts, suspicious process activity, or lateral movement indicators across servers and cloud APIs

• A desire from leadership for an actionable, centralized detection environment that produces meaningful alerts and supports incident response playbooks

The project goal was to design an architecture that collects relevant host, application, network, and cloud telemetry, normalizes and centralizes it in Wazuh, correlates events for high value detections, and provides a pragmatic, repeatable path to operationalize detection and response.

Tools used

  1. Wazuh for centralized host and cloud telemetry collection, rule based detection, file integrity monitoring and alerting
  2. Suricata as a network intrusion detection system installed on the on premise web server to monitor the network interface for malicious traffic patterns
  3. AWS CloudTrail to capture API level activity in the cloud, S3 to stage event logs, and the Wazuh Manager pipeline for ingestion and correlation of cloud events
  4. Wazuh agents on the on premise file server and web server for log collection, process monitoring and integrity checks
  5. Kali Linux as the attacker machine used for end to end validation and detection testing
  6. Offensive tooling for validation including Hydra, sqlmap, nmap, nikto and the built in ping utility to simulate a range of attacker behaviours
  7. Local operational tooling and documentation for alerts, playbooks and handover notes

The Execution

Servers Configuration

The foundation of any effective monitoring environment begins with a clean, stable server setup. For this project, we provisioned two on-premise Ubuntu 24.04 servers, each simulating a distinct operational role within FinEdge’s infrastructure. These servers serve as the primary on-prem monitoring targets for our Wazuh deployment.