Monitoring Cisco Network Devices with Wazuh: A Complete Guide
Network infrastructure is the backbone of any modern organization. To secure and monitor that infrastructure, centralized log collection is essential. In this guide, we’ll show you how to collect and analyze syslog messages from Cisco switches or routers using Wazuh, an open-source security platform.
Want hands-on cybersecurity skills? Learn how to simulate attacks, monitor threats, and build a real-world defense lab using free tools like GNS3, Wazuh, and Docker.
🔧 Build Your Own Cybersecurity Lab with GNS3 + Wazuh + Docker – Train, Detect, and Defend in One Platform
Looking for an affordable SIEM that actually works? Discover how Wazuh helps companies monitor, detect, and respond to threats—without breaking the bank.
🛡️ Strengthen Your Cybersecurity Posture with Wazuh – A Scalable & Cost-Effective SIEM Solution
Before you deploy Wazuh, get to know how it works. This deep-dive explains Wazuh’s internal architecture, key use cases, and how to apply it in real-world scenarios.
📚 Understanding Wazuh: Architecture, Use Cases, and Real-World Applications
Whether you're monitoring link status, configuration changes, or login attempts, Wazuh offers a scalable and powerful way to turn raw logs into actionable alerts.
🚀 Why Use Wazuh for Cisco Syslog?
- ✅ Centralized logging for all your switches and routers
- 🔍 Real-time monitoring of network events (e.g., interface status, login attempts)
- ⚠️ Alerting and correlation with other data sources
- 📊 Visualization through the Wazuh dashboard (Kibana)
🛠️ System Architecture
+--------------------+ +------------------------+ +---------------------+
| Cisco Switches +-------------> | Wazuh Manager +-------------> | Wazuh Rules Engine |
| (IOS/ASA/NX-OS) | (UDP/TCP 514) | (Logcollector active) | | (alerts triggered) |
+--------------------+ +-----------+------------+ +---------------------+
|
| Writes
v
+----------------------------+
| /var/ossec/logs/archives/ |
| /var/ossec/logs/alerts/ |
+-------------+--------------+
|
Parses/Forwards to (optional)
v
+------------------------------+
| Wazuh Dashboard (Kibana) |
| Visualization & Searching |
+------------------------------+
⚙️ Step-by-Step Setup
1. Configure Cisco Switch to Send Syslog
Login to the Cisco device and enter configuration mode:
conf t
logging host <WAZUH_IP> transport udp port 514
logging trap informational
service timestamps log datetime msec
exit
Adjust the transport protocol (
udp
ortcp
) and port as needed.
2. Configure Wazuh to Accept Syslog
Edit the Wazuh Manager configuration file:
<!-- /var/ossec/etc/ossec.conf -->
<remote>
<connection>syslog</connection>
<port>514</port>
<protocol>udp</protocol>
<allowed-ips>192.168.10.0/24</allowed-ips>
<local_ip>192.168.10.10</local_ip> <!-- your Wazuh interface IP -->
</remote>
Restart the Wazuh Manager:
sudo systemctl restart wazuh-manager
3. Sample Cisco Syslog Messages
<189>Jun 10 14:22:10 switch01 33953: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/24, changed state to up
<189>Jun 10 14:23:45 switch01 33954: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: admin] [Source: 192.168.1.50]
<190>Jun 10 14:24:30 switch01 33955: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.50)
Wazuh parses and categorizes these using built-in decoders for Cisco devices.
4. Visualizing Logs in Wazuh Dashboard
Once syslog messages are processed:
- Open Wazuh Dashboard (based on Kibana)
- Filter logs by source IP, severity, or keyword
-
Create alerts or dashboards for:
- Interface up/down events
- Failed login attempts
- Unauthorized config changes
🔒 Security Tip: Use <allowed-ips>
The <allowed-ips>
tag ensures that only trusted IPs (your Cisco devices) can send syslog messages:
<allowed-ips>192.168.10.0/24</allowed-ips>
This prevents abuse or noise from unknown sources.
✅ Final Thoughts
Integrating Cisco switches with Wazuh provides a robust and scalable approach to infrastructure monitoring and threat detection. From compliance to performance to security, you gain real-time visibility into your network’s heartbeat.
Need help writing custom rules or dashboards for your Cisco logs? Contact us or drop a comment below!
🔗 Related Resources
Get in Touch with us
Related Posts
- Build a Local Product Recommendation System with LangChain, Ollama, and Open-Source Embeddings
- 2025 Guide: Comparing the Top Mobile App Frameworks (Flutter, React Native, Expo, Ionic, and More)
- Understanding `np.meshgrid()` in NumPy: Why It’s Needed and What Happens When You Swap It
- How to Use PyMeasure for Automated Instrument Control and Lab Experiments
- Supercharge Your Chatbot: Custom API Integration Services for Your Business
- How to Guess an Equation Without Math: Exploring Cat vs. Bird Populations
- How to Build an AI-Resistant Project: Ideas That Thrive on Human Interaction
- Build Your Own Cybersecurity Lab with GNS3 + Wazuh + Docker: Train, Detect, and Defend in One Platform
- How to Simulate and Train with Network Devices Using GNS3
- What Is an LMS? And Why You Should Pay Attention to Frappe LMS
- Agentic AI in Factories: Smarter, Faster, and More Autonomous Operations
- Smarter, Safer EV Fleets: Geo-Fencing and Real-Time Tracking for Electric Motorcycles
- How to Implement Google Single Sign-On (SSO) in FastAPI
- Build Your Own Taxi Booking App with Simplico: Scalable, Secure & Ready to Launch
- Building a Scalable EV Charging Backend — For Operators, Developers, and Innovators
- How to Handle Complex Pricing for Made-to-Order Products in Odoo
- How to Build a Made-to-Order Product System That Boosts Sales & Customer Satisfaction
- Transform Your Operations with Autonomous Agentic AI
- Streamline Fiber Tester Management with a Lightweight EXFO Admin Panel
- Enhancing Naval Mission Readiness with EMI Simulation: Cost-Effective Risk Reduction Using MEEP and Python