Monitoring Cisco Network Devices with Wazuh: A Complete Guide
Network infrastructure is the backbone of any modern organization. To secure and monitor that infrastructure, centralized log collection is essential. In this guide, we’ll show you how to collect and analyze syslog messages from Cisco switches or routers using Wazuh, an open-source security platform.
Want hands-on cybersecurity skills? Learn how to simulate attacks, monitor threats, and build a real-world defense lab using free tools like GNS3, Wazuh, and Docker.
🔧 Build Your Own Cybersecurity Lab with GNS3 + Wazuh + Docker – Train, Detect, and Defend in One Platform
Looking for an affordable SIEM that actually works? Discover how Wazuh helps companies monitor, detect, and respond to threats—without breaking the bank.
🛡️ Strengthen Your Cybersecurity Posture with Wazuh – A Scalable & Cost-Effective SIEM Solution
Before you deploy Wazuh, get to know how it works. This deep-dive explains Wazuh’s internal architecture, key use cases, and how to apply it in real-world scenarios.
📚 Understanding Wazuh: Architecture, Use Cases, and Real-World Applications
Whether you're monitoring link status, configuration changes, or login attempts, Wazuh offers a scalable and powerful way to turn raw logs into actionable alerts.
🚀 Why Use Wazuh for Cisco Syslog?
- ✅ Centralized logging for all your switches and routers
- 🔍 Real-time monitoring of network events (e.g., interface status, login attempts)
- ⚠️ Alerting and correlation with other data sources
- 📊 Visualization through the Wazuh dashboard (Kibana)
🛠️ System Architecture
+--------------------+ +------------------------+ +---------------------+
| Cisco Switches +-------------> | Wazuh Manager +-------------> | Wazuh Rules Engine |
| (IOS/ASA/NX-OS) | (UDP/TCP 514) | (Logcollector active) | | (alerts triggered) |
+--------------------+ +-----------+------------+ +---------------------+
|
| Writes
v
+----------------------------+
| /var/ossec/logs/archives/ |
| /var/ossec/logs/alerts/ |
+-------------+--------------+
|
Parses/Forwards to (optional)
v
+------------------------------+
| Wazuh Dashboard (Kibana) |
| Visualization & Searching |
+------------------------------+
⚙️ Step-by-Step Setup
1. Configure Cisco Switch to Send Syslog
Login to the Cisco device and enter configuration mode:
conf t
logging host <WAZUH_IP> transport udp port 514
logging trap informational
service timestamps log datetime msec
exit
Adjust the transport protocol (
udportcp) and port as needed.
2. Configure Wazuh to Accept Syslog
Edit the Wazuh Manager configuration file:
<!-- /var/ossec/etc/ossec.conf -->
<remote>
<connection>syslog</connection>
<port>514</port>
<protocol>udp</protocol>
<allowed-ips>192.168.10.0/24</allowed-ips>
<local_ip>192.168.10.10</local_ip> <!-- your Wazuh interface IP -->
</remote>
Restart the Wazuh Manager:
sudo systemctl restart wazuh-manager
3. Sample Cisco Syslog Messages
<189>Jun 10 14:22:10 switch01 33953: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/24, changed state to up
<189>Jun 10 14:23:45 switch01 33954: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: admin] [Source: 192.168.1.50]
<190>Jun 10 14:24:30 switch01 33955: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.50)
Wazuh parses and categorizes these using built-in decoders for Cisco devices.
4. Visualizing Logs in Wazuh Dashboard
Once syslog messages are processed:
- Open Wazuh Dashboard (based on Kibana)
- Filter logs by source IP, severity, or keyword
-
Create alerts or dashboards for:
- Interface up/down events
- Failed login attempts
- Unauthorized config changes
🔒 Security Tip: Use <allowed-ips>
The <allowed-ips> tag ensures that only trusted IPs (your Cisco devices) can send syslog messages:
<allowed-ips>192.168.10.0/24</allowed-ips>
This prevents abuse or noise from unknown sources.
✅ Final Thoughts
Integrating Cisco switches with Wazuh provides a robust and scalable approach to infrastructure monitoring and threat detection. From compliance to performance to security, you gain real-time visibility into your network’s heartbeat.
Need help writing custom rules or dashboards for your Cisco logs? Contact us or drop a comment below!
🔗 Related Resources
Get in Touch with us
Related Posts
- How Agentic AI and MCP Servers Work Together: The Next Step in Intelligent Automation
- DevOps in Django E-Commerce System with DRF and Docker
- How AI Can Solve Real Challenges in Agile Development
- Connecting TAK and Wazuh for Real-Time Threat Awareness
- Scaling Wazuh for Multi-Site Network Security Monitoring
- Why ERP Projects Fail — and How to Avoid It
- How to Build Strong Communities with Technology
- How AI Can Make Open Zoos More Fun, Smart, and Educational
- How to Choose the Right Recycling Factory for Industrial Scrap
- Understanding Modern Database Technologies — and How to Choose the Right One
- The Future Is at the Edge — Understanding Edge & Distributed Computing in 2025
- NVIDIA and the Two Waves: From Crypto to AI — The Art of Riding a Bubble
- From Manual Checks to AI-Powered Avionics Maintenance
- Automated Certificate Generator from XLSX Templates
- Introducing SimpliPOS (COFF POS) — A Café-Focused POS System
- Building a Local-First Web App with Alpine.js — Fast, Private, and Serverless
- Carbon Footprint Calculator (Recycling) — Measuring CO₂ Savings in Recycling Operations
- Recycle Factory Tools: A Smarter Way to Track Scrap Operations
- Running Form Coach — Cadence Metronome, Tapper, Drills, Posture Checklist
- How to Build a Carbon Credit Calculator for Your Business













