Endpoint Detection with Falco, Auditd, and Sysmon
Endpoint security monitoring for Linux and Windows servers using Wazuh, Falco, auditd, and Sysmon, including custom detection development, validation, and production handover.
Endpoint Detection with Falco, Auditd, and Sysmon
Project Description
A two month security engineering engagement that integrates three telemetry sources into a single Wazuh instance: Falco for Linux runtime threat detection, auditd for Linux system call auditing, and Sysmon for Windows process, network, and file activity.
Twenty custom Wazuh rules were developed to surface audit events that the built in ruleset suppresses by default. Fifteen auditd rules carry a MITRE ATT&CK technique each, and the Falco rules route on Falco priority while the technique travels in the Falco tags field. The rules were validated against real endpoint activity before handover.
The engagement was delivered with a custom Wazuh dashboard consolidating all telemetry into a single operational view as the primary deliverable, staged and validated before production handover.
Goals & Objectives
Consolidate endpoint telemetry
Bring Falco runtime, auditd system call, and Sysmon Windows telemetry into a single Wazuh instance and one operational view.
Surface suppressed audit events
Develop custom rules that alert on the Linux audit activity the default Wazuh ruleset collects but never raises.
Map detections to MITRE
Give the fifteen auditd rules a MITRE ATT&CK technique each, across credential access, privilege escalation, persistence, and exfiltration.
Validate before handover
Prove every detection against real activity in wazuh-logtest and the dashboard, and document the confirmed detections and the gaps.
Architecture & Workflow
graph TB subgraph AIO["Wazuh All-in-One - Central SIEM"] WM[Wazuh Manager] WI[Wazuh Indexer / OpenSearch] WD[Wazuh Dashboard] WM --> WI --> WD end
subgraph LINUX["Linux Server Endpoint"]
LA[Wazuh Agent v4.14.5]
Falco[Falco 0.43.1]
Auditd[auditd]
Falco -->|JSON alerts| LA
Auditd -->|audit.log| LA
end
subgraph WIN["Windows Server 2019 Endpoint"]
WA[Wazuh Agent v4.14.5]
Sysmon[Sysmon v15.20]
Sysmon -->|Event Log| WA
end
LA -->|port 1514 TLS| WM
WA -->|port 1514 TLS| WM
Implementation
A Wazuh All in One instance is the central SIEM, with agents on a Linux server and a Windows Server 2019 endpoint.
Linux endpoint. Falco provides runtime threat detection writing JSON to falco_events.json, and auditd provides system call auditing through a 49 key ruleset. The agent forwards both to the manager, where 20 custom rules parse them: four Falco rules routing on priority, fifteen auditd rules each mapped to a MITRE technique, and one inherited example rule.
Windows endpoint. Sysmon with a curated config feeds process, network, and file events into the same Wazuh pipeline through eventchannel.
Detection engineering. The auditd ruleset defines 49 keys; the custom rules act on 21 of them, and the deliberate gap of 28 uncovered keys is documented rather than hidden. Every detection was validated against real activity in wazuh-logtest and on the dashboard, and the confirmed counts, the false positives, and the blind spots were all recorded. The consolidated dashboard was the primary deliverable.
Tech Stack Used
All in One SIEM manager, indexer, and dashboard, running 20 custom rules and consolidating three telemetry sources.
Linux runtime threat detection over eBPF, emitting JSON events routed into Wazuh by priority.
Linux system call auditing feeding 15 MITRE mapped rules across credential access, persistence, and exfiltration.
Windows process, network, and file telemetry on Windows Server 2019, routed into the same Wazuh pipeline.
Key Features & Deliverables
20 custom detection rules
Fifteen auditd rules mapped to MITRE ATT&CK plus four Falco priority rules, written to surface events the default ruleset suppresses.
Three sources, one dashboard
Falco, auditd, and Sysmon consolidated into a single Wazuh operational view, the primary POC deliverable.
Validated against real activity
50,626 alerts over 24 hours, detections confirmed in wazuh-logtest and the dashboard rather than assumed from rule names.
Honest coverage evaluation
A 210113 false positive traced to any AF_INET socket, the MITRE claim corrected, and 28 uncovered audit keys documented.
Key Metrics
Results & Outcome
A fully operational endpoint monitoring deployment with confirmed detection coverage across Linux and Windows, delivered with a dashboard as the production deliverable.
Over a 24 hour window the dashboard recorded 50,626 total alerts: 8,034 Falco, 7,956 Sysmon, 1,712 auditd, and 7,825 at high severity. Total volume is dominated by authentication noise from the internet rather than by the custom detections, with the top triggered rule being the built in sshd non existent user attempt, consistent with the brute force activity observed.
The deliverable is honest about its edges. Rule 210113 was found to match any AF_INET socket rather than raw sockets alone, so its false positive spans many daemons, not just Falco. The MITRE mapping was corrected to reflect that five of the twenty rules carry no technique by design. The result is coverage across credential access, privilege escalation, lateral movement, persistence, and exfiltration, backed by an evaluation that says exactly what is confirmed and what is not.
Screenshots & Demo
Wazuh Agent Inventory Overview
Overview of active Wazuh agents connected to the lab environment, showing Linux and Windows endpoints with their operating system, group assignment, agent version, and connection status.
Custom Wazuh Security Monitoring Dashboard
Visualizes endpoint security alerts from Linux and Windows telemetry, including Sysmon events, Falco alerts, auditd logs, and recent triggered detection rules.
Auditd Event Discovery in Wazuh
Shows auditd events collected from the Linux endpoint and indexed in Wazuh, including syscall activity, executed commands, agent details, and audit related fields for investigation.
Falco Runtime Alert Analysis
Wazuh Discover view showing Falco runtime security alerts collected from the Linux endpoint, including suspicious SSH activity, rule metadata, source IP, agent details, and alert frequency over time.
Windows Sysmon Event Analysis
Wazuh Discover view showing Sysmon events collected from the Windows Server 2019 endpoint, including process activity, executable paths, event metadata, and agent details for Windows security monitoring.
Interested in This Project?
Discuss your security needs or explore collaboration opportunities.