Pfsense Firewall Logs Ingestion In Wazuh
Build a centralized security monitoring environment by sending pfSense firewall logs to Wazuh for real-time threat detection and analysis. In this hands-on project, you will configure pfSense to forward logs to a Wazuh Manager, where they will be parsed, indexed, and visualized through the Wazuh Dashboard.
Overview
In this project, you will set up a centralized security monitoring environment by sending pfSense Firewall logs to Wazuh for real-time visibility and threat detection. You’ll configure your pfSense appliance to forward firewall and system logs to Wazuh using Syslog for ingestion, parsing, and analysis.
What You'll Learn
-
Configure pfSense for Remote Syslog Forwarding
Learn how to enable and send pfSense firewall and system logs to a remote Wazuh server securely.
-
Set Up Wazuh Manager, Indexer, and Dashboard
Understand the deployment components of Wazuh and how they process, analyze, and visualize security logs.
About Trainer
Jaimin Pathak
Jaimin Pathak is a dynamic cybersecurity leader with deep expertise in Blue Team operations, digital forensics, and threat intelligence. As the Head of Security at HaxSecurity, Jaimin brings a hands-on approach to building and scaling modern Security Operations Centers (SOC). His career spans years of dedicated work in incident response, SIEM engineering, and proactive threat hunting. Jaimin is also a passionate mentor and educator, having guided thousands of cybersecurity learners through practical training programs, shaping the next generation of defenders in the field.
Related Projects
Practical AWS Cloud Security Posture Assessment Using Scout Suite
Identify real-world AWS attack surfaces through visual security posture analysis.
Wazuh + n8n + Anyrun: Automated Malware Analysis
Automate malware analysis by sending Wazuh-detected suspicious files into ANY.RUN, retrieving detailed reports and IOCs, and integrating results back into your SOC workflow.
Apache Web Server Log Monitoring using Wazuh
Real-time detection of HTTP errors, brute-force and suspicious requests from Apache logs