TG
All posts
3 min read

Zero-Trust Hardening & SIEM: Remediating 26 Audit Findings Across 37 Endpoints

Default-deny WireGuard access with MFA, Wazuh and OpenSearch for telemetry, and an Ansible response that null-routes an attacking range fleet-wide in under two seconds.

Client-facing production tends to get the security attention. Internal corporate networks, developer workstations, and staging servers get whatever is left — which is how they end up with shadow access and credential sprawl.

An internal audit returned 26 distinct findings across 37 heterogeneous endpoints and servers: exposed SSH management ports, unrestricted east-west traffic between staging hosts, unmonitored privilege escalation, and no log correlation to catch any of it. Patching those individually would have left the model that produced them intact, so we rebuilt the access model instead.

DEFAULT-DENY INTERNAL NETWORK WITH AUTOMATED RESPONSEIDENTITY AND SECURE INGRESSINTERNAL INFRASTRUCTURE PERIMETER37 endpointsHOST SECURITY CONTROLSWAZUH SIEM CLUSTERAUTOMATED REMEDIATIONAdmin workstationsWindows · macOS · LinuxWireGuard gatewaydefault-deny wg0 · MFAApplication endpointsWazuh agentDB clusterWazuh agentBuild agentWazuh agentUFW packet filteringdrops east-west trafficSyslog / FIMpasswd · sudoers · sshd_configWazuh managerrule engine · GeoIP anomalyOpenSearch indexerstorage · analyticsAnsible engineUFW drop rules · null-route1. mutual key + MFA2. encrypted mesh tunnel3. east-west, filtered4. strict AllowedIPslocal filtering5. audit + telemetry6. encrypted log stream7. index and correlate8. active-response webhooknull-route fleet-widenumbered happy pathhost controls / enforcement
Two separate UFW roles: local packet filtering stops east-west movement, and Ansible-written rules null-route an attacking range across every host.

How access and response now work

  1. A managed workstation — Windows, macOS or Linux — authenticates to the central gateway with mutual public-key cryptography and multi-factor authentication. There are no open inbound public ports to attack.
  2. The encrypted WireGuard mesh tunnel carries it into the internal perimeter.
  3. Application endpoints talk east-west only where policy allows it.
  4. Strict AllowedIPs CIDR routing governs which peer can reach the database cluster and the build agent at all.
  5. Every node carries a Wazuh agent doing file integrity monitoring and forwarding syslog.
  6. Those FIM and syslog events cross to the Wazuh manager as one encrypted audit and log stream.
  7. The manager correlates them and the OpenSearch indexer stores and analyses them.
  8. On a brute-force pattern or SSH GeoIP anomaly, the manager's active-response webhook fires rather than paging anyone.

An Ansible automation engine then pushes UFW drop rules through dynamic Bash scripts and null-routes the offending CIDR across every host. The loop closes without a human in it, which is the point: manual review of security events introduces exactly the delay an attacker is counting on.

Two different jobs for the same firewall

UFW appears twice in that flow and does something different each time.

Local packet filtering runs continuously on every host, dropping unauthorised east-west traffic between internal machines. That is the control that turns a flat internal network into a segmented one.

Ansible-written drop rules are the response path — written on demand, fleet-wide, in under two seconds, in reaction to something Wazuh saw.

The first is posture. The second is reaction. Conflating them is how teams end up with a firewall that is either too static to respond or too dynamic to reason about.

Default-deny WireGuard mesh

Direct internet access to SSH on port 22 was shut down on all 37 machines. Each endpoint and engineer workstation was provisioned with its own cryptographic keypair, an immutable /32 address, and ephemeral peer sessions — so a stale credential grants nothing. Only traffic authenticated over wg0 can speak to a management daemon, and every connection is audit logged.

What Wazuh actually watches

File Integrity Monitoring (FIM) tracks unauthorised modification of /etc/passwd, /etc/sudoers, and /etc/ssh/sshd_config. Centralised syslog forwarding carries the rest.

Log analysis and GeoIP telemetry parses authentication logs for abnormal login times, brute-force patterns, privilege escalation attempts, and connection origins that do not belong.

What it resolved

All 26 audit findings were closed across the 37 target endpoints and servers. SSH and remote administration are no longer exposed to the public internet at all. Credential stuffing and anomalous GeoIP logins are now detected and blocked with no human intervention.

GitHub
LinkedIn