Accessing and Validating the Wazuh Dashboard

Use the dashboard safely, but validate it like an operator: confirm it is reachable, confirm Wazuh data is flowing, confirm agents are visible, and avoid treating the dashboard as the only source of truth.

Kubernetes SOC Field Lab · Practical Security Operations

Domain alignment

What this lesson covers

• Accessing the dashboard with port-forwarding
• Understanding local certificate warnings
• Validating Wazuh dashboard health
• Checking manager/indexer health from Kubernetes
• Confirming agent visibility
• Setting the correct time range
• Capturing analyst evidence without overreacting

Step 1: Confirm Wazuh pods are healthy

kubectl get pods -n wazuh
kubectl get pvc -n wazuh
kubectl get events -n wazuh --sort-by=.lastTimestamp

Do not use the dashboard for SOC analysis until the manager, indexer, and dashboard are healthy.

Step 2: Start dashboard port-forwarding

kubectl -n wazuh port-forward --address 127.0.0.1 service/dashboard 8443:443

Open:

https://127.0.0.1:8443

Your browser may show a certificate warning because this lab uses self-signed certificates.

Step 3: Login and validate the landing view

Validation checklist:
- Login succeeds
- Wazuh application loads
- No backend connection error is shown
- Agent sections load
- Alert/event views are available
- Time range is set correctly

Step 4: Confirm services and endpoints

kubectl get svc -n wazuh
kubectl get endpoints -n wazuh

Endpoints show whether services actually have backing pods. A service existing does not mean healthy pods are behind it.

Step 5: Prepare for SOC analyst use

Analyst question examples:
- Did the agent report in during the last 15 minutes?
- Did my test event appear around the expected timestamp?
- Which source generated this alert?
- Which rule fired?
- Is this expected lab activity or unexpected behavior?

Step 6: Capture evidence consistently

Dashboard evidence:
- Timestamp
- Agent/source
- Rule ID
- Severity
- Description
- Full log summary
- Related Kubernetes pod/namespace
- Expected or unexpected
- Recommended action