A Field Manual for Wazuh — Building and Running Your First Security Monitoring System on Linux Mint. Thirty-one chapters. Published on Amazon. Written by the man who will be installing your system.
Most consultants leave behind a system nobody in the building understands, which is how you end up paying them forever. I would rather you understood what you own. So every installation, every server and every monthly client gets the book — the same one people buy on Amazon — free.
It assumes you remember nothing and starts at the first login. A guided tour of the dashboard, adding Windows and Linux machines, reading real alerts, writing your first rule, file integrity monitoring, vulnerability detection, active response, tuning out the noise, and four practical drills you can run yourself — a brute force attack, file tampering, suspicious account activity, log tampering. Plus a glossary, a command quick reference and a troubleshooting index.
If you ever want to take it in-house, or hand it to somebody else, everything you need is written down. That is deliberate.
Anyone can say they know a system. Writing a book on it and putting your name on the cover is a different kind of statement.
Plain English, for someone with no security background. Whoever looks after your computers can follow it.