Skip to main content

​
General

T-Guard is an innovative Security Operations Center (SOC) solution that leverages leading open-source tools to provide robust protection for your digital assets.
You can access the official repository and documentation here:
T-Guard is a community-driven open-source project. Contributors include university and research partners, and additional contributions can be viewed directly in the nusantara repository. Visit T-Guard GitHub for more information.
For community-driven support, visit the T-Guard community hub. This platform provides categories for general support, user discussions, installation assistance, and troubleshooting guidelines. You can ask questions, view existing threads, and report issues.Visit TGuard SOC & CSC ISAC Support.

​
Installation & VM Tuning

Before installing T-Guard, ensure your system meets the following prerequisites:
  • A clean Linux system (highly recommended Ubuntu Live Server 24.04 LTS).
  • Minimum Guest VM resource allocation:
    • Minimum (Trial): 4 vCPU, 8 GB RAM, 150 GB Storage
    • Standard (Production): 8 vCPU, 16 GB RAM, 250 GB Storage
  • A Static/Dedicated IP Address is mandatory because the IP detection is performed once during installation and is hardcoded directly into the system integration.
  • Your physical host machine is recommended to have at least +2 vCPUs and +4 GB RAM above the VM allocation limits to prevent the hypervisor from locking up the host OS.
To prevent database timeout faults during intense security log indexing processes (such as in Opensearch or MariaDB):
  1. Paravirtualized Network (virtio-net): Allows the VM’s network interface to communicate directly with the physical host machine without a slow hardware-emulation layer, mempacking log transmission delays.
  2. Enable Host I/O Cache: Enables the physical host’s RAM caching on the SATA Controller to drastically improve the VM’s disk read/write performance.
Ensure that your UFW or Cloud Security Groups allow inbound traffic on the following explicit application ports:
  • 443: Wazuh Dashboard Web Access Portal
  • 1443: MISP Threat Intelligence Central Hub
  • 8443: DFIR-IRIS Incident Response Web Application
  • 5678: n8n SOAR Workflow Engine Interface
  • 55000: Wazuh Manager API Communication Line
  • 1514/1515: Wazuh Agent Enrollment & Secure Data Exchange Channels
T-Guard V2.2 installation utilizes an interactive terminal script. Follow the steps below:1. Clone the repository & run the setup script:
2. Full Installation (Option 1): Select the [1] Full Installation menu option. Within the guided wizard:
  • Select SOAR Engine: n8n (Lightweight, Highly Recommended).
  • Advanced Config: Select NO to automatically deploy the entire system using optimized default settings.
  • Enter your VirusTotal API Key if you select YES.
  • Confirm the setup by selecting Yes, start deployment!.
After the deployment stack is running, you must configure the platform APIs manually to enable automated data workflows. Re-run the installer and select the [2] Integrate Manual (Configure APIs) menu to enter the following parameters:
  1. Wazuh SIEM: Configure the host Manager URL and the secure API Password.
  2. IRIS DFIR: Link your IRIS base URL (https://<IP>:8443) and the unique integration token generated from Profile -> My Settings -> API Key inside the IRIS dashboard.
  3. MISP Intel: Link your local MISP hub URL (https://<IP>:1443) and the administrative authorization key retrieved from the MISP console under Administration -> List Auth Keys.
  4. n8n Engine & VirusTotal: Enter your n8n orchestration engine gateway URL (http://<IP>:5678) along with the VirusTotal verification key.
Initial system credentials are printed automatically on the terminal screen after successful deployment or upon invoking the option 5 menu for initial administrative dashboard access:
  • Wazuh: admin | SecretPassword
  • DFIR-IRIS: administrator | MySuperAdminPassword!
  • MISP: admin@admin.test | admin
  • n8n: Register your own administrative master account on your first visit at port 5678.
Important: Change ALL default passwords above immediately in production environments.

​
Troubleshooting

This issue typically happens if your host server’s IP Address changes due to a DHCP server reboot or a VM migration. Since the URL parameters are hardcoded during the initial setup, re-run the interactive installer script, select the [2] Integrate Manual menu, and update all component URL fields with your new IP address.
This is expected behavior during the initial configuration phase. T-Guard uses built-in self-signed certificates for secure node-to-node privacy before signed production SSL certificates are installed. Simply click proceed to bypass the browser warning page and access your login interface.

​
SOC Components

Wazuh serves as the Security Monitoring & Detection Platform (SIEM). It is equipped with advanced capabilities for automated log analysis and correlation, host-based intrusion detection (HIDS), real-time file integrity monitoring (FIM), and systemic vulnerability mapping. It acts as the primary alert source across the T-Guard framework.
IRIS is utilized as the Incident Response & Case Management System. This component is designed to automatically record ticketed security events, manage analyst investigation workflows, and strictly document timelines, evidence repositories, and triage notes.
n8n functions as the SOAR (Security Orchestration, Automation, and Response) Engine, replacing prior heavy workflow automation platforms. It serves as an orchestration bridge that ingests raw alerts from Wazuh, filters duplicate assets, queries threat context from intelligence layers, and automatically triggers incident response workflows.
MISP is deployed as the Threat Intelligence Platform. It provides structure for aggregating, storing, and correlating Indicators of Compromise (IOC lookup values such as malware hashes, malicious IPs, and rogue domains) which are consumed by the Wazuh manager engine to distinguish real threats from false positives.

​
Security Workflow & PoC Simulation

Upon executing the [4] Inject n8n Workflows menu option, the system automatically pushes 4 essential blueprint automation templates into your n8n instance:
  • Master Triage: Ingests raw alerts from the Wazuh Webhook, parses operational IOC values, and branches the data into enrichment, ticketing, and alerting nodes.
  • IP Enrichment & Anti-Dupe: Filters recurring source IPs to check for duplicates and performs real-time reputation queries against the VirusTotal cloud engine.
  • IRIS Incident Response Anti-Dupe: Queries active cases in IRIS; if the ticket already exists, it appends a new structural note, otherwise, it provisions a clean case profile.
  • Notification Dispatcher: Compiles a final incident summary and dispatches instant security messages to the team’s group channel using the built-in Telegram node.
You can validate your defensive rules and playbook pipelines by navigating to the [3] PoC (Proof of Concept) Simulation menu, selecting your target loopback IP (127.0.0.1), and triggering three core scenarios:
  1. SSH Brute Force: Simulates an external password-guessing attack by generating 10 invalid login rounds to trigger security alerts like “Password Guessing, SSH”.
  2. EICAR Malware Test: Drops an industry-standard EICAR malware string file into monitored server directories to verify real-time FIM alerts and automated scoring from 61 antivirus engines.
  3. Web Defacement Detection: Modifies website file indices to trigger critical alerts for “Stored Data Manipulation” and cross-examine cryptographic differences (Old md5sum vs New md5sum).
Yes. T-Guard V2.2 includes an automated [6] Uninstall script. This option safely terminates all active security containers, purges temporary deployment certificates, clears mapped network ports, and returns your clean Ubuntu Server environment to its original state.

​
What’s New

n8n SOAR Integration

Replaced the previous orchestration platform with a sleek, lightweight n8n framework to maximize resource and guest memory efficiency.

Structural Playbook Injection

Introduced automated provisioning for 4 core playbooks handling incident triage, deduplication, and dispatcher alerting.

Native Go CLI

Completely rewritten from Bash to a single, zero-dependency binary. Experience a rock-solid terminal dashboard with fluid arrow-key navigation that runs flawlessly across any environment.

Automated Cleanup Engine

Opsi Menu 6 tool built to cleanly stop and purge Docker containers, returning the host machine to its original footprint.