# FAQ
Source: https://docs.tguard.org/faq

Frequently Asked Questions about T-Guard

## General

<AccordionGroup>
  <Accordion title="What is T-Guard?">
    T-Guard is an innovative Security Operations Center (SOC) solution that leverages leading open-source tools to provide robust protection for your digital assets.
  </Accordion>

  <Accordion title="Where can I find T-Guard's source code and documentation?">
    You can access the official repository and documentation here:

    * **Documentation**: [T-Guard Documentation](https://tguard.org)
    * **Source Code**: [Nusantara Repository on GitHub](https://github.com/sguresearcher/nusantara/tree/v2) — containing setup codes and scripts for T-Guard components.
  </Accordion>

  <Accordion title="Who maintains T-Guard?">
    T-Guard is a community-driven open-source project. Contributors include university and research partners, and additional contributions can be viewed directly in the nusantara repository. Visit [T-Guard GitHub](https://github.com/sguresearcher/nusantara) for more information.
  </Accordion>

  <Accordion title="Where can I get community support?">
    For community-driven support, visit the T-Guard community hub. This platform provides categories for general support, user discussions, installation assistance, and troubleshooting guidelines. You can ask questions, view existing threads, and report issues.

    Visit [TGuard SOC & CSC ISAC Support](https://support.tguard.org).
  </Accordion>
</AccordionGroup>

## Installation & VM Tuning

<AccordionGroup>
  <Accordion title="What are the prerequisites for installing T-Guard V2.2?">
    Before installing T-Guard, ensure your system meets the following prerequisites:

    * A clean Linux system (highly recommended **Ubuntu Live Server 24.04 LTS**).
    * Minimum *Guest VM* resource allocation:
      * **Minimum (Trial)**: 4 vCPU, 8 GB RAM, 150 GB Storage
      * **Standard (Production)**: 8 vCPU, 16 GB RAM, 250 GB Storage
    * A **Static/Dedicated IP Address** is mandatory because the IP detection is performed once during installation and is hardcoded directly into the system integration.
    * Your physical host machine is recommended to have at least **+2 vCPUs and +4 GB RAM** above the VM allocation limits to prevent the hypervisor from locking up the host OS.
  </Accordion>

  <Accordion title="What performance tuning is mandatory on VirtualBox?">
    To prevent database timeout faults during intense security log indexing processes (such as in Opensearch or MariaDB):

    1. **Paravirtualized Network (virtio-net)**: Allows the VM's network interface to communicate directly with the physical host machine without a slow hardware-emulation layer, mempacking log transmission delays.
    2. **Enable Host I/O Cache**: Enables the physical host's RAM caching on the SATA Controller to drastically improve the VM's disk read/write performance.
  </Accordion>

  <Accordion title="What internal SOC firewall ports must be opened?">
    Ensure that your UFW or Cloud Security Groups allow inbound traffic on the following explicit application ports:

    * `443`: Wazuh Dashboard Web Access Portal
    * `1443`: MISP Threat Intelligence Central Hub
    * `8443`: DFIR-IRIS Incident Response Web Application
    * `5678`: n8n SOAR Workflow Engine Interface
    * `55000`: Wazuh Manager API Communication Line
    * `1514/1515`: Wazuh Agent Enrollment & Secure Data Exchange Channels
  </Accordion>

  <Accordion title="What are the main installation steps via CLI?">
    T-Guard V2.2 installation utilizes an interactive terminal script. Follow the steps below:

    **1. Clone the repository & run the setup script:**

    ```bash theme={null}
    git clone [https://github.com/sguresearcher/nusantara.git](https://github.com/sguresearcher/nusantara.git)
    cd nusantara
    chmod +x setup.sh
    sudo bash ./setup.sh
    ```

    **2. Full Installation (Option 1):** Select the **`[1] Full Installation`** menu option. Within the guided wizard:

    * Select SOAR Engine: **`n8n (Lightweight, Highly Recommended)`**.
    * Advanced Config: Select **`NO`** to automatically deploy the entire system using optimized default settings.
    * Enter your VirusTotal API Key if you select **`YES`**.
    * Confirm the setup by selecting **`Yes, start deployment!`**.
  </Accordion>

  <Accordion title="How do I complete the T-Guard integration parameters after installation?">
    After the deployment stack is running, you must configure the platform APIs manually to enable automated data workflows. Re-run the installer and select the **`[2] Integrate Manual (Configure APIs)`** menu to enter the following parameters:

    1. **Wazuh SIEM**: Configure the host Manager URL and the secure API Password.
    2. **IRIS DFIR**: Link your IRIS base URL (`https://<IP>:8443`) and the unique integration token generated from *Profile -> My Settings -> API Key* inside the IRIS dashboard.
    3. **MISP Intel**: Link your local MISP hub URL (`https://<IP>:1443`) and the administrative authorization key retrieved from the MISP console under *Administration -> List Auth Keys*.
    4. **n8n Engine & VirusTotal**: Enter your n8n orchestration engine gateway URL (`http://<IP>:5678`) along with the VirusTotal verification key.
  </Accordion>

  <Accordion title="What are the default system credentials used for?">
    Initial system credentials are printed automatically on the terminal screen after successful deployment or upon invoking the option 5 menu for initial administrative dashboard access:

    * **Wazuh**: `admin` | `SecretPassword`
    * **DFIR-IRIS**: `administrator` | `MySuperAdminPassword!`
    * **MISP**: `admin@admin.test` | `admin`
    * **n8n**: Register your own administrative master account on your first visit at port `5678`.

    <Warning>
      **Important:** Change ALL default passwords above immediately in production environments.
    </Warning>
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Why have all my integrated dashboards lost connection access?">
    This issue typically happens if your host server's IP Address changes due to a DHCP server reboot or a VM migration. Since the URL parameters are hardcoded during the initial setup, re-run the interactive installer script, select the **`[2] Integrate Manual`** menu, and update all component URL fields with your new IP address.
  </Accordion>

  <Accordion title="Why am I encountering an invalid SSL certificate warning in my browser?">
    This is expected behavior during the initial configuration phase. T-Guard uses built-in self-signed certificates for secure node-to-node privacy before signed production SSL certificates are installed. Simply click proceed to bypass the browser warning page and access your login interface.
  </Accordion>
</AccordionGroup>

## SOC Components

<AccordionGroup>
  <Accordion title="What is the role of Wazuh in this SOC stack?">
    Wazuh serves as the **Security Monitoring & Detection Platform (SIEM)**. It is equipped with advanced capabilities for automated log analysis and correlation, host-based intrusion detection (HIDS), real-time file integrity monitoring (FIM), and systemic vulnerability mapping. It acts as the primary alert source across the T-Guard framework.
  </Accordion>

  <Accordion title="What is the functionality of IRIS within the SOC ecosystem?">
    IRIS is utilized as the **Incident Response & Case Management System**. This component is designed to automatically record ticketed security events, manage analyst investigation workflows, and strictly document timelines, evidence repositories, and triage notes.
  </Accordion>

  <Accordion title="What is the role of n8n in this SOC architecture?">
    n8n functions as the **SOAR (Security Orchestration, Automation, and Response) Engine**, replacing prior heavy workflow automation platforms. It serves as an orchestration bridge that ingests raw alerts from Wazuh, filters duplicate assets, queries threat context from intelligence layers, and automatically triggers incident response workflows.
  </Accordion>

  <Accordion title="What is the role of MISP in the T-Guard SOC?">
    MISP is deployed as the **Threat Intelligence Platform**. It provides structure for aggregating, storing, and correlating *Indicators of Compromise* (IOC lookup values such as malware hashes, malicious IPs, and rogue domains) which are consumed by the Wazuh manager engine to distinguish real threats from false positives.
  </Accordion>
</AccordionGroup>

## Security Workflow & PoC Simulation

<AccordionGroup>
  <Accordion title="Which automation playbooks are directly injected into n8n?">
    Upon executing the **`[4] Inject n8n Workflows`** menu option, the system automatically pushes 4 essential blueprint automation templates into your n8n instance:

    * **Master Triage**: Ingests raw alerts from the Wazuh Webhook, parses operational IOC values, and branches the data into enrichment, ticketing, and alerting nodes.
    * **IP Enrichment & Anti-Dupe**: Filters recurring source IPs to check for duplicates and performs real-time reputation queries against the VirusTotal cloud engine.
    * **IRIS Incident Response Anti-Dupe**: Queries active cases in IRIS; if the ticket already exists, it appends a new structural note, otherwise, it provisions a clean case profile.
    * **Notification Dispatcher**: Compiles a final incident summary and dispatches instant security messages to the team's group channel using the built-in Telegram node.
  </Accordion>

  <Accordion title="How do I verify the SOC setup using the Proof of Concept (PoC) simulations?">
    You can validate your defensive rules and playbook pipelines by navigating to the **`[3] PoC (Proof of Concept) Simulation`** menu, selecting your target loopback IP (`127.0.0.1`), and triggering three core scenarios:

    1. **SSH Brute Force**: Simulates an external password-guessing attack by generating 10 invalid login rounds to trigger security alerts like *“Password Guessing, SSH”*.
    2. **EICAR Malware Test**: Drops an industry-standard EICAR malware string file into monitored server directories to verify real-time FIM alerts and automated scoring from 61 antivirus engines.
    3. **Web Defacement Detection**: Modifies website file indices to trigger critical alerts for *“Stored Data Manipulation”* and cross-examine cryptographic differences (*Old md5sum vs New md5sum*).
  </Accordion>

  <Accordion title="Does T-Guard V2.2 support a clean uninstall utility?">
    Yes. T-Guard V2.2 includes an automated **`[6] Uninstall`** script. This option safely terminates all active security containers, purges temporary deployment certificates, clears mapped network ports, and returns your clean Ubuntu Server environment to its original state.
  </Accordion>
</AccordionGroup>

## What's New

<Accordion title="Update T-Guard v2.2">
  <CardGroup>
    <Card title="n8n SOAR Integration" icon="robot">
      Replaced the previous orchestration platform with a sleek, lightweight n8n framework to maximize resource and guest memory efficiency.
    </Card>

    <Card title="Structural Playbook Injection" icon="code-branch">
      Introduced automated provisioning for 4 core playbooks handling incident triage, deduplication, and dispatcher alerting.
    </Card>

    <Card title="Native Go CLI" icon="terminal">
      Completely rewritten from Bash to a single, zero-dependency binary. Experience a rock-solid terminal dashboard with fluid arrow-key navigation that runs flawlessly across any environment.
    </Card>

    <Card title="Automated Cleanup Engine" icon="trash">
      Opsi Menu 6 tool built to cleanly stop and purge Docker containers, returning the host machine to its original footprint.
    </Card>
  </CardGroup>
</Accordion>


# Introduction
Source: https://docs.tguard.org/index

T-Guard is an open-source unified security solution designed to enhance organizational cybersecurity through a cohesive process of monitoring network activities across various devices, analyzing and enriching security events using various tools for further threat analysis. It integrates with threat intelligence sharing and leverages a SOAR platform to automate the incident response workflow, creating a streamlined and efficient defense ecosystem against cyber threats.

## Architecture

<img alt="Architecture" title="Architecture" />

This diagram represents an integrated SOC workflow, utilizing various tools and platforms for comprehensive cybersecurity management. Here are the descriptions and functionalities of every component within T-Guard:

* **Wazuh Agents**: Various devices such as Mac, Windows, and Linux machines, as well as IoT devices and sensors, are sources of logs. These logs are crucial for monitoring and analysis purposes and they are sent to the Wazuh platform.
* **Wazuh Server**: This is the central SIEM system that receives logs from the different devices. It acts as a security detection system to identify potential threats from the collected logs.
* **IRIS**: Depending on the threshold and rules we set, Wazuh will forward the logs into the IRIS platform for incident case management.
* **Threat Sharing (MISP)**: IRIS exchanges indicators of compromise with MISP (Malware Information Sharing Platform & Threat Sharing). This is a community-driven platform for sharing, storing, and correlating indicators of compromise of targeted attacks.
* **n8n as SOAR**: Acting as the Security Orchestration, Automation, and Response (SOAR) engine, n8n sits between IRIS and the surrounding toolset to automate the incident response workflow. It queries enrichment sources such as VirusTotal and YARA to score and classify suspicious indicators, and dispatches alerts and case updates to the team's configured collaboration channels (e.g. Telegram, Slack, Microsoft Teams, email, and other integrated tools). SOAR platforms like this are designed to help security teams manage and respond to endless alarms at machine speeds.


# Installation
Source: https://docs.tguard.org/installation



# I. Setup & Hardware Tuning

## A. Prerequisite

### 1. Common Prerequisites (Applies to Both VM & Bare-Metal)

* **Operating System**: The T-Guard installation script requires a Debian-based platform and will explicitly block non-Linux environments; however, it is highly recommended to use a clean Ubuntu Live Server 24.04 LTS installation to ensure maximum resource efficiency and full compatibility with the automated deployment stack.
* **Network Addressing**: A static/dedicated IP address is required. `setup.sh` detects the host IP once during installation and hardcodes it into all dashboard URLs and inter-service integrations (n8n ↔ MISP ↔ IRIS ↔ Wazuh). An IP change will break these integrations.

### 2. Virtual Machine Version

The resource requirements below define the allocation variables needed inside the guest OS framework.

| Use Case                                                                                       | vCPU | RAM (GB) | Storage (GB) |
| ---------------------------------------------------------------------------------------------- | :--: | :------: | :----------: |
| **Minimum Requirements**<br />*For trial deployments*                                          |   4  |     8    |      150     |
| **Standard Requirements**<br />*For production environments and continuous*<br />*development* |   8  |    16    |      250     |

**Note:**

1. **Host Overhead Buffering**: The requirements listed above are for the Guest VM allocation. Your physical host machine (PC/Laptop running VirtualBox) must possess at least +2 vCPUs and +4 GB RAM above these limits so the hypervisor does not lock up the host OS.
2. **VirtualBox Tuning Parameters**: You must set your VM Network to Paravirtualized Network (virtio-net) and check Enable Host I/O Cache under your storage controllers to prevent database timeout faults (detail on step 1B).

### 3. Bare-Metal / Cloud Host Version

The resource requirements below define the allocation variables needed for the OS framework.

| Use Case                                                                                       | CPU | RAM (GB) | Storage (GB) |
| ---------------------------------------------------------------------------------------------- | :-: | :------: | :----------: |
| **Minimum Requirements**<br />*For trial deployments*                                          |  4  |     8    |      150     |
| **Standard Requirements**<br />*For production environments and continuous*<br />*development* |  8  |    16    |      250     |

**Note:**

1. **Required SOC Firewall Port Openings** — Ensure your internal firewalls (e.g., UFW) or Cloud Security Groups allow inbound traffic on these explicit application ports. Do not expose these ports directly to the public internet; restrict entry using a secure VPN, a bastion host proxy, or explicit institutional IP address whitelists.
   | Port        | Service                                                |
   | ----------- | ------------------------------------------------------ |
   | 443         | Wazuh Dashboard Web Access Portal                      |
   | 1443        | MISP Threat Intelligence Central Hub                   |
   | 8443        | DFIR-IRIS Incident Response Web Application            |
   | 5678        | n8n SOAR Workflow Engine Interface                     |
   | 55000       | Wazuh Manager API Communication Line                   |
   | 1514 / 1515 | Wazuh Agent Enrollment & Secure Data Exchange Channels |

## B. Hardware Performance Tuning (Virtual Machine in VirtualBox)

<Steps>
  <Step title="Change Network to Paravirtualized Network (virtio-net)">
    <Frame>
      <img alt="Vbox Network Virtio" title="Vbox Network Virtio" />
    </Frame>

    **Why:** Paravirtualization allows the VM's network interface to communicate directly with the physical host machine instead of using a slow hardware-emulation layer. This maximizes network throughput and prevents log delays between your security agents and the central manager.
  </Step>

  <Step title="Enable Host I/O Cache">
    <Frame>
      <img alt="Vbox Host Io Cache" title="Vbox Host Io Cache" />
    </Frame>

    **Why:** Enabling this setting allows virtual storage disks to directly tap into the host system's RAM caching layer. This drastically improves Read/Write speeds during intense security database tasks, such as loading index tables in Opensearch or MariaDB.
  </Step>

  <Step title="Select Ubuntu Server (minimized)">
    <Frame>
      <img alt="Ubuntu Server Minimized" title="Ubuntu Server Minimized" />
    </Frame>

    **Why:** This version is customized to have a small runtime footprint to save vital system memory and storage space on your machine.
  </Step>
</Steps>

# II. Installation Steps

<Steps>
  <Step title="Clone the repository">
    ```text theme={null}
    git clone -b v2 https://github.com/sguresearcher/nusantara.git
    ```
  </Step>

  <Step title="Move to the directory and execute the installation script">
    <Frame>
      <img alt="Install Terminal Clone" title="Install Terminal Clone" />
    </Frame>

    ```text theme={null}
    cd nusantara
    chmod +x install.sh
    sudo bash ./install.sh
    ```
  </Step>

  <Step title="Navigate the CLI dashboard">
    This is the interactive Command Line Interface (CLI) dashboard for managing the T-Guard framework. Users can navigate up and down using arrow keys, type keywords to filter specific choices, and press enter to execute operations. The core menu functionalities include:

    <Frame>
      <img alt="Tguard Main Menu" title="Tguard Main Menu" />
    </Frame>

    **\[1] Full Installation**: Automatically provisions and installs the complete internal security stack (Wazuh, n8n, IRIS, and MISP).

    **\[2] Integrate Manual:** Allows users to link, adjust, or override custom operational API connection tokens between active platforms.

    **\[3] PoC (Proof of Concept):** Launches local attack scenarios (e.g., SSH brute force, EICAR malware execution) to verify that SIEM detection and correlation rules work properly.

    **\[4] Inject n8n Workflows**: Pushes structural incident triage, deduplication, and alerting blueprint playbooks straight into the automation engine.

    **\[5] View Default Credentials:** Prints the initial system dashboard web addresses, ports, configurations, and default user passwords.

    **\[6] Uninstall:** Safely stops all containers and purges all deployed components to return the host system to its clean original state.
  </Step>
</Steps>

# III. Step 1: Full Installation

Select Option \[1] to perform a complete deployment of the SOC platform stack.

<Frame>
  <img alt="Install Terminal Clone" title="Install Terminal Clone" />
</Frame>

Select SOAR Engine:

<Steps>
  <Step title="Choose your orchestration platform">
    Choose your preferred orchestration platform. Select n8n (Lightweight, Highly Recommended).

    <Frame>
      <img alt="Soar Engine Select" title="Soar Engine Select" />
    </Frame>
  </Step>

  <Step title="Advanced Configuration">
    Select NO to automatically deploy the entire system using standard, optimized default settings.

    <Frame>
      <img alt="Advanced Config Prompt" title="Advanced Config Prompt" />
    </Frame>
  </Step>

  <Step title="VirusTotal Integration">
    Select YES if you want to perform automated threat scanning inside the SIEM.

    <Frame>
      <img alt="Virustotal Integration Prompt" title="Virustotal Integration Prompt" />
    </Frame>
  </Step>

  <Step title="Enter your VirusTotal API Key">
    You will be prompted to paste your 64-character VirusTotal API Key.

    <Frame>
      <img alt="Virustotal Api Key Input" title="Virustotal Api Key Input" />
    </Frame>

    **Note**: If using a VirusTotal free-tier key, note it has rate limits (usually per-minute/per-day caps), so high alert volume may delay or fail enrichment requests.
  </Step>

  <Step title="Confirm Deployment">
    Select "Yes, start deployment!" to begin the stack installation.

    <Frame>
      <img alt="Confirm Deployment Prompt" title="Confirm Deployment Prompt" />
    </Frame>
  </Step>

  <Step title="Review the default access endpoints">
    Upon successful deployment, the system displays the default access endpoints:

    <Frame>
      <img alt="Deployment Complete Credentials" title="Deployment Complete Credentials" />
    </Frame>

    **Security Reminder:** Change all default passwords immediately! Enable your firewall (`sudo ufw enable`) and restrict access exclusively to production ports: 443, 1443, 5678, 8443, 9200, 55000.
  </Step>

  <Step title="Configure the IRIS and MISP API keys">
    Right after Step 1 (Full Installation) completes, the installer will show an ACTION REQUIRED alert:

    <Frame>
      <img alt="Action Required Api Config" title="Action Required Api Config" />
    </Frame>

    **Action Alert:** The terminal warns you that the SOC is running but cannot automate data flow yet because the IRIS and MISP API keys must be generated manually from their respective dashboards.

    **Next Steps Menu:** You are given direct options to proceed forward immediately, choose 2: **\[2] Proceed to Integrate Manual (Configure APIs)**: Choose this option to jump directly into the setup screens for your API tokens.

    The installer guides you through these prompt fields:

    <Steps>
      <Step title="IRIS DFIR Integration">
        * **IRIS Dashboard URL**: Input the incident response application gateway

        <Frame>
          <img alt="Iris Dashboard Url Prompt" title="Iris Dashboard Url Prompt" />
        </Frame>

        * **IRIS API Key**: Paste the unique integration token generated directly from your IRIS dashboard profile (Profile -> My Settings -> API Key)

        <Frame>
          <img alt="Iris Api Key Profile" title="Iris Api Key Profile" />
        </Frame>
      </Step>

      <Step title="MISP Threat Intelligence Integration">
        * **MISP Platform URL**: Input the local threat intel repository path

        <Frame>
          <img alt="Misp Platform Url Prompt" title="Misp Platform Url Prompt" />
        </Frame>

        * **MISP API Key**: Paste the administrative authorization key retrieved from the MISP web console (Administration -> List Auth Keys)

        <Frame>
          <img alt="Misp Auth Key Created" title="Misp Auth Key Created" />
        </Frame>
      </Step>
    </Steps>
  </Step>

  <Step title="Access all dashboards">
    Try to access all the dashboard:

    <Frame>
      <img alt="Wazuh Dashboard Overview" title="Wazuh Dashboard Overview" />
    </Frame>

    <Frame>
      <img alt="N8n Setup Owner Account" title="N8n Setup Owner Account" />
    </Frame>

    <Frame>
      <img alt="Iris Dashboard Overview" title="Iris Dashboard Overview" />
    </Frame>

    <Frame>
      <img alt="Misp Dashboard Events" title="Misp Dashboard Events" />
    </Frame>
  </Step>
</Steps>

# IV. Step 2: Integrate Manual (Configure APIs)

Select Option \[2] to link or reconfigure the API connections between all external security platforms and your central orchestration engine (n8n).

If the host IP changes (e.g. after a DHCP restart or VM migration), all dashboard URLs and integrations will break, since the IP was hardcoded during install, update the URL fields (Wazuh, IRIS, MISP, n8n), and re-submit each API key. Also check this menu if an integration suddenly fails: the IRIS/MISP key may have expired or been revoked from its own dashboard.

<Steps>
  <Step title="Wazuh SIEM Integration">
    * **Wazuh Manager URL**: Input your deployment host address
    * **Wazuh API Password**: Provide the secure API password (defaults to the system credentials generated during installation)

    <Frame>
      <img alt="Wazuh Integration Prompt" title="Wazuh Integration Prompt" />
    </Frame>
  </Step>

  <Step title="IRIS DFIR Integration">
    * **IRIS Dashboard URL**: Input the incident response application gateway

    <Frame>
      <img alt="Iris Dashboard Url Prompt" title="Iris Dashboard Url Prompt" />
    </Frame>

    * **IRIS API Key**: Paste the unique integration token generated directly from your IRIS dashboard profile (Profile -> My Settings -> API Key)

    <Frame>
      <img alt="Iris Api Key Profile" title="Iris Api Key Profile" />
    </Frame>
  </Step>

  <Step title="MISP Threat Intelligence Integration">
    * **MISP Platform URL**: Input the local threat intel repository path

    <Frame>
      <img alt="Misp Platform Url Prompt" title="Misp Platform Url Prompt" />
    </Frame>

    * **MISP API Key**: Paste the administrative authorization key retrieved from the MISP web console (Administration -> List Auth Keys)

    <Frame>
      <img alt="Misp Auth Key Created" title="Misp Auth Key Created" />
    </Frame>
  </Step>

  <Step title="n8n Orchestration">
    * **n8n Target URL**: Input the orchestration engine dashboard address

    <Frame>
      <img alt="N8n Url Prompt" title="N8n Url Prompt" />
    </Frame>
  </Step>

  <Step title="VirusTotal Integration (Threat Enrichment Layer)">
    * **VirusTotal API Key (Optional)**: If you skipped the automated VirusTotal onboarding during the initial Full Installation phase, or if you need to update an expired key, paste your 64-character key here.

    <Frame>
      <img alt="Virustotal Optional Prompt" title="Virustotal Optional Prompt" />
    </Frame>

    **Note**: This token allows the Wazuh manager to forward extracted file hashes (such as malware diagnostic strings for POC) to the VirusTotal cloud engine for structural threat scoring.
  </Step>

  <Step title="Save and apply the integration">
    Select "Yes, SAVE and apply" at the bottom prompt. The installer engine will bundle your configurations and output a secure state schema to:

    ```text theme={null}
    /var/lib/tguard_state/integration.json
    ```
  </Step>

  <Step title="Activation Notice">
    These integrations will lock in and apply across your SOC ecosystem upon the next scheduled T-Guard service container restart.
  </Step>
</Steps>

# V. Step 3: PoC (Proof of Concept) Simulation

Select Option \[3] to test your defensive monitoring rules against simulated real-world attack behaviors.

<Frame>
  <img alt="Tguard Main Menu Poc" title="Tguard Main Menu Poc" />
</Frame>

Select your target host IP (defaults to loopback 127.0.0.1) and toggle the security scenarios you want to run:

<Frame>
  <img alt="Poc Scenario Select Target Ip" title="Poc Scenario Select Target Ip" />
</Frame>

<Steps>
  <Step title="A. SSH Brute Force Simulation">
    **Execution**: Simulates an attacker trying to guess passwords by attempting 10 invalid login rounds on the host machine using non-existent usernames.

    <Frame>
      <img alt="Poc Bruteforce Output" title="Poc Bruteforce Output" />
    </Frame>

    **SIEM Verification**: You will see alert hits flagged as "Password Guessing, SSH" and "sshd brute force trying to get access to the system".

    <Frame>
      <img alt="Wazuh Bruteforce Alerts" title="Wazuh Bruteforce Alerts" />
    </Frame>
  </Step>

  <Step title="B. EICAR Malware Detection Test">
    **Execution**: Drops an industry-standard EICAR malware test string file into monitored server folders (`/root/eicar.com` and `/home/user/nusantara/usecase/webdeface/uploads/eicar-sample.txt`)

    <Frame>
      <img alt="Poc Eicar Output" title="Poc Eicar Output" />
    </Frame>

    **SIEM Verification**: The agent instantly catches the file writing event.

    <Frame>
      <img alt="Wazuh Eicar Detection" title="Wazuh Eicar Detection" />
    </Frame>

    It triggers a VirusTotal Alert within the log engine, showing that up to 61 engines flagged the signature.

    <Frame>
      <img alt="Virustotal Eicar Detections" title="Virustotal Eicar Detections" />
    </Frame>
  </Step>

  <Step title="C. Web Defacement Detection">
    **Execution**: Simulates a website defacement compromise by modifying the application file index (`/home/user/nusantara/usecase/webdeface/index.html`).

    <Frame>
      <img alt="Poc Webdeface Output" title="Poc Webdeface Output" />
    </Frame>

    **SIEM Verification**: T-Guard triggers a "Stored Data Manipulation" alert event. Wazuh catches the File Integrity Monitoring (FIM) change in real-time, logging the modified attributes, timestamp modifications, and cryptographic checksum differences (Old md5sum vs New md5sum).

    <Frame>
      <img alt="Wazuh Fim Webdeface Alert" title="Wazuh Fim Webdeface Alert" />
    </Frame>
  </Step>
</Steps>

# VI. Step 4: Inject n8n Workflows

Select Option \[4] to automatically load pre-built blueprint playbooks into your n8n orchestration instance.

<Steps>
  <Step title="Inject the workflows">
    Select "Yes, inject workflows" at the prompt. The installer will verify that the n8n container is up and running before importing the playbooks.

    <Frame>
      <img alt="Tguard Main Menu Inject N8n" title="Tguard Main Menu Inject N8n" />
    </Frame>
  </Step>

  <Step title="Review the playbooks loaded">
    The system injects 4 essential SOC automation workflows directly into n8n:

    <Frame>
      <img alt="N8n Workflows Overview" title="N8n Workflows Overview" />
    </Frame>

    a. **Master Triage**: Receives raw alerts from the Wazuh Webhook, extracts the Indicators of Compromise (Extract IOC), and splits the data into three paths: Trigger Enrichment, Trigger IRIS, and Trigger Notification.

    b. **IP Enrichment & Anti-Dupe**: Takes the parsed data, filters out repetitive IP addresses (Check Duplicate IP), and queries AbuseIPDB and VirusTotal only if the IP is new (IF Not Scanned).

    c. **IRIS Incident Response Anti-Dupe**: Checks if a ticket already exists for the alert (Search IRIS Case). If the Case Exists, it updates the ticket (Add Note); if not, it opens a new one (Create Case).

    d. **Notification Dispatcher**: Takes the final alert details and sends a direct security message to your team's chat group using the Telegram node (sendMessage).

    **Activation**: Once injected, log into your n8n web dashboard to view, review, and turn on the playbooks. The workflow templates are ready to use, but you may need to manually update or adjust the URL fields inside the nodes to match your network path (please refer to the official n8n documentation: [https://docs.n8n.io/integrations](https://docs.n8n.io/integrations)).
  </Step>
</Steps>

# VII. Step 5: View Default Credentials

Select Option \[5] from the main menu if you need to display the default system passwords and access URLs that were generated during the initial deployment.

<Frame>
  <img alt="Tguard Main Menu View Credentials" title="Tguard Main Menu View Credentials" />
</Frame>

* This option is helpful if you lose your login details or need a quick reference to access your web dashboards.
* When selected, the terminal will print a secure text block containing the exact URLs, ports, and default usernames for Wazuh, n8n, IRIS, and MISP.

<Frame>
  <img alt="Tguard Deployment Complete Credentials" title="Tguard Deployment Complete Credentials" />
</Frame>

**Security Check:** The screen will display a warning reminder to change these default passwords immediately to prevent unauthorized access to your SOC stack if you going to use this for production.

# VIII. Step 6: Uninstall T-Guard Components

Select Option \[6] only when you need to completely remove the T-Guard platform from your host system.

<Frame>
  <img alt="Tguard Main Menu Uninstall" title="Tguard Main Menu Uninstall" />
</Frame>

* **Automated Cleanup**: The installer engine stops all active security services and cleanly deletes the operational containers from your Docker environment.
* **Data Removal**: This process clears out internal system states, temporary deployment certificates, and network port mappings.
* **Final State**: Your Ubuntu host environment is returned to its original configuration, leaving your hardware resources free for other applications.