Student Adds UFW, Fail2Ban and Logwatch to Ubuntu Server Within Wazuh SIEM Setup

A new cybersecurity learner, who works as a full-time teacher, enhanced an existing Ubuntu server and its Wazuh SIEM monitoring environment. The project added three tools: UFW to control incoming traffic, Fail2Ban to ban IPs after repeated failed SSH logins, and Logwatch to compile system logs into readable reports. Testing with Nmap from Kali Linux showed UFW filtering the blocked port, while Fail2Ban successfully banned an attacking IP during a simulated SSH password-guessing attempt. Wazuh recorded the events, and Logwatch delivered a summary report to the server's root mailbox. The author's tests were aligned with MITRE ATT&CK technique T1046, Network Service Discovery.