107 lines
2.8 KiB
Markdown
107 lines
2.8 KiB
Markdown
|[HOME](README.md)|[RESEARCH](01_research.md)|[INSTALLATION](02_install_rocky.md)|[CLIENT APP](03_client_app.md)|[INTEGRATION](04_wazuh_integration.md)|[DEMONSTRATION](05_demonstration.md)|[CONCLUSION](06_conclusion.md)|
|
|
|-|-|-|-|-|-|-|
|
|
|
|
# Wazuh Integration
|
|
|
|
## Requirements
|
|
- Wazuh manager installed and configured on the wazuh server
|
|
- Wazuh agent installed and connected on WEB01
|
|
- osquery already installed on WEB01 ([installation guide](02_install_rocky.md))
|
|
- root privileges
|
|
|
|
## Configure osquery on web01
|
|
### on WEB01
|
|
- create osquery configuration file. if already created with defaults, edit it
|
|
```json
|
|
> sudo nano /etc/osquery/osquery.conf
|
|
{
|
|
"options": {
|
|
"logger_path": "/var/log/osquery",
|
|
"disable_logging": "false",
|
|
"schedule_splay_percent": "10",
|
|
"utc": "true"
|
|
},
|
|
"schedule": {
|
|
"system_info": {
|
|
"query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
|
|
"interval": 300
|
|
},
|
|
"processes": {
|
|
"query": "SELECT pid, name, path, cmdline FROM processes;",
|
|
"interval": 300
|
|
},
|
|
"logged_in_users": {
|
|
"query": "SELECT user, host, time FROM logged_in_users;",
|
|
"interval": 300
|
|
},
|
|
"firewall_status": {
|
|
"query": "SELECT * FROM shell WHERE command = 'firewall-cmd --state';",
|
|
"interval": 300
|
|
}
|
|
},
|
|
...
|
|
```
|
|
|
|
- create log directories with correct permissions for storing osquery results
|
|
```bash
|
|
sudo mkdir -p /var/log/osquery
|
|
sudo chown -R root:root /var/log/osquery
|
|
sudo chmod -R 755 /var/log/osquery
|
|
```
|
|
|
|
- restart osqueryd
|
|
```bash
|
|
sudo systemctl restart osqueryd
|
|
sudo systemctl status osqueryd
|
|
```
|
|
|
|
## Configure WEB01 -> Wazuh integration
|
|
### On WEB01
|
|
- configure Wazuh agent to monitor osquery logs
|
|
```xml
|
|
> sudo nano /var/ossec/etc/ossec.conf
|
|
|
|
# Add these blocks inside the <ossec_config> section
|
|
# make sure this wodle is NOT disabled, as this service is disabled by default
|
|
|
|
<wodle name="osquery">
|
|
<disabled>no</disabled>
|
|
<run_daemon>yes</run_daemon>
|
|
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
|
|
<config_path>/etc/osquery/osquery.conf</config_path>
|
|
<add_labels>yes</add_labels>
|
|
</wodle>
|
|
|
|
|
|
<localfile>
|
|
<log_format>json</log_format>
|
|
<location>/var/log/osquery/osqueryd.results.log</location>
|
|
</localfile>
|
|
```
|
|
|
|
- restart wazuh agent
|
|
```bash
|
|
sudo systemctl restart wazuh-agent
|
|
sudo systemctl status wazuh-agent
|
|
```
|
|
|
|
## Validation
|
|
### on WEB01
|
|
- Run a manual query to generate an immediate log entry
|
|
```
|
|
sudo osqueryi --json "SELECT * FROM processes LIMIT 5;" > /var/log/osquery/osqueryd.results.log
|
|
```
|
|
- Check if Wazuh detected it
|
|
```
|
|
sudo tail -f /var/ossec/logs/ossec.log
|
|
```
|
|
### on Wazuh Server
|
|
- Go to Modules Menu -> Security Events -> Events
|
|
- In left panel, add rule.groups: osquery
|
|
|
|
|
|
|
|
___
|
|
|[<<<<](03_client_app.md)|[>>>>](05_demonstration.md)|
|
|
|-|-|
|
|
|