Wazuh IDS an einem Switch

Aufbau

[Bearbeiten]

Suricata

Installation

• apt update
• apt install -y suricata

Minimal Konfiguration

Konfigfile

• cat /etc/suricata/suricata.yaml

%YAML 1.1
---
# Standard-Log-Verzeichnis
default-log-dir: /var/log/suricata/

# Statistiken aktivieren
stats:
  enabled: yes
  interval: 8

# Ausgaben konfigurieren
outputs:
  - fast:
      enabled: yes
      filename: fast.log
      append: yes
  - alert-debug:
      enabled: yes
      filename: alert-debug.log
      append: yes
  - stats:
      enabled: yes
      filename: stats.log
      append: yes
      totals: yes
      threads: no

# Logging-Einstellungen
logging:
  default-log-level: notice
  outputs:
  - console:
      enabled: yes
  - file:
      enabled: yes
      level: info
      filename: suricata.log

# Netzwerkschnittstelle für Mirror-Port konfigurieren
af-packet:
  - interface: enp0s8
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    ring-size: 2048
    buffer-size: 65535
    mmap-locked: yes
    tpacket-v3: yes
    checksum-checks: no

# Alternativ PCAP-Modus (wenn AF_PACKET nicht genutzt wird)
pcap:
  - interface: enp0s8
    buffer-size: 65535
    checksum-checks: no

# PID-Datei
pid-file: /var/run/suricata.pid

# Coredump-Einstellungen
coredump:
  max-dump: unlimited

# Host-Modus
host-mode: auto

# Unix-Befehlseingabe konfigurieren
unix-command:
  enabled: yes
  filename: /var/run/suricata-command.socket

# Engine-Analyse-Einstellungen
engine-analysis:
  rules-fast-pattern: yes
  rules: yes

# Defragmentierungseinstellungen
defrag:
  memcap: 32mb
  hash-size: 65536
  trackers: 65535
  max-frags: 65535
  prealloc: yes
  timeout: 60

# Standardregelverzeichnis
default-rule-path: /etc/suricata/rules

# Regel-Dateien
rule-files:
  - local.rules

# Klassifikationsdatei
classification-file: /etc/suricata/classification.config

# Referenzkonfigurationsdatei
reference-config-file: /etc/suricata/reference.config
app-layer:
  protocols:
    http:
      enabled: yes
    tls:
      enabled: yes
    dcerpc:
      enabled: yes
    smb:
      enabled: yes
    ftp:
      enabled: yes
    ssh:
      enabled: yes
    smtp:
      enabled: yes
    dns:
      enabled: yes
    modbus:
      enabled: yes
    enip:
      enabled: yes
    dnp3:
      enabled: yes
    nfs:
      enabled: yes
    ntp:
      enabled: yes
    tftp:
      enabled: yes
    ikev2:
      enabled: yes
    krb5:
      enabled: yes
    dhcp:
      enabled: yes
    snmp:
      enabled: yes
    sip:
      enabled: yes
    rfb:
      enabled: yes
    mqtt:
      enabled: yes
    rdp:
      enabled: yes
    http2:
      enabled: yes
    imap:
      enabled: yes

Eigene Regeln

• cat /etc/suricata/rules/local.rules

alert icmp any any -> any any (msg:"ICMP Test"; flow:to_server; sid:1;)
alert tcp any any -> any any (flags: S; msg: "SYN packet"; sid:2;)

Test

• suricata -T -c /etc/suricata/suricata.yaml

26/2/2025 -- 09:39:13 - <Info> - Running suricata under test mode
26/2/2025 -- 09:39:13 - <Notice> - This is Suricata version 6.0.10 RELEASE running in SYSTEM mode
26/2/2025 -- 09:39:13 - <Notice> - Configuration provided was successfully loaded. Exiting.

Erster Start

Vordergrund

suricata -c /etc/suricata/suricata.yaml --af-packet

Hintergrund

suricata -c /etc/suricata/suricata.yaml --af-packet -D

Wazuh

Installation

• Wazuh Installation

Anpassen von Suricata

• Nachdem Wazuh läuft, muss Suricata so konfiguriert werden, dass es die Logs an Wazuh sendet.
• Suricata-Logging anpassen Öffne die suricata.yaml und stelle sicher, dass die JSON-Logs aktiviert sind:
• vi /etc/suricata/suricata.yaml

outputs:
 ...
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/eve.json
      types:
        - alert
        - anomaly
        - dns
        - tls
        - http
        - ssh
        - smtp

Runterfahren

• suricatasc -c shutdown

Neustarten

• suricata -c /etc/suricata/suricata.yaml --af-packet -D

Kontrolle ob etwas geloggt wird

tail /var/log/suricata/eve.json

{"timestamp":"2025-02- 26T10:48:17.825694+0100","flow_id":1157424342247926,"in_iface":"enp0s8","event_type":"alert","src_ip":"192.168.1.98","src_port":0,"dest_ip":"8.8.8.8","dest_port":0,"proto":"ICMP","icmp_ type":8,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":1,"rev":0,"signature":"ICMP Test","category":"","severity":3},"flow" :{"pkts_toserver":2186,"pkts_toclient":2185,"bytes_toserver":214228,"bytes_toclient":214130,"start":"2025-02-26T10:11:34.272886+0100"}}
{"timestamp":"2025-02-