Wazuh Logs überwachen

Ubuntu Server Add the following to /var/ossec/etc/ossec.conf file to configure the Wazuh agent and monitor the Apache access logs:

<localfile>

 <log_format>syslog</log_format>
 <location>/var/log/apache2/access.log</location>

</localfile>

Wazu Manager

Download the Alienvault IP reputation database:

sudo wget https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/alienvault_reputation.ipset -O /var/ossec/etc/lists/alienvault_reputation.ipset

Append the IP address of the attacker endpoint to the IP reputation database. Replace <ATTACKER_IP> with the RHEL IP address in the command below:

sudo echo "<ATTACKER_IP>" >> /var/ossec/etc/lists/alienvault_reputation.ipset

Download a script to convert from the .ipset format to the .cdb list format:

sudo wget https://wazuh.com/resources/iplist-to-cdblist.py -O /tmp/iplist-to-cdblist.py

Convert the alienvault_reputation.ipset file to a .cdb format using the previously downloaded script:

sudo /var/ossec/framework/python/bin/python3 /tmp/iplist-to-cdblist.py /var/ossec/etc/lists/alienvault_reputation.ipset /var/ossec/etc/lists/blacklist-alienvault

Optional: Remove the alienvault_reputation.ipset file and the iplist-to-cdblist.py script, as they are no longer needed:

sudo rm -rf /var/ossec/etc/lists/alienvault_reputation.ipset

sudo rm -rf /tmp/iplist-to-cdblist.py

Assign the right permissions and ownership to the generated file:

   sudo chown wazuh:wazuh /var/ossec/etc/lists/blacklist-alienvault

Configure the Active Response module to block the malicious IP address

Add a custom rule to trigger a Wazuh active response script. Do this in the Wazuh server /var/ossec/etc/rules/local_rules.xml custom ruleset file:

<group name="attack,">

 <rule id="100100" level="10">
   <if_group>web|attack|attacks</if_group>
   <list field="srcip" lookup="address_match_key">etc/lists/blacklist-alienvault</list>
   <description>IP address found in AlienVault reputation database.</description>
 </rule>

</group>

Edit the Wazuh server /var/ossec/etc/ossec.conf configuration file and add the etc/lists/blacklist-alienvault list to the <ruleset> section:

<ossec_config>

 <ruleset>
   <decoder_dir>ruleset/decoders</decoder_dir>
   <rule_dir>ruleset/rules</rule_dir>
   <rule_exclude>0215-policy_rules.xml</rule_exclude>
   <list>etc/lists/audit-keys</list>
   <list>etc/lists/amazon/aws-eventnames</list>
   <list>etc/lists/security-eventchannel</list>
   <list>etc/lists/blacklist-alienvault</list>

   <decoder_dir>etc/decoders</decoder_dir>
   <rule_dir>etc/rules</rule_dir>
 </ruleset>

</ossec_config>

Add the Active Response block to the Wazuh server /var/ossec/etc/ossec.conf file:

For the Ubuntu endpoint

The firewall-drop command integrates with the Ubuntu local iptables firewall and drops incoming network connection from the attacker endpoint for 60 seconds:

   <ossec_config>
     <active-response>
       <command>firewall-drop</command>
       <location>local</location>
       <rules_id>100100</rules_id>
       <timeout>60</timeout>
     </active-response>
   </ossec_config>

For the Windows endpoint

The active response script uses the netsh command to block the attacker's IP address on the Windows endpoint. It runs for 60 seconds:

   <ossec_config>
     <active-response>
       <command>netsh</command>
       <location>local</location>
       <rules_id>100100</rules_id>
       <timeout>60</timeout>
     </active-response>
   </ossec_config>

Restart the Wazuh manager to apply the changes:

   sudo systemctl restart wazuh-manager

Attack emulation

Access any of the web servers from the RHEL endpoint using the corresponding IP address. Replace <WEBSERVER_IP> with the appropriate value and execute the following command from the attacker endpoint:

   curl http://<WEBSERVER_IP>

The attacker endpoint connects to the victim's web servers the first time. After the first connection, the Wazuh Active Response module temporarily blocks any successive connection to the web servers for 60 seconds.