Benutzer-Werkzeuge
wazuh
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
|
wazuh [2025/03/15 22:03] |
wazuh [2025/03/28 14:54] (aktuell) |
||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| + | Wazuh ist eine Open Source Sicherheitsplattform, | ||
| + | < | ||
| + | vie-srv-dc01 | ||
| + | vie-srv-fs04 | ||
| + | vie-srv-fs03 | ||
| + | vie-srv-dc02 | ||
| + | vie-srv-lb00 | ||
| + | vie-srv-ex02 | ||
| + | vie-srv-ex01 | ||
| + | vie-srv-gts03 | ||
| + | vie-srv-gts04 | ||
| + | vie-p-srv-fw01 | ||
| + | vie-p-srv-fw02 | ||
| + | vie-p-srv-fw03 | ||
| + | vie-t-srv-fw01 | ||
| + | vie-srv-infra01 | ||
| + | vie-srv-ca01 | ||
| + | vie-t-srv-audit | ||
| + | vie-p-srv-at01 | ||
| + | vie-p-srv-at02 | ||
| + | vie-p-srv-at03 | ||
| + | vie-p-srv-mb01 | ||
| + | vie-p-srv-mb02 | ||
| + | vie-p-srv-mb03 | ||
| + | vie-p-srv-mb04 | ||
| + | vie-p-srv-ps00 | ||
| + | vie-p-srv-wsy02 | ||
| + | vie-srv-smct01 | ||
| + | vie-p-srv-rg24 | ||
| + | vie-srv-au01 | ||
| + | vie-srv-dvo02 | ||
| + | VIE-SRV-EBK02 | ||
| + | vie-srv-db04 | ||
| + | vie-srv-db05 | ||
| + | vie-srv-dmzfs03 | ||
| + | vie-srv-dmzfs02 | ||
| + | vie-nb-gbi016 | ||
| + | vie-srv-epm00 | ||
| + | VIE-SRV-EPM02 | ||
| + | vie-p-srv-flb01 | ||
| + | </ | ||
| + | |||
| + | Wazuh besteht aus mehreren Komponenten, | ||
| + | |||
| + | Der Wazuh Manager ist das Herzstück des Systems und empfängt die Daten von den Agenten. Er analysiert die Informationen, | ||
| + | |||
| + | Wazuh unterstützt eine Vielzahl von Betriebssystemen, | ||
| + | |||
| + | |||
| + | < | ||
| + | data.win.eventdata.lmPackageName = NTLM | ||
| + | </ | ||
| + | |||
| + | =====Config===== | ||
| + | |||
| + | ====OSSec.conf==== | ||
| + | |||
| + | ossec.conf ist die Hauptkonfigurationsdatei des Wazuh-Managers. Ein Konfigurationsfehler kann den Start der Wazuh-Dienst verhindern. Die Datei gibt es auf dem Wazuh-Manager und dem Wazuh-Agent. | ||
| + | |||
| + | Auf dem Wazuh-Manager unter | ||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Auf dem Wazuh-Agent unter | ||
| + | ^Plattform^Pfad^ | ||
| + | | Windows | C:\Program Files (x86)\ossec-agent\ossec.conf | | ||
| + | | Linux/Unix | / | ||
| + | | macOS | / | ||
| + | |||
| + | Enable Vulnerability Scan | ||
| + | < | ||
| + | # In / | ||
| + | |||
| + | [...] | ||
| + | < | ||
| + | < | ||
| + | [...] | ||
| + | </ | ||
| + | |||
| + | ===Beispiel=== | ||
| + | |||
| + | <code xml> | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | <!-- Agent buffer options --> | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | <!-- Policy monitoring --> | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | |||
| + | <!-- Frequency that rootcheck is executed - every 12 hours --> | ||
| + | < | ||
| + | |||
| + | < | ||
| + | < | ||
| + | |||
| + | < | ||
| + | </ | ||
| + | |||
| + | <wodle name=" | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | |||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | <!-- Osquery integration --> | ||
| + | <wodle name=" | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | <!-- System inventory --> | ||
| + | <wodle name=" | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | <ports all=" | ||
| + | < | ||
| + | |||
| + | <!-- Database synchronization settings --> | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | <sca> | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | <!-- File integrity monitoring --> | ||
| + | < | ||
| + | < | ||
| + | |||
| + | <!-- Frequency that syscheck is executed default every 12 hours --> | ||
| + | < | ||
| + | |||
| + | < | ||
| + | |||
| + | <!-- Directories to check (perform all possible verifications) --> | ||
| + | < | ||
| + | < | ||
| + | |||
| + | <!-- Files/ | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | |||
| + | <!-- File types to ignore --> | ||
| + | <ignore type=" | ||
| + | |||
| + | <!-- Check the file, but never compute the diff --> | ||
| + | < | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | |||
| + | <!-- Nice value for Syscheck process --> | ||
| + | < | ||
| + | |||
| + | <!-- Maximum output throughput --> | ||
| + | < | ||
| + | |||
| + | <!-- Database synchronization settings --> | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | <!-- Log analysis --> | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | <!-- Active response --> | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | <!-- Choose between " | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | </ | ||
| + | </ | ||
| + | ====Agent.conf==== | ||
| + | |||
| + | Die agent.conf Datei ist ossec.conf sehr ähnlich, wird aber zur zentralen Verteilung von Konfigurationsinformationen an Agenten verwendet. | ||
| + | |||
| + | Sie befindet sich auf dem Wazuh-Manager unter | ||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | und ist von beginn an leer. | ||
| + | =====CLI===== | ||
| + | |||
| + | Managing Agents (interactive | ||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Removing an agent from the manager | ||
| + | < | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Restart the manager | ||
| + | <code bash> | ||
| + | sudo docker exec -it < | ||
| + | service wazuh-manager restart | ||
| + | </ | ||
| + | |||
| + | =====Ubuntu Docker Installation===== | ||
| + | |||
| + | <code bash> | ||
| + | # https:// | ||
| + | #!/bin/bash | ||
| + | |||
| + | set -e | ||
| + | |||
| + | G=" | ||
| + | E=" | ||
| + | |||
| + | if ! grep -q ' | ||
| + | then | ||
| + | echo ----------------------------------------------- | ||
| + | echo "Not Ubuntu? Could not find Codename Ubuntu in lsb_release -a. Please switch to Ubuntu." | ||
| + | echo ----------------------------------------------- | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | ## Update OS | ||
| + | echo " | ||
| + | sudo apt update | ||
| + | sudo apt upgrade -y | ||
| + | |||
| + | ## Install Prereqs | ||
| + | echo " | ||
| + | sudo apt-get update | ||
| + | sudo apt-get install -y \ | ||
| + | apt-transport-https ca-certificates curl gnupg lsb-release \ | ||
| + | software-properties-common haveged bash-completion jq | ||
| + | |||
| + | ## Install Docker | ||
| + | echo " | ||
| + | sysctl -w vm.max_map_count=262144 | ||
| + | curl -sSL https:// | ||
| + | systemctl start docker | ||
| + | usermod -aG docker $USER | ||
| + | |||
| + | ## Install Docker Compose | ||
| + | echo " | ||
| + | curl -L " | ||
| + | chmod +x / | ||
| + | |||
| + | ## Install Wazuh Docker | ||
| + | echo " | ||
| + | git clone https:// | ||
| + | cd wazuh-docker/ | ||
| + | docker-compose -f generate-indexer-certs.yml run --rm generator | ||
| + | docker-compose up -d | ||
| + | |||
| + | ## Print Server Information and Links | ||
| + | cd ../../ | ||
| + | touch ./ | ||
| + | echo ----------------------------------------------- | ||
| + | echo -e ${G}Install is complete. Please use the below information to access your environment.${E} | tee ./ | ||
| + | echo -e ${G}Wazuh UI:${E} https:// | ||
| + | echo -e ${G}Wazuh Login${E}: admin/ | ||
| + | echo Details above are saved to the file at ./ | ||
| + | echo ----------------------------------------------- | ||
| + | </ | ||
| + | |||
| + | |||
| + | =====Queries===== | ||
| + | |||
| + | Siehe [[Elasticsearch]] | ||
| + | |||
| + | [[https:// | ||
| + | |||
| + | ====Match==== | ||
| + | Feld muss zutreffen | ||
| + | < | ||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | ====Wildcard==== | ||
| + | |||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | ====Bool Must==== | ||
| + | Beide Felder müssen zutreffen | ||
| + | < | ||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | ====Bool Should==== | ||
| + | should bedeutet, dass mindestens eine der Bedingungen erfüllt sein kann. | ||
| + | Falls ein Dokument beide Bedingungen erfüllt, wird es höher gewichtet, aber es ist nicht zwingend erforderlich. | ||
| + | Falls kein weiteres must- oder filter-Kriterium vorhanden ist, kann Elasticsearch hier auch alle Dokumente zurückgeben, | ||
| + | Problem: Ohne " | ||
| + | < | ||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Mindestens 2 Felder müssen zutreffen | ||
| + | < | ||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | ====Bool Must Bool Should==== | ||
| + | < | ||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Der äußere must stellt sicher, dass die innere should-Bedingung zwingend zutreffen muss. | ||
| + | Die should-Bedingung innerhalb des bool-Blocks sorgt dafür, dass mindestens eine der Bedingungen zutreffen kann. | ||
| + | Falls ein Dokument beide should-Bedingungen erfüllt, wird es höher gewichtet. | ||
| + | Effekt: Diese Abfrage gibt nur Dokumente zurück, die mindestens eines der should-Kriterien erfüllen. Dokumente, die weder " | ||
| + | < | ||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | ^Abfrage^Bedeutung^Kann Ergebnisse ohne Treffer zurückgeben? | ||
| + | |should direkt in bool|Beide Bedingungen sind optional, erhöhen aber das Ranking|Ja (falls kein minimum_should_match)|(Ergebnisse können auch ohne Übereinstimmung erscheinen)| | ||
| + | |should innerhalb must|Mindestens eine should-Bedingung muss erfüllt sein|Nein|(Mindestens eine Bedingung muss passen)| | ||
| + | |||
| + | ====More==== | ||
| + | < | ||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | |||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | |||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | " | ||
| + | } | ||
| + | |||
| + | GET / | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | =====Paging===== | ||
| + | |||
| + | [[todo]] | ||
| + | |||
| + | =====Bash Script===== | ||
| + | |||
| + | <code bash> | ||
| + | #!/bin/bash | ||
| + | |||
| + | # Wazuh Indexer URL und Authentifizierung | ||
| + | WAZUH_INDEXER=" | ||
| + | USERNAME=" | ||
| + | PASSWORD=" | ||
| + | |||
| + | # Anfrage ausführen | ||
| + | curl -k -u " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | EOF | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | bash wazuh-query.sh | jq -r ' | ||
| + | bash wazuh-query.sh | jq -r ' | ||
| + | bash wazuh-query.sh | jq -r ' | ||
| + | bash wazuh-query.sh | jq -r ' | ||
| + | bash wazuh-query.sh | jq -r ' | ||
| + | </ | ||
| + | |||
| + | |||
| + | =====Python Client===== | ||
| + | |||
| + | <code python> | ||
| + | # pip install opensearch-py | ||
| + | |||
| + | from opensearchpy import OpenSearch | ||
| + | |||
| + | es = OpenSearch( | ||
| + | hosts=[" | ||
| + | http_auth=(" | ||
| + | verify_certs=False | ||
| + | ) | ||
| + | |||
| + | query = { | ||
| + | " | ||
| + | } | ||
| + | |||
| + | resp = es.search(index=" | ||
| + | |||
| + | for hit in resp[" | ||
| + | ts = hit[" | ||
| + | |||
| + | # Sicherstellen, | ||
| + | data = hit[" | ||
| + | win = data.get(" | ||
| + | eventdata = win.get(" | ||
| + | |||
| + | targetUserName = eventdata.get(" | ||
| + | authenticationPackageName = eventdata.get(" | ||
| + | |||
| + | print(ts, ' | ||
| + | </ | ||
| + | |||
| + | =====Links===== | ||
| + | |||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
Seiten-Werkzeuge
Falls nicht anders bezeichnet, ist der Inhalt dieses Wikis unter der folgenden Lizenz veröffentlicht: CC Attribution-NoDerivatives 4.0 International
