|
|
@@ -0,0 +1,308 @@
|
|
|
+<ossec_config>
|
|
|
+ <global>
|
|
|
+ <jsonout_output>yes</jsonout_output>
|
|
|
+ <alerts_log>yes</alerts_log>
|
|
|
+ <logall>no</logall>
|
|
|
+ <logall_json>no</logall_json>
|
|
|
+ <email_notification>no</email_notification> <!-- (Optional) When you want to use email notifications -->
|
|
|
+ <smtp_server>postfix</smtp_server> <!-- Optional) When you need to use an SMTP relay for email notifications, and authentication is required -->
|
|
|
+ <email_from>your-from-email</email_from> <!-- (Optional) Replace with your email, hen you want to use email notifications -->
|
|
|
+ <email_to>your-to-email</email_to> <!-- (Optional) Replace with your email, when you want to use email notifications -->
|
|
|
+ <email_maxperhour>12</email_maxperhour>
|
|
|
+ <email_log_source>alerts.log</email_log_source>
|
|
|
+ <agents_disconnection_time>10m</agents_disconnection_time>
|
|
|
+ <agents_disconnection_alert_time>0</agents_disconnection_alert_time>
|
|
|
+ </global>
|
|
|
+
|
|
|
+ <alerts>
|
|
|
+ <log_alert_level>3</log_alert_level>
|
|
|
+ <email_alert_level>12</email_alert_level>
|
|
|
+ </alerts>
|
|
|
+
|
|
|
+ <!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
|
|
|
+ <logging>
|
|
|
+ <log_format>plain</log_format>
|
|
|
+ </logging>
|
|
|
+
|
|
|
+ <remote>
|
|
|
+ <connection>secure</connection>
|
|
|
+ <port>1514</port>
|
|
|
+ <protocol>tcp</protocol>
|
|
|
+ <queue_size>131072</queue_size>
|
|
|
+ </remote>
|
|
|
+
|
|
|
+ <!-- Policy monitoring -->
|
|
|
+ <rootcheck>
|
|
|
+ <disabled>no</disabled>
|
|
|
+ <check_files>yes</check_files>
|
|
|
+ <check_trojans>yes</check_trojans>
|
|
|
+ <check_dev>yes</check_dev>
|
|
|
+ <check_sys>yes</check_sys>
|
|
|
+ <check_pids>yes</check_pids>
|
|
|
+ <check_ports>yes</check_ports>
|
|
|
+ <check_if>yes</check_if>
|
|
|
+
|
|
|
+ <!-- Frequency that rootcheck is executed - every 12 hours -->
|
|
|
+ <frequency>43200</frequency>
|
|
|
+
|
|
|
+ <rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
|
|
|
+ <rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
|
|
|
+
|
|
|
+ <skip_nfs>yes</skip_nfs>
|
|
|
+ </rootcheck>
|
|
|
+
|
|
|
+ <wodle name="cis-cat">
|
|
|
+ <disabled>yes</disabled>
|
|
|
+ <timeout>1800</timeout>
|
|
|
+ <interval>1d</interval>
|
|
|
+ <scan-on-start>yes</scan-on-start>
|
|
|
+
|
|
|
+ <java_path>wodles/java</java_path>
|
|
|
+ <ciscat_path>wodles/ciscat</ciscat_path>
|
|
|
+ </wodle>
|
|
|
+
|
|
|
+ <!-- Osquery integration -->
|
|
|
+ <wodle name="osquery">
|
|
|
+ <disabled>yes</disabled>
|
|
|
+ <run_daemon>yes</run_daemon>
|
|
|
+ <log_path>/var/log/osquery/osqueryd.results.log</log_path>
|
|
|
+ <config_path>/etc/osquery/osquery.conf</config_path>
|
|
|
+ <add_labels>yes</add_labels>
|
|
|
+ </wodle>
|
|
|
+
|
|
|
+ <!-- System inventory -->
|
|
|
+ <wodle name="syscollector">
|
|
|
+ <disabled>no</disabled>
|
|
|
+ <interval>1h</interval>
|
|
|
+ <scan_on_start>yes</scan_on_start>
|
|
|
+ <hardware>yes</hardware>
|
|
|
+ <os>yes</os>
|
|
|
+ <network>yes</network>
|
|
|
+ <packages>yes</packages>
|
|
|
+ <ports all="no">yes</ports>
|
|
|
+ <processes>yes</processes>
|
|
|
+
|
|
|
+ <!-- Database synchronization settings -->
|
|
|
+ <synchronization>
|
|
|
+ <max_eps>10</max_eps>
|
|
|
+ </synchronization>
|
|
|
+ </wodle>
|
|
|
+
|
|
|
+ <sca>
|
|
|
+ <enabled>yes</enabled>
|
|
|
+ <scan_on_start>yes</scan_on_start>
|
|
|
+ <interval>12h</interval>
|
|
|
+ <skip_nfs>yes</skip_nfs>
|
|
|
+ </sca>
|
|
|
+
|
|
|
+ <vulnerability-detection>
|
|
|
+ <enabled>yes</enabled>
|
|
|
+ <index-status>yes</index-status>
|
|
|
+ <feed-update-interval>60m</feed-update-interval>
|
|
|
+ </vulnerability-detection>
|
|
|
+
|
|
|
+ <indexer>
|
|
|
+ <enabled>yes</enabled>
|
|
|
+ <hosts>
|
|
|
+ <host>https://wazuh.indexer:9200</host>
|
|
|
+ </hosts>
|
|
|
+ <ssl>
|
|
|
+ <certificate_authorities>
|
|
|
+ <ca>/etc/ssl/root-ca.pem</ca>
|
|
|
+ </certificate_authorities>
|
|
|
+ <certificate>/etc/ssl/filebeat.pem</certificate>
|
|
|
+ <key>/etc/ssl/filebeat.key</key>
|
|
|
+ </ssl>
|
|
|
+ </indexer>
|
|
|
+
|
|
|
+ <!-- File integrity monitoring -->
|
|
|
+ <syscheck>
|
|
|
+ <disabled>no</disabled>
|
|
|
+
|
|
|
+ <!-- Frequency that syscheck is executed default every 12 hours -->
|
|
|
+ <frequency>43200</frequency>
|
|
|
+
|
|
|
+ <scan_on_start>yes</scan_on_start>
|
|
|
+
|
|
|
+ <!-- Generate alert when new file detected -->
|
|
|
+ <alert_new_files>yes</alert_new_files>
|
|
|
+
|
|
|
+ <!-- Don't ignore files that change more than 'frequency' times -->
|
|
|
+ <auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
|
|
|
+
|
|
|
+ <!-- Directories to check (perform all possible verifications) -->
|
|
|
+ <directories>/etc,/usr/bin,/usr/sbin</directories>
|
|
|
+ <directories>/bin,/sbin,/boot</directories>
|
|
|
+
|
|
|
+ <!-- Files/directories to ignore -->
|
|
|
+ <ignore>/etc/mtab</ignore>
|
|
|
+ <ignore>/etc/hosts.deny</ignore>
|
|
|
+ <ignore>/etc/mail/statistics</ignore>
|
|
|
+ <ignore>/etc/random-seed</ignore>
|
|
|
+ <ignore>/etc/random.seed</ignore>
|
|
|
+ <ignore>/etc/adjtime</ignore>
|
|
|
+ <ignore>/etc/httpd/logs</ignore>
|
|
|
+ <ignore>/etc/utmpx</ignore>
|
|
|
+ <ignore>/etc/wtmpx</ignore>
|
|
|
+ <ignore>/etc/cups/certs</ignore>
|
|
|
+ <ignore>/etc/dumpdates</ignore>
|
|
|
+ <ignore>/etc/svc/volatile</ignore>
|
|
|
+
|
|
|
+ <!-- File types to ignore -->
|
|
|
+ <ignore type="sregex">.log$|.swp$</ignore>
|
|
|
+
|
|
|
+ <!-- Check the file, but never compute the diff -->
|
|
|
+ <nodiff>/etc/ssl/private.key</nodiff>
|
|
|
+
|
|
|
+ <skip_nfs>yes</skip_nfs>
|
|
|
+ <skip_dev>yes</skip_dev>
|
|
|
+ <skip_proc>yes</skip_proc>
|
|
|
+ <skip_sys>yes</skip_sys>
|
|
|
+
|
|
|
+ <!-- Nice value for Syscheck process -->
|
|
|
+ <process_priority>10</process_priority>
|
|
|
+
|
|
|
+ <!-- Maximum output throughput -->
|
|
|
+ <max_eps>100</max_eps>
|
|
|
+
|
|
|
+ <!-- Database synchronization settings -->
|
|
|
+ <synchronization>
|
|
|
+ <enabled>yes</enabled>
|
|
|
+ <interval>5m</interval>
|
|
|
+ <max_interval>1h</max_interval>
|
|
|
+ <max_eps>10</max_eps>
|
|
|
+ </synchronization>
|
|
|
+ </syscheck>
|
|
|
+
|
|
|
+ <!-- Active response -->
|
|
|
+ <global>
|
|
|
+ <white_list>127.0.0.1</white_list>
|
|
|
+ <white_list>^localhost.localdomain$</white_list>
|
|
|
+ </global>
|
|
|
+
|
|
|
+ <command>
|
|
|
+ <name>disable-account</name>
|
|
|
+ <executable>disable-account</executable>
|
|
|
+ <timeout_allowed>yes</timeout_allowed>
|
|
|
+ </command>
|
|
|
+
|
|
|
+ <command>
|
|
|
+ <name>restart-wazuh</name>
|
|
|
+ <executable>restart-wazuh</executable>
|
|
|
+ </command>
|
|
|
+
|
|
|
+ <command>
|
|
|
+ <name>firewall-drop</name>
|
|
|
+ <executable>firewall-drop</executable>
|
|
|
+ <timeout_allowed>yes</timeout_allowed>
|
|
|
+ </command>
|
|
|
+
|
|
|
+ <command>
|
|
|
+ <name>host-deny</name>
|
|
|
+ <executable>host-deny</executable>
|
|
|
+ <timeout_allowed>yes</timeout_allowed>
|
|
|
+ </command>
|
|
|
+
|
|
|
+ <command>
|
|
|
+ <name>route-null</name>
|
|
|
+ <executable>route-null</executable>
|
|
|
+ <timeout_allowed>yes</timeout_allowed>
|
|
|
+ </command>
|
|
|
+
|
|
|
+ <command>
|
|
|
+ <name>win_route-null</name>
|
|
|
+ <executable>route-null.exe</executable>
|
|
|
+ <timeout_allowed>yes</timeout_allowed>
|
|
|
+ </command>
|
|
|
+
|
|
|
+ <command>
|
|
|
+ <name>netsh</name>
|
|
|
+ <executable>netsh.exe</executable>
|
|
|
+ <timeout_allowed>yes</timeout_allowed>
|
|
|
+ </command>
|
|
|
+
|
|
|
+ <!--
|
|
|
+ <active-response>
|
|
|
+ active-response options here
|
|
|
+ </active-response>
|
|
|
+ -->
|
|
|
+
|
|
|
+ <!-- Log analysis -->
|
|
|
+ <localfile>
|
|
|
+ <log_format>command</log_format>
|
|
|
+ <command>df -P</command>
|
|
|
+ <frequency>360</frequency>
|
|
|
+ </localfile>
|
|
|
+
|
|
|
+ <localfile>
|
|
|
+ <log_format>full_command</log_format>
|
|
|
+ <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
|
|
|
+ <alias>netstat listening ports</alias>
|
|
|
+ <frequency>360</frequency>
|
|
|
+ </localfile>
|
|
|
+
|
|
|
+ <localfile>
|
|
|
+ <log_format>full_command</log_format>
|
|
|
+ <command>last -n 20</command>
|
|
|
+ <frequency>360</frequency>
|
|
|
+ </localfile>
|
|
|
+
|
|
|
+ <ruleset>
|
|
|
+ <!-- Default ruleset -->
|
|
|
+ <decoder_dir>ruleset/decoders</decoder_dir>
|
|
|
+ <rule_dir>ruleset/rules</rule_dir>
|
|
|
+ <rule_exclude>0215-policy_rules.xml</rule_exclude>
|
|
|
+ <list>etc/lists/audit-keys</list>
|
|
|
+ <list>etc/lists/amazon/aws-eventnames</list>
|
|
|
+ <list>etc/lists/security-eventchannel</list>
|
|
|
+
|
|
|
+ <!-- User-defined ruleset -->
|
|
|
+ <decoder_dir>etc/decoders</decoder_dir>
|
|
|
+ <rule_dir>etc/rules</rule_dir>
|
|
|
+ </ruleset>
|
|
|
+
|
|
|
+ <rule_test>
|
|
|
+ <enabled>yes</enabled>
|
|
|
+ <threads>1</threads>
|
|
|
+ <max_sessions>64</max_sessions>
|
|
|
+ <session_timeout>15m</session_timeout>
|
|
|
+ </rule_test>
|
|
|
+
|
|
|
+ <!-- Configuration for wazuh-authd -->
|
|
|
+ <auth>
|
|
|
+ <disabled>no</disabled>
|
|
|
+ <port>1515</port>
|
|
|
+ <use_source_ip>no</use_source_ip>
|
|
|
+ <purge>yes</purge>
|
|
|
+ <use_password>no</use_password>
|
|
|
+ <ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
|
|
|
+ <!-- <ssl_agent_ca></ssl_agent_ca> -->
|
|
|
+ <ssl_verify_host>no</ssl_verify_host>
|
|
|
+ <ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
|
|
|
+ <ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
|
|
|
+ <ssl_auto_negotiate>no</ssl_auto_negotiate>
|
|
|
+ </auth>
|
|
|
+
|
|
|
+ <cluster>
|
|
|
+ <name>wazuh</name>
|
|
|
+ <node_name>node01</node_name>
|
|
|
+ <node_type>master</node_type>
|
|
|
+ <key>aa093264ef885029653eea20dfcf51ae</key>
|
|
|
+ <port>1516</port>
|
|
|
+ <bind_addr>0.0.0.0</bind_addr>
|
|
|
+ <nodes>
|
|
|
+ <node>wazuh.manager</node>
|
|
|
+ </nodes>
|
|
|
+ <hidden>no</hidden>
|
|
|
+ <disabled>yes</disabled>
|
|
|
+ </cluster>
|
|
|
+
|
|
|
+</ossec_config>
|
|
|
+
|
|
|
+<ossec_config>
|
|
|
+ <localfile>
|
|
|
+ <log_format>syslog</log_format>
|
|
|
+ <location>/var/ossec/logs/active-responses.log</location>
|
|
|
+ </localfile>
|
|
|
+
|
|
|
+</ossec_config>
|
Christian Lempa