HowTo: Wazuh SIEM/XDR de la zero

Wazuh e o platforma open-source de detectie (XDR) si management de loguri (SIEM): agenti pe endpointuri, integritatea fisierelor, colectare de loguri, detectie de vulnerabilitati si raspuns automat. Ghidul asta te duce de la instalare pana la reguli proprii si integrari.

Instalare (all-in-one sau componente separate)

Wazuh are trei componente: manager (analiza), indexer (stocare/cautare, bazat pe OpenSearch) si dashboard. Pentru inceput, all-in-one:

curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
bash ./wazuh-install.sh -a               # manager + indexer + dashboard
# afiseaza parola 'admin' pt https://server (dashboard)
tar -xf wazuh-install-files.tar          # certificatele generate
systemctl status wazuh-manager wazuh-indexer wazuh-dashboard

Pentru scala mare instalezi componentele separat (mai multe noduri de indexer). Documentatia oficiala are pasii -wi / -ws / -wd.

Enrolare agenti + grupuri

Agentul se inregistreaza la manager (authd) si primeste o cheie. Il pui intr-un grup ca sa mosteneasca o configuratie comuna.

# Linux
WAZUH_MANAGER='wazuh.example.com' apt install wazuh-agent
systemctl enable --now wazuh-agent
# Windows
msiexec /i wazuh-agent-4.9.0.msi /q WAZUH_MANAGER='wazuh.example.com'
Net Start WazuhSvc
# pe manager: vezi agentii + pune-i in grup
/var/ossec/bin/agent_control -l
/var/ossec/bin/agent_groups -a -i 003 -g servere-web

FIM: integritatea fisierelor (realtime + whodata)

Syscheck monitorizeaza directoare; cu whodata (audit) afli si cine a facut modificarea, nu doar ca s-a intamplat.

<!-- /var/ossec/etc/shared/servere-web/agent.conf -->
<syscheck>
  <disabled>no</disabled>
  <directories check_all="yes" realtime="yes" whodata="yes">/var/www,/etc</directories>
  <alert_new_files>yes</alert_new_files>
  <frequency>43200</frequency>
</syscheck>
# restart si verifici pe agent:
/var/ossec/bin/wazuh-control restart

Colectare loguri + rootcheck

Colectezi orice log (auth, nginx, aplicatie, Windows Event) si rulezi verificari de politici/rootkit.

<!-- localfile in agent.conf -->
<localfile><log_format>syslog</log_format><location>/var/log/auth.log</location></localfile>
<localfile><log_format>json</log_format><location>/var/log/nginx/access.json</location></localfile>
<localfile><log_format>eventchannel</log_format><location>Security</location></localfile>
# rootcheck + SCA (Security Configuration Assessment) sunt pornite implicit

Reguli si decoders custom

Cand vrei alerte pe aplicatia ta, scrii un decoder (extrage campuri) si o regula (decide severitatea). Se testeaza cu wazuh-logtest.

<!-- /var/ossec/etc/rules/local_rules.xml -->
<group name="local,syslog,">
  <rule id="100100" level="12">
    <if_sid>5716</if_sid>         <!-- SSH login failed -->
    <srcip>!192.168.0.0/16</srcip>
    <description>SSH esuat din exterior</description>
  </rule>
</group>
# test rapid:
echo 'Failed password for root from 1.2.3.4' | /var/ossec/bin/wazuh-logtest

Active response: blocare automata

La reguli grave, managerul comanda agentul sa reactioneze — de exemplu blocheaza IP-ul in firewall pentru 10 minute.

<!-- ossec.conf pe manager -->
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>5710,5712,100100</rules_id>
  <timeout>600</timeout>
</active-response>
# vezi actiunile in /var/ossec/logs/active-responses.log

Detectie vulnerabilitati + integrari

Wazuh coreleaza inventarul de pachete cu feed-urile de CVE si se integreaza cu VirusTotal (hash-uri din FIM) si Suricata (eve.json).

<!-- ossec.conf pe manager -->
<vulnerability-detection><enabled>yes</enabled></vulnerability-detection>
<integration>
  <name>virustotal</name>
  <api_key>***</api_key>
  <rule_id>100200,554</rule_id>
</integration>
# Suricata: colectezi /var/log/suricata/eve.json ca localfile json

Operare: mentenanta index si vizualizare

Indexer-ul e OpenSearch; folosesti ISM (Index State Management) ca sa nu creasca la nesfarsit, si dashboard-ul pentru investigatii.

# starea indexer-ului
curl -k -u admin:*** https://localhost:9200/_cat/indices?v
# politica ISM: rollover la 30 GB / stergere dupa 90 zile (din dashboard: Index Management)
# alertele live: dashboard > Threat Hunting / Security events