Nginx and Modsecurity integration with Wazuh

[Mohamed Maslouh]

Hello,

I want to integrate modesecurity logs in Wazuh.

OS : Ubuntu

Web Server : Nginx

Modesecurity log file : /var/log/modsec_audit.log

[hasitha.u...@wazuh.com]

Hi Mohamed,

We have an official blog that explains how to monitor ModSecurity events with Wazuh. You can check it out for detailed guidance.
Analyzing ModSecurity events with Wazuh

Additionally, as you mentioned, if these logs are written to a file, you can monitor them by installing the Wazuh agent on the endpoint where the logs are stored.

Steps to Monitor ModSecurity Events with Wazuh:1. Install the Wazuh Agent

Follow the instructions in the Wazuh documentation to install the agent on your system:
Wazuh Agent Installation Guide

2. Configure Log Paths

After installing the Wazuh agent, you need to configure the log paths in the ossec.conf file.

• Open the file using a text editor like nano or vi:

  nano /var/ossec/etc/ossec.conf

• Add the following configuration under the <ossec_config> tags, typically at the bottom of the file:

  1. <localfile>
  2. <location>/var/log/modsec_audit.log</location>
  3. <log_format>syslog</log_format>
  4. </localfile>

• Similarly, configure the Nginx log path in the ossec.conf file if required.

3. Restart the Wazuh Agent

Once the configuration is updated, restart the Wazuh agent to apply the changes:

systemctl restart wazuh-agent

4. Verify Log Parsing

To check if the logs match existing decoders and rules, use the wazuh-logtest tool:

/var/ossec/bin/wazuh-logtest

• Copy a sample log from your file, paste it into the tool after running the command, and press Enter.
• If the logs do not match any default decoders or rules, you’ll need to create custom decoders and rules.

5. Create Custom Decoders and Rules

If necessary, refer to the following documentation to create custom decoders and rules:

• Creating Custom Decoders
• Decoder Syntax Guide
• Creating Custom Rules
• Rule Syntax Guide
• Blog: Creating Decoders and Rules from Scratch

6. Troubleshooting

If you encounter any issues while creating decoders or rules, feel free to share sample logs from Nginx and ModSecurity. This will help in providing more specific assistance.

Let me know if you need further support on this.

Regards,
Hasitha Upekshitha