How FTS works

[CRIZ]

Hi Team,

Can someone help me with the use of fts in decoder and Rules?

Prefer an example with screenshots to understand.
My concern is i would like to create an alert if a first seen service creates a new process in windows agent.

Thanks in advance.

Regards,

chris 

[Chukwudalu Chisimdi Okonkwo]

Hello Criz, 

Kindly allow me something to work on this and provide you with the desired output. Feedback will be provided shortly.

[Chukwudalu Chisimdi Okonkwo]

Hello Criz, 

Thanks for your time. I have completed my test, and here is the output. The <FTS> is used when you would like to see when a value is first seen within Wazuh. Here is an example

Objective: Detect when a new user is seen to fail a password login within my environment.

To achieve this, I start by using the <fts> to watch over a decoded field of interest. In this case, the field I will watch is the <user> field.  <User> is an alias to <dstuser>

Custom Decoder
<decoder name="fakeinc_custom"> <program_name>Fakeinc</program_name> </decoder> <decoder name="fakeinc_custom_message"> <parent>fakeinc_custom</parent> <prematch> password for user </prematch> <regex>^(\w+) password for user (\w+), IP: (\S+)</regex> <order>result, user, srcip</order> <fts>user</fts> <ftscomment>Detect when a new user is seen to fail password</ftscomment> </decoder>

Custom Rule
<group name="fakeinc"> <rule id="300102" level="0"> <decoded_as>fakeinc_custom</decoded_as> <description>Parent rule for Fakeinc custom</description> </rule> <rule id="300103" level="5"> <if_sid>300102</if_sid> <if_fts/> <description>First time user $(dstuser) is seen to fail a password</description> <group>authentication_failed</group> </rule> </group>


The above will first trigger when a new user is seen to fail a password login, but if this same user is seen over time doing it repeatedly, then this will not trigger any new alert until a completely new user is seen to trigger the same event.

To simulate this
1. Create a logfile that will be monitored by your Wazuh manager or Wazuh agent, e.g., fts.log
2. Then create a localfile within the manager or Wazuh agent's ossec.conf to monitor the logs in fts.log

  <localfile>
     <log_format>syslog</log_format>
     <location>/home/chuks/fts.log</location>
  </localfile>

3. Then restart the Wazuh manager or Wazuh agent.

Thereafter, begin to populate the log file fts.log with one line of these.

Dec  4 17:07:01 myserver Fakeinc: Accepted password for user test3, IP: 1.2.3.4
Dec  4 17:07:01 myserver Fakeinc: Accepted password for user test3, IP: 1.2.3.5
Dec  4 17:07:01 myserver Fakeinc: Accepted password for user test2, IP: 1.2.3.4
Dec  4 17:07:01 myserver Fakeinc: Accepted password for user test3, IP: 2.2.3.4
Dec  4 17:07:01 myserver Fakeinc: Accepted password for user test3, IP: 2.2.3.5
Dec  4 17:07:01 myserver Fakeinc: Accepted password for user test3, IP: 2.2.3.6


Expectation: only 2 alerts are to trigger. Firstly, the log line with test3 and then the third one with user test2 because that's a NEW USER. Screenshot from my environment is attached within

Above all, in regard to your use case, do note that the decoder <fts> can only be used against a list of allowed values, not custom values. Please find them here: https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/decoders.html#decoders-fts

So if the process falls under a field name not within the allowed values, then <fts> will not apply to your use case.

[Chukwudalu Chisimdi Okonkwo]

Adding a custom fule that contains the custom decoder and rule as the previous response had them muddled up

[CRIZ]

Hi  Chukwudalu Chisimdi Okonkwo,

Thanks for your support

Regards,