Customizing rules for groups of agents
Joaquim António
Chantal Belen Kelm
To specify rules for a group of agents, you can create a new rule file in the Wazuh ruleset directory and add rules to it that apply specifically to that group. For example, if you have a group of agents for a particular client, you can create a new rule file in the Wazuh ruleset directory and add rules to it that are specific to that client's environment.
Here are the general steps to create a new rule file for a specific group of agents:
Create a new directory under /var/ossec/rules with a name that is unique and identifies the group. For example, you could create a directory called client-a for a group of agents that belong to client A.
Create a new rule file in the new directory with a unique name that describes the purpose of the file. For example, you could create a file called webserver-rules.xml for rules that apply to web servers in the group.
Add rules to the new rule file that apply specifically to the group of agents. You can use the existing Wazuh rules as a reference and modify them as needed. The rules should be specific to the group's environment and should not interfere with the rules that apply to other groups or the entire infrastructure.
Add the new rule file to the ossec.conf configuration file of the agents that belong to the group. You can add the file to the rules parameter under the appropriate group definition.
For example, you could add the following line to the ossec.conf file of the agents that belong to client-a:
<group name="client-a">
<ruleset>client-a/webserver-rules.xml</ruleset>
</group>
This tells the agents to use the webserver-rules.xml file that is located in the client-a directory under the Wazuh ruleset directory.
By following these steps, you can create separate rule files for each group of agents and specify different rules for each group. This can help you to tailor the Wazuh monitoring to the specific needs and requirements of each client or group.
Joaquim António
Chantal Belen Kelm
If you create new rule files or modify existing rules in the Wazuh ruleset directory, those changes will be preserved across upgrades to new versions of Wazuh, as long as you follow best practices for customizing the ruleset.
To ensure that your customizations are preserved across upgrades, you should avoid making changes to the original Wazuh rule files. Instead, create new rule files or modify copies of the original rule files and place them in a custom ruleset directory outside of the Wazuh installation directory. By doing so, your customizations will be stored in a separate location that is not affected by upgrades to the Wazuh software.
For example, you could create a new directory at /var/ossec/customrules to store your custom rule files. You could then copy the rules from the original Wazuh rule files into your custom rule files and make your modifications there. You can then add your custom ruleset to the ossec.conf configuration file of the agents as described in my previous response.
Another important consideration is to periodically review and update your custom rules to ensure that they continue to work as expected with new versions of Wazuh. New releases of Wazuh may introduce changes to the original rule files that could impact your customizations. Therefore, it is important to test your custom ruleset after upgrading Wazuh to ensure that it continues to function correctly. You may need to update your custom rules to account for changes to the original rules or to take advantage of new features introduced in the new version.
By following these best practices, you can create a customized ruleset for your environment that is preserved across upgrades and tailored to your specific needs.
Joaquim António
<ruleset>client-a/webserver-rules.xml</ruleset>
</group>
Chantal Belen Kelm
Unfortunately, it is not possible to filter rules by agent at the moment. Here are some options with which you can achieve something similar:
- Use labels: It is possible to add labels to the agent's groups that will be applied to every alert triggered by those agents. To do that you can apply a centralized configuration to set up the label for each specific group.
%2009.55.42.png?part=0.6&view=1)
%2009.56.49.png?part=0.4&view=1)
%2009.57.13.png?part=0.5&view=1)
Once that is done you can verify the new alerts from those agents and confirm that the label is applied. You can also filter by the labels in wazuh dashboard.
- Use a specific field: If you have a specific field in the alert that is common to all the agents of a group, you can edit the rules only to be triggered when that field is the expected. For example: if all the agent hostnames of the group "lab" start with "lab-" and you want to filter the rule 5701, you can create a child rule similar to this:
<rule id="100002" level="8">
<if_sid>5701</if_sid>
<hostname type="PCRE2">lab-.+</hostname>
<description>sshd: Possible attack on the ssh server </description>
<description>(or version gathering). - Known agetn</description>
</rule>
This way the rule will only be triggered when the agent hostname starts with "lab-".
As you can see in the previous image, agents starting with "lab-" trigger the custom rule, while agents that don't start with "lab-" trigger the original rule.
