GeoLocation data in Integration component

[Ramiro Fróes Ferrão]

Greetings,

I'd like to know if this is possible with the latest build of Wazuh or if there's any special configuration needed.

ossec.conf (Integrator configuration only)

<integration>
    <name>custom-integration</name>
    <level>4</level>
    <rule_id>81606</rule_id>
    <alert_format>json</alert_format>
  </integration>

[Ramiro Fróes Ferrão]

Also I've added this in local_internal_options.conf

analysisd.geoip_jsonout=1

Despite this — and even checking it directly into internal_options.conf —, there were no changes (GeoLocation data that is) shown in /var/ossec/logs/alerts/alerts.json

[Facundo Dalmau]

Hi Ramiro,

Thanks for using Wazuh!

What is the use case you are trying to achieve with the Integration you are declaring?

Regards,

Facundo Dalmau

[Ramiro Fróes Ferrão]

I'm trying to forward events from the aforementioned rule_id towards an external monitoring system using the Integrator component, although it's just an initial experiment for now. It would be useful for the JSON data handled by the custom-integration script to already have GeoLocation/GeoIP related information available considering it's already present in wazuh-alerts-4.x-xxxx.xx.xx index's _source.

Shouldn't the analysisd.geoip_jsonout option provide this for Integrator as well? Not sure what I should do next.

[Facundo Dalmau]

Hi Ramiro,

Thanks for your reply!

Currently, the geolocation data is added to the alert on Wazuh indexer level, after being processed by all decoders and rules, limiting the ability to create rules and decode with geolocation conditions. That is the main reason, as you mentioned, the geolocation data is not shown in /var/ossec/logs/alerts/alerts.json.
For the use case you mention, I suggest two options:
- Make your custom integration to look for the geolocation data
- Create rules that can use geolocation, building Wazuh with the flag USE_GEOIP=yes. Since you have already set up the option analysisd.geoip_jsonout, did you build Wazuh from sources including Geolite2 databases? 

Regards,

[Ramiro Fróes Ferrão]

Hi Facundo Dalmau,

Thank you for the feedback! I've already considered the first option, but I'd prefer if I didn't need to use other services for getting this data, if possible; as for the second one, no, I used the wazuh-install.sh script with the --all-in-one flag. Can you elaborate on this?

• How do I recompile Wazuh and Geolite databases for rules to be compatible with GeoLocation?
• What do I need to change in the rules for geo data to be available in alerts.json and custom Integrator scripts?

Best regards,

[Facundo Dalmau]

Hi Ramiro, 

Sure. You will have to reinstall Wazuh from sources doing the following to include GeoLite2 database:

1. Install libgeoip-dev library. command: apt install libgeoip-dev
2. Build Wazuh version with USE_GEOIP flag. command: make TARGET=server USE_GEOIP=yes
3. Install Wazuh server version,  command: ./install.sh
4. Download the GeoLite2 free databases, it's necessary create an account. choose the City version in CSV format, zipped. link .
5. Download geolite2legacy.py to convert from .CSV to .DAT file (supported by Wazuh).
6. Convert the GeoLite2-City-CSV to DB file. command: ./geolite2legacy.py -i GeoLite2-City-CSV_20220603.zip -f geoname2fips.csv -o GeoIP.dat
7. Copy the converted GeoIP.dat DB inside the Wazuh directory. command: cp GeoIP.dat /var/ossec/etc

Following steps are configuration settings:

- Enable USE_GEOIP in ossec.conf file:

    <global>     

            <geoipdb>/var/ossec/etc/GeoIP.dat</geoipdb>     

    </global>    

    <alerts>     

            <use_geoip>yes</use_geoip>    

    </alerts>

- Enable USE_GEOIP in internal_options.conf file:

     analysisd.geoip_jsonout=1    

     maild.geoip=1

Restart Wazuh server and it should run without any ERROR message. At this point every generated alert that include srcip or dstip field will look for the srcgeoip or dstgeoip information in GeoIP.dat database.

Let me know how it goes!

Regards

[Ramiro Fróes Ferrão]

Hi Facundo,

Thanks, it works. Just had to make some adjustments for CentOS (described below so it may help anybody else trying to do this):

1. Installed GeoIP-devel, no libgeoip-dev package is available for CentOS
   
2. OK
3. During install.sh USE_GEOIP was turned off again, so I just opted to hardcode it into install.sh (line 1128: ${MAKEBIN} TARGET=${INSTYPE} USE_GEOIP=yes... )
   
4. OK
5. OK
6. OK
7. OK

Everything else is good.

Best regards,

[Facundo Dalmau]

Hi Ramiro,

Great to read that it worked properly.

Thanks for sharing the adjustments!

Regards