active response if IP address in AWS VPC Flow Log in IP blacklist?

[Neil M]

I have successfully setup AWS VPC Flow Logs with Wazuh (messages show up in alerts.log)

I would like to perform an active response (firewall block) if aws.srcaddr exists in an IP blocklist (such as alienvault), however I'm not sure how to accomplish this

I read https://documentation.wazuh.com/current/proof-of-concept-guide/block-malicious-actor-ip-reputation.html

How do I configure a rule to do this? This is what i have:

<group name="attack,">
  <rule id="100100" level="10">
    <list field="aws.srcaddr" lookup="address_match_key">etc/lists/blacklist-alienvault</list>
    <description>IP address found in AlientVault reputation database</description>
  </rule>
</group>

thanks

Neil

[Federico Ramos]

Hi Neil

Try using "data.aws.scraddr" in the list tag. Also, if you want to test your rules, you can use https://documentation.wazuh.com/current/user-manual/ruleset/testing.html.