Same agent/same hostname for a frequency alerts

[Daniil Sobolev]

Hi wazuh team,

I'm trying to create a rule for an alert that triggers several time on one host.

In the raw logs I only have a hostname. 

I found  <same location> tag, but it seems to be related to log file location. 

Is it possible to do such thing with what I have?

Thanks!

[Julián Morales]

Hi cry2rain,

The location identifies the origin of the input. If the event comes from an agent, its name and registered IP (as it was added) is appended to the location.
In other words, same_location is used to identify that the log source is the same, same agent and same file.

If the log format is syslog type, you could use the <same_system_name> tag. This option specifies that the name of the decoded system must be the same, comparing the hostname field extracted in the pre-decoding stage.
If the format is not syslog, you could extract the host name with your custom decoder and then use the same_field tag in the rule.

If you need help, feel free to share the logs along with your decoders and rules custom.

Please let me know if this is helpful to you.

Regards,
Julian

[Daniil Sobolev]

Exactly what I needed!  

Thanks a lot!

вторник, 2 февраля 2021 г. в 17:07:42 UTC+3, julian....@wazuh.com:

[Fontoura]

I've stumble upon the same needs but the <same_system_name/> tag doesn't seem to be working:

Here is the decoder:

<decoder name="huawei-ssh">

<prematch>%%\d+SSH</prematch>

</decoder>

<!-- Feb 01 14:55:37 <device_name> %%01SSH/4/SSH_FAIL(s)[0]:Failed to login through SSH. (IP=<IP>, VpnInstanceName= , UserName=<user>, Times=1, FailedReason=User public key authentication failed) -->

<decoder name="huawei-ssh-fail">

<parent>huawei-ssh</parent>

<use_own_name>true</use_own_name>

<prematch type="pcre2">SSH_FAIL</prematch>

<regex type="pcre2" offset="after_prematch">Failed to login through SSH\. \(IP=(\S+), VpnInstanceName=\s*(\S*), UserName=(\S+), Times=(\d+), FailedReason=(.+)\)</regex>

<order>srcip,vpninstance,username,times,failedreason,system_name</order>

</decoder>

Here is the rule:

<rule id="100301" level="5">

<decoded_as>huawei-ssh-fail</decoded_as>

<match>Failed to login</match>

<description>$(hostname): User '$(username)' failed to login through SSH from $(srcip). The reason was: '$(failedreason)'. This is the $(times) time this user has failed to login.</description>

<group>authentication,ssh</group>

</rule>

<rule id="100302" frequency="5" level="13" ignore="300" timeframe="300">

<if_matched_sid>100301</if_matched_sid>

<same_system_name/>

<!-- <same_field>username</same_field> -->

<description>$(hostname): User '$(username)' failed to login through SSH from $(srcip) 5 times. This alert will be suppressed for 5 minutes.</description>

<mitre>

<id>T1110</id>

</mitre>

<group>authentication,ssh</group>

</rule>

I believe its worth mentioning that the device generating these logs is not a Wazuh Agent, but a network device (Huawei). I'm sending the device's logs to wazuh directly.

I already have other rules that work with these logs, but now I need to aggregate them based on individual hosts.

Can you help me?

[Brenno Garcia]

Hello, 

could u give me a sample log and wazuh-logtest result?

[Vinícius Fontoura de Abreu]

Brenno, sorry for the long delay...

It turns out my solution was simpler: 

1. I set up my network devices to send their logs to my wazuh deployment;

2. I added a syslog-ng container to my wazuh deployment(I'm using docker with a compose file) and configured the syslog-ng to extract the name of the device from the source log and append it to the end of the message.

This way, my decoders and rules were able to use this new part of the message to differentiate each device. It works :)

DECODER:

<!-- %%01SSH -->

<decoder name="huawei-ssh">

<prematch>%%\d+SSH</prematch>

</decoder>

<!-- Mar 12 18:56:57 <device name> %%01SSH/4/SSH_FAIL(s)[235514]:Failed to login through SSH. (IP=<IP>, VpnInstanceName= , UserName=<user>, \

times=3, FailedReason=User password authentication failed) DEVICE_NAME=<device name>-->

<decoder name="huawei-ssh-fail">

<parent>huawei-ssh</parent>

<use_own_name>true</use_own_name>

<prematch type="pcre2">SSH_FAIL</prematch>

<regex type="pcre2">Failed to login through SSH\. \(IP=(\S+), VpnInstanceName=\s*(\S*), UserName=(\S+), Times=(\d+), FailedReason=(.+)\) DEVICE_NAME=(\S+)</regex>

<order>srcip,vpninstance,username,times,failedreason,device_name</order>

</decoder>

RULE:

<rule id="100301" level="5">

<decoded_as>huawei-ssh-fail</decoded_as>

<match>Failed to login</match>

<description>$(device_name): User '$(username)' failed to login through SSH from $(srcip). The reason was: '$(failedreason)'. \

This is the $(times) time this user has failed to login.</description>

<group>authentication,ssh</group>

</rule>

<rule id="100302" frequency="5" level="13" ignore="300" timeframe="300">

<if_matched_sid>100301</if_matched_sid>

<same_field>username</same_field>

<same_field>device_name</same_field>

<same_field>failedreason</same_field>

<description>$(hostname): User '$(username)' failed to login through SSH from $(srcip) 5 times. \

This alert will be suppressed for 5 minutes.</description>

<mitre>

<id>T1110</id>

</mitre>

<group>authentication,ssh</group>

</rule>

It would be great to have this as out-of-the-box from wazuh. As well as being able to customize the wazuh internal syslog service.

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/VHKebLdSass/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/cf125ccd-9ea3-48e0-915f-dda828f409d3n%40googlegroups.com.