Agentless Monitoring of ModSecurity Events

[Asmit Desai]

Hi Team

I saw the wazuh blogs and could find the agent monitoring method for ModSecurity but for my workflow i want to be able to get ModSecurity Events along with Cpanel events agentlessly is there a way to achieve that.

[antonio...@wazuh.com]

Hi,

First of all, if possible, I recommend installing an agent, since it's the easiest way to do it. You can follow this documentation.

Following the guide above, the first steps are the same for an agentless setup; the difference lies in forwarding the logs to the Wazuh Manager, which in this case would be done using rsyslog.

•  To do this, you’ll need to configure the <allowed-ips><CIDR_NOTATION></allowed-ips> field using the ModSecurity/cPanel IP address
• On the host where ModSecurity/cPanel is running, you must configure rsyslog to read the relevant files and forward them to the Wazuh server using the port you specified in the configuration.
• Events generated by ModSecurity and written to Apache’s error.log file are covered by Wazuh. However, for cPanel events, you’ll need to create custom decoders and rules for the logs stored under the path /usr/local/cpanel/logs/. For example:
  • /usr/local/cpanel/logs/access_log: Contains records of when a cPanel & WHM user accesses their account.
  • /usr/local/cpanel/logs/cphulkd_errors.log: Logs errors from the Brute Force Protection daemon (cphulkd).
  • /usr/local/cpanel/logs/error_log: Contains general cPanel & WHM errors (e.g., fatal errors or directive timeouts).

Syslog is line-oriented, so single-line logs (Apache error.log , cPanel access/login logs) forward cleanly. The detailed ModSecurity audit log is multiline, which does not travel well over plain syslog. If you need the full audit detail, either forward it as JSON (rsyslog imfile can handle that on the client side) or use a Wazuh agent for that specific file. The agent handles multiline collection natively.