Wazuh功能梳理

官方文档

功能介绍

日志收集（Log Collector）

> 介绍

官方文档

This agent component can read flat log files and Windows events, collecting operating system and application log messages. It does support XPath filters for Windows events and recognizes multi-line formats (e.g. Linux Audit logs). It can also enrich JSON events with additional metadata.

> 流程图

> 配置

ossec.conf（agent）或agent.conf（manager）中配置：

<localfile>
    <log_format>json</log_format>
    <location>/test/json_log</location>
</localfile>

• log_format: 日志格式
  • 如syslog、json、full_command等（更多见log_format）
  • 支持自定义 TODO: decoder & rule
• location: 日志路径
  • 支持通配：如/var/log/*.log
  • 支持日期：如C:\Windows\app\log-%y-%m-%d.log
  • 支持环境变量：如%SystemDrive%\inetpub\logs\LogFiles\W3SVC1\u_ex%y%m%d.log
• target: 目标
  • 仅多output的时候需要配置，配合<socket>...</socket>使用。

> 输出

• alert.json/log
  如果配置了规则匹配上了会输出到这儿。
• archives.json/log
  manager端开启logall或logall_json
  每次修改被监控的文件，会输出文件的所有内容到这儿。
  TODO: 如何利用该功能做日志收集
  

命令执行（Command execution）

> 介绍

官方文档

Agents can run authorized commands periodically, collecting their output and reporting it back to the Wazuh server for further analysis. This module can be used to meet different purposes (e.g. monitoring hard disk space left, getting a list of last logged in users, etc.).

> 流程图

> 配置

• agent端
  需要在/var/ossec/etc/local_internal_options.conf添加wazuh_command.remote_commands=1

• manager/agent端
  ossec.conf（agent）或agent.conf（manager）中配置：

  <localfile>
   	<log_format>full_command</log_format>
   	<command>.....</command>
   	<frequency>120</frequency>
  </localfile>
  

文件完整性监控（File integrity monitoring， FIM）

> 介绍

官方文档

This module monitors the file system, reporting when files are created, deleted, or modified. It keeps track of file attributes, permissions, ownership, and content. When an event occurs, it captures who, what, and when details in real time. Additionally, this module builds and maintains a database with the state of the monitored files, allowing queries to be run remotely.

> 流程图

> 配置

在ossec.conf或agent.conf中配置：

<syscheck>
  <frequency>36000</frequency>
  <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
  ...
</syscheck>

扫描位置

• directories：路径（文件or文件夹）
  • 支持分割符（逗号,）或多行（多directories标签）
  • 支持环境变量
  • 默认：取决于操作系统
  • 属性：
    • check_all
    • realtime
    • 更多

扫描时间

• frequency: 频率
  • 单位：秒
  • 默认：43200秒，即12个小时
• scan_on_start: 启动时是否扫描
  • yes / no
  • 默认：yes
• scan_time: 扫描时间（一天内）
  • 支持精确到分（如8:30）或到小时（如9pm）
  • 默认：无（默认是frequency）
• scan_day: 扫描时间（一周内）
  • 如：thursday
  • 默认：无（默认是frequency）

其他

安全配置评估 (Security configuration assessment，SCA)

> 介绍

官方文档

This component provides continuous configuration assessment, utilizing out-of-the-box checks based on the Center of Internet Security (CIS) benchmarks. Users can also create their own SCA checks to monitor and enforce their security policies.

> 流程图

> 配置

  <sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
    <skip_nfs>yes</skip_nfs>
  </sca>

系统数据（System inventory）

> 介绍

官方文档

This agent module periodically runs scans, collecting inventory data such as operating system version, network interfaces, running processes, installed applications, and a list of open ports. Scan results are stored into local SQLite databases that can be queried remotely.

恶意软件检测（Malware detection）

> 介绍

官方文档

Using a non-signature based approach, this component is capable of detecting anomalies and possible presence of rootkits. Monitoring system calls, it looks for hidden processes, hidden files, and hidden ports.

> 流程图

自动响应（Active response）

> 介绍

This agent module is integrated with the Docker Engine API in order to monitor changes in a containerized environment. For example, it detects changes to container images, network configuration, or data volumes. Besides, it alerts on containers running in privileged mode and on users executing commands in a running container.

容器安全监控（Containers security monitoring）

> 介绍

This agent module is integrated with the Docker Engine API in order to monitor changes in a containerized environment. For example, it detects changes to container images, network configuration, or data volumes. Besides, it alerts on containers running in privileged mode and on users executing commands in a running container.

云安全监控（Containers security monitoring）

> 介绍

This component monitors cloud providers such as Amazon AWS, Microsoft Azure, or Google GCP. It natively communicates with their APIs. It is capable of detecting changes to the cloud infrastructure (e.g. a new user is created, a security group is modified, a cloud instance is stopped, etc.), and collecting cloud services log data (e.g. AWS Cloudtrail, AWS Macie, AWS GuardDuty, Azure Active Directory, etc.)

agent与manager通讯

注册

1. 修改配置
   vim /var/ossec/etc/ossec.conf
   修改<server>标签的<address>为manager的ip

   <ossec_config>
     <client>
       <server>
         <address>${manager_ip}</address>
         <port>1514</port>
         <protocol>tcp</protocol>
   ...
   

2. 认证
   /var/ossec/bin/agent-auth -m ${manager_ip} -p ${manager_port} -A ${agent_name}

   • manager_ip: manager的ip
   • manager_port: manager认证端口，默认为1515
   • agent_name: agent注册名称，默认为agent的hostname

3. 重启
   /var/ossec/bin/ossec-control restart

消息上报

策略下发

配置文件梳理

ossec.conf

官方文档

> 功能

> 属于

• agent
• manager

> 位置

• /var/ossec/etc/ossec.conf
• C:\Program Files (x86)\ossec-agent\ossec.conf

agent.conf

官方文档

> 功能

对agent进行远程的分组的管理。

> 分组依据

• 名称（name）
• 系统（os）
• 配置（profile）

> 启用

该功能需要在agent端启用：在agent的/var/ossec/etc/local_internal_options.conf文件中，添加wazuh_command.remote_commands=1

> 属于

• agent - 不需要配置，会从manager端同步
• manager

> 位置

• /var/ossec/etc/shared/*/agent.conf