wazuh agent
- 功能介绍
- agent与manager通讯
- 配置文件梳理
功能介绍
日志收集(Log Collector)
> 介绍
This agent component can read flat log files and Windows events, collecting operating system and application log messages. It does support XPath filters for Windows events and recognizes multi-line formats (e.g. Linux Audit logs). It can also enrich JSON events with additional metadata.
> 流程图
> 配置
ossec.conf
(agent)或agent.conf
(manager)中配置:
<localfile>
<log_format>json</log_format>
<location>/test/json_log</location>
</localfile>
- log_format: 日志格式
- 如
syslog
、json
、full_command
等(更多见log_format) - 支持自定义 TODO: decoder & rule
- 如
- location: 日志路径
- 支持通配:如
/var/log/*.log
- 支持日期:如
C:\Windows\app\log-%y-%m-%d.log
- 支持环境变量:如
%SystemDrive%\inetpub\logs\LogFiles\W3SVC1\u_ex%y%m%d.log
- 支持通配:如
- target: 目标
- 仅多output的时候需要配置,配合
<socket>...</socket>
使用。
- 仅多output的时候需要配置,配合
> 输出
- alert.json/log
如果配置了规则匹配上了会输出到这儿。 - archives.json/log
manager端开启logall或logall_json
每次修改被监控的文件,会输出文件的所有内容到这儿。
TODO: 如何利用该功能做日志收集
命令执行(Command execution)
> 介绍
Agents can run authorized commands periodically, collecting their output and reporting it back to the Wazuh server for further analysis. This module can be used to meet different purposes (e.g. monitoring hard disk space left, getting a list of last logged in users, etc.).
> 流程图
> 配置
-
agent端
需要在/var/ossec/etc/local_internal_options.conf
添加wazuh_command.remote_commands=1
-
manager/agent端
ossec.conf
(agent)或agent.conf
(manager)中配置:<localfile> <log_format>full_command</log_format> <command>.....</command> <frequency>120</frequency> </localfile>
文件完整性监控(File integrity monitoring, FIM)
> 介绍
This module monitors the file system, reporting when files are created, deleted, or modified. It keeps track of file attributes, permissions, ownership, and content. When an event occurs, it captures who, what, and when details in real time. Additionally, this module builds and maintains a database with the state of the monitored files, allowing queries to be run remotely.
> 流程图
> 配置
在ossec.conf
或agent.conf
中配置:
<syscheck>
<frequency>36000</frequency>
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
...
</syscheck>
扫描位置
- directories:路径(文件or文件夹)
- 支持分割符(逗号
,
)或多行(多directories标签) - 支持环境变量
- 默认:取决于操作系统
- 属性:
- check_all
- realtime
- 更多
- 支持分割符(逗号
扫描时间
- frequency: 频率
- 单位:秒
- 默认:43200秒,即12个小时
- scan_on_start: 启动时是否扫描
- yes / no
- 默认:yes
- scan_time: 扫描时间(一天内)
- 支持精确到分(如
8:30
)或到小时(如9pm
) - 默认:无(默认是frequency)
- 支持精确到分(如
- scan_day: 扫描时间(一周内)
- 如:
thursday
- 默认:无(默认是frequency)
- 如:
其他
安全配置评估 (Security configuration assessment,SCA)
> 介绍
This component provides continuous configuration assessment, utilizing out-of-the-box checks based on the Center of Internet Security (CIS) benchmarks. Users can also create their own SCA checks to monitor and enforce their security policies.
> 流程图
> 配置
<sca>
<enabled>yes</enabled>
<scan_on_start>yes</scan_on_start>
<interval>12h</interval>
<skip_nfs>yes</skip_nfs>
</sca>
系统数据(System inventory)
> 介绍
This agent module periodically runs scans, collecting inventory data such as operating system version, network interfaces, running processes, installed applications, and a list of open ports. Scan results are stored into local SQLite databases that can be queried remotely.
恶意软件检测(Malware detection)
> 介绍
Using a non-signature based approach, this component is capable of detecting anomalies and possible presence of rootkits. Monitoring system calls, it looks for hidden processes, hidden files, and hidden ports.
> 流程图
自动响应(Active response)
> 介绍
This agent module is integrated with the Docker Engine API in order to monitor changes in a containerized environment. For example, it detects changes to container images, network configuration, or data volumes. Besides, it alerts on containers running in privileged mode and on users executing commands in a running container.
容器安全监控(Containers security monitoring)
> 介绍
This agent module is integrated with the Docker Engine API in order to monitor changes in a containerized environment. For example, it detects changes to container images, network configuration, or data volumes. Besides, it alerts on containers running in privileged mode and on users executing commands in a running container.
云安全监控(Containers security monitoring)
> 介绍
This component monitors cloud providers such as Amazon AWS, Microsoft Azure, or Google GCP. It natively communicates with their APIs. It is capable of detecting changes to the cloud infrastructure (e.g. a new user is created, a security group is modified, a cloud instance is stopped, etc.), and collecting cloud services log data (e.g. AWS Cloudtrail, AWS Macie, AWS GuardDuty, Azure Active Directory, etc.)
agent与manager通讯
注册
-
修改配置
vim /var/ossec/etc/ossec.conf
修改<server>
标签的<address>
为manager的ip<ossec_config> <client> <server> <address>${manager_ip}</address> <port>1514</port> <protocol>tcp</protocol> ...
-
认证
/var/ossec/bin/agent-auth -m ${manager_ip} -p ${manager_port} -A ${agent_name}
- manager_ip: manager的ip
- manager_port: manager认证端口,默认为1515
- agent_name: agent注册名称,默认为agent的hostname
-
重启
/var/ossec/bin/ossec-control restart
消息上报
策略下发
配置文件梳理
ossec.conf
> 功能
> 属于
- agent
- manager
> 位置
/var/ossec/etc/ossec.conf
C:\Program Files (x86)\ossec-agent\ossec.conf
agent.conf
> 功能
对agent进行远程的分组的管理。
> 分组依据
- 名称(name)
- 系统(os)
- 配置(profile)
> 启用
该功能需要在agent端启用:在agent的/var/ossec/etc/local_internal_options.conf
文件中,添加wazuh_command.remote_commands=1
> 属于
- agent - 不需要配置,会从manager端同步
- manager
> 位置
/var/ossec/etc/shared/*/agent.conf