Wazuh
Wazuh is an open-source SIEM. Read more about the tool on its website. You are expected to be familiar with Wazuh and have it deployed, otherwise this connector will not be very useful to you. However, if you are coming from the CTI world and want to test the connector on a demo instance of Wazuh with test data, have a look at the full demo.
In order to fully understand how the connector works, it is worth knowing at least a little bit about how Wazuh works.
Agent
Each device monitored by Wazuh is called an agent. Agents have a three-digit
identifier. Wazuh itself will also be listed as an agent, with ID 000, and will
not be considered as an agent by the connector, but its own identity
(system_name). If
agents_as_systems is true, each agent will be its
own identity in OpenCTI.
Wazuh and its agents are represented as systems (a type of identity) in OpenCTI, and are used as targets in sightings.
Alert
An alert is an event, typically originating from a log, that Wazuh’s rules consider worthy of logging. It need not be an important event, despite the name alert. Alerts are classified with a rule level, ranging from 1 to 15 (0 are never logged).
The following is an example alert:
1{
2 "_index": "wazuh-alerts-4.x-sample",
3 "_id": "QeizKY8BtDMkMQlwZ138",
4 "_score": 1.8809273,
5 "_source": {
6 "predecoder": {
7 "hostname": "wazuh-manager",
8 "program_name": "sshd",
9 "timestamp": "Apr 27 18:49:51"
10 },
11 "cluster": {
12 "node": "wazuh-manager",
13 "name": "wazuh-cluster"
14 },
15 "agent": {
16 "ip": "145.80.240.15",
17 "name": "Amazon",
18 "id": "002"
19 },
20 "manager": {
21 "name": "wazuh-manager"
22 },
23 "data": {
24 "srcuser": "ec2-user",
25 "srcip": "141.98.81.37",
26 "srcport": "3527"
27 },
28 "@sampledata": true,
29 "rule": {
30 "firedtimes": 3,
31 "level": 5,
32 "pci_dss": [
33 "10.2.4",
34 "10.2.5",
35 "10.6.1"
36 ],
37 "hipaa": [
38 "164.312.b"
39 ],
40 "tsc": [
41 "CC1.4"
42 ],
43 "description": "sshd: Attempt to login using a non-existent user",
44 "groups": [
45 "syslog",
46 "sshd",
47 "invalid_login",
48 "authentication_failed"
49 ],
50 "id": 5710,
51 "nist_800_53": [
52 "AU.14",
53 "AC.7",
54 "AU.6"
55 ],
56 "gpg13": [
57 "7.1"
58 ],
59 "gdpr": [
60 "IV_35.7.d",
61 "IV_32.2"
62 ]
63 },
64 "decoder": {
65 "parent": "sshd",
66 "name": "sshd"
67 },
68 "full_log": "Apr 27 18:49:51 wazuh-manager sshd[10022]: Invalid user ec2-user from ec2-user from 141.98.81.37 port 3527 ssh2",
69 "input": {
70 "type": "log"
71 },
72 "@timestamp": "2024-04-27T18:49:51.048Z",
73 "location": "/var/log/secure",
74 "id": "1580123327.49031",
75 "GeoLocation": {
76 "city_name": "Berlin",
77 "country_name": "Germany",
78 "location": {
79 "lon": 13.411,
80 "lat": 52.524
81 },
82 "region_name": "Berlin"
83 },
84 "timestamp": "2024-04-27T18:49:51.048+0000"
85 }
86}
Alerts do not follow a strict schema/model, but the same fields are reused in many decoders. It is also possible to write custom decoders for Wazuh, where fields can be customised by the author.
This connector makes an effort trying to search all possible relevant fields, but given the lack of a schema/model, false positives are possible, as well as false negatives (alerts missed in searches). Please report false positives and false negatives.
OpenSearch
OpenSearch is the main database used by Wazuh, storing all alerts. The connector relies completely on this database for querying and enriching data. Wazuh also stores state and other information, such as installed software and active connections, in other databases, only available through the Wazuh API. Querying this API is still under development.
Your Wazuh installation may use Elastic instead of OpenSearch. The API should however be compatible, even if there is no official support for this.