wazuh 收集 suricata eve.json日志

安装suricata和规则 (源码或者安装包)，本博客提供安装包操作方式：

切换成超级用户进行操作

yum -y install epel-release wget jq
curl -O https://copr.fedorainfracloud.org/coprs/jasonish/suricata-stable/repo/epel-7/jasonish-suricata-stable-epel-7.repo
yum -y install suricata
wget https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz
tar zxvf emerging.rules.tar.gz
rm /etc/suricata/rules/* -f
mv rules/*.rules /etc/suricata/rules/
rm -f /etc/suricata/suricata.yaml
wget -O /etc/suricata/suricata.yaml http://www.branchnetconsulting.com/wazuh/suricata.yaml
systemctl daemon-reload
systemctl enable suricata
systemctl start suricata

suricata 默认是af-packet 模式， 配置文件默认监控的是eth0网口，使用ifconfig 或者 ip addr 查看本机网口，并进行修改

af-packet:
  - interface: ens33
    # Number of receive threads (>1 will enable experimental flow pinned
    # runmode)
    threads: 1
    # Default clusterid.  AF_PACKET will load balance packets based on flow.
    # All threads/processes that will participate need to have the same
    # clusterid.
    cluster-id: 99
...

测试触发alert日志

suricata的默认日志路径配置信息：

default-log-dir: /var/log/suricata/
...
outputs:
...
  - eve-log:
      enabled: yes
      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
      filename: eve.json

日志记录在/var/log/suricata/eve.json中。

通过以下命令生成日志：

curl http://testmyids.com

输出为：

uid=0(root) gid=0(root) groups=0(root)

日志为json格式：

{"timestamp":"2019-11-19T03:12:29.008505+0000","flow_id":2047777552751061,"in_iface":"ens33","event_type":"alert","src_ip":"192.168.1.45","src_port":50512,"dest_ip":"217.160.0.187","dest_port":80,"proto":"TCP","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013028,"rev":4,"signature":"ET POLICY curl User-Agent Outbound","category":"Attempted Information Leak","severity":2}}
{"timestamp":"2019-11-19T03:12:29.231083+0000","flow_id":2047777552751061,"in_iface":"ens33","event_type":"alert","src_ip":"217.160.0.187","src_port":80,"dest_ip":"192.168.1.45","dest_port":50512,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2100498,"rev":7,"signature":"GPL ATTACK_RESPONSE id check returned root","category":"Potentially Bad Traffic","severity":2}}

通过signature_id 可以定位到具体规则：

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY curl User-Agent Outbound"; flow:established,to_server; content:"curl/"; nocase; http_user_agent; depth:5; reference:url,www.useragentstring.com/pages/useragentstring.php; classtype:attempted-recon; sid:2013028; rev:4; metadata:created_at 2011_06_14, updated_at 2011_06_14;)
alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)

suricata 对上面的输出进行检查匹配到以上两条日志，并产生以上日志。

suricata的规则也snort的语法一样，如果不明白可以阅读之前的snort规则解析文章。

接下来就是配置wazuh-agent，在 ossec.conf中增加以下配置：

    json
    /var/log/suricata/eve.json

agent的日志收集模块会调用read_json读取这个文件，具体实现，可以查看 wazuh 日志搜集原理分析 文章。

重启agent ：

systemctl restart wazuh-agent 或者 service wazuh-agent restart

如果想看wazuh-agent是否真的收集了信息，可以通过修改日志级别进行查看：

在/var/ossec/etc目录下有两个文件internal_options.conf 、 local_internal_options.conf 都可以修改日志级别，

本文在internal_options.conf中直接修改为2，最详细的日志：

# Log collector (server, local or Unix agent)
logcollector.debug=2

查看日志/var/ossec/logs/ossec.log：

2019/11/19 03:40:21 ossec-logcollector[49650] read_json.c:101 at read_json(): DEBUG: Reading json message: '{"timestamp":"2019-11-19T03:40:20.279975+0000","flow_id":1961614'...
2019/11/19 03:40:21 ossec-logcollector[49650] read_json.c:101 at read_json(): DEBUG: Reading json message: '{"timestamp":"2019-11-19T03:40:20.503634+0000","flow_id":1961614'...
2019/11/19 03:40:21 ossec-logcollector[49650] read_json.c:139 at read_json(): DEBUG: Read 2 lines from /var/log/suricata/eve.json
2019/11/19 03:40:21 ossec-logcollector[49650] read_syslog.c:97 at read_syslog(): DEBUG: Reading syslog message: 'Nov 19 03:40:10 jack suricata[81311]: message repeated 55 times:'...
2019/11/19 03:40:21 ossec-logcollector[49650] read_syslog.c:97 at read_syslog(): DEBUG: Reading syslog message: 'Nov 19 03:40:20 jack suricata[81311]: [1:2013028:4] ET POLICY cu'...
2019/11/19 03:40:21 ossec-logcollector[49650] read_syslog.c:97 at read_syslog(): DEBUG: Reading syslog message: 'Nov 19 03:40:20 jack suricata[81311]: [1:2100498:7] GPL ATTACK_R'...
2019/11/19 03:40:21 ossec-logcollector[49650] read_syslog.c:134 at read_syslog(): DEBUG: Read 3 lines from /var/log/syslog

日志正常获取，接下来看manager端转发到UI那边查看：

我在manager端部署了Elastic Stack

可以参考 https://documentation.wazuh.com/3.10/installation-guide/installing-elastic-stack/elastic_server_deb.html

通过浏览器可以查看：

http://ip:5601/

需要设置wazuh app

参考 https://documentation.wazuh.com/3.10/user-manual/kibana-app/connect-kibana-app.html

界面查看：