Skip to content

Integration with Wazuh SIEM

Description

Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. Integrating with XMS can be achieved relatively easy.

Installation

It is best to follow the official documentation on how to install the wazuh agent inside the virtual machine that XMS is running, regardless if it is a cloud instance or hosted in a company's infrastructure.

XMS specific instructions

Since XMS is tested to run on top of Ubuntu Linux, this guide will provide the require commands in order to install the agent and configure it.

  1. Install the GPG key:

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

  1. Add the repository and run apt-update

echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list && apt-get update

  1. Deploy Wazuh agent

Find out the IP address of the Wazuh server and create an environment variable.

export WAZUH_MANAGER="192.168.0.222" && apt-get install wazuh-agent

  1. Enable and start the Wazuh Agent service
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent
  1. It is recommended to disable automatic updates of the wazuh agent. That is achieved either by disabling the Wazuh apt repo or marking the package in hold state. Perform one of the following:

sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list

OR

echo "wazuh-agent hold" | dpkg --set-selections

Monitoring Docker events

The Docker listener allows the Wazuh agent to capture Docker events and forward them to the Wazuh server. The following sections describe how to install the Python Docker module and enable the Wazuh Docker listener.

Python libraries

The Docker container module requires Python 3. Specifically, it's compatible with Python 3.8–3.12. While later Python versions should work as well, we can't assure they are compatible.

For python version 3.11-3.12, the required libraries are installed through pip

pip3 install docker==7.1.0 urllib3==1.26.20 requests==2.32.2 --break-system-packages

Configuring the agent

Edit the configuration file in /var/ossec/etc/ossec.conf

and add the following block after the last wodle block:

  <wodle name="docker-listener">
    <interval>10m</interval>
    <attempts>5</attempts>
    <run_on_start>yes</run_on_start>
    <disabled>no</disabled>
  </wodle>

After that the agent can be restarted and the events should start appearing in the central Wazuh dashboard.

systemctl restart wazuh-agent