Wazuh is a free and open source platform used for threat prevention, detection,
and response. It is capable of protecting workloads across on-premises,
virtualized, containerized, and cloud-based environments.
Wazuh solution consists of an endpoint security agent, deployed to the
monitored systems, and a management server, which collects and analyzes data
gathered by the agents. Besides, Wazuh has been fully integrated with the
Elastic Stack, providing a search engine and data visualization tool that
allows users to navigate through their security alerts.
===> The following configuration options are available for wazuh-manager-4.5.4:
INOTIFY=off: Kevent based real time monitoring
PRELUDE=off: Sensor support from Prelude SIEM
ZEROMQ=off: ZeroMQ support
====> Options available for the group DATABASE
MYSQL=off: MySQL database support
PGSQL=off: PostgreSQL database support
===> Use 'make config' to modify these settings
Wazuh Manager was installed
1) Copy /etc/locatime to /var/ossec/etc directory
# cp /etc/localtime /var/ossec/etc
2) You must edit /var/ossec/etc/ossec.conf.sample for your setup and rename/copy
it to ossec.conf.
Take a look wazuh manager configuration at the following url:
https://documentation.wazuh.com/current/user-manual/manager/index.html
3) You can find additional useful files installed at
# /var/ossec/packages_files/manager_installation_scripts
4) Do not forget generate auth certificate
# openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 \
-subj "/C=US/ST=California/CN=Wazuh/" \
-keyout /var/ossec/etc/sslmanager.key -out /var/ossec/etc/sslmanager.cert
# chmod 640 /var/ossec/etc/sslmanager.key
# chmod 640 /var/ossec/etc/sslmanager.cert
5) FreeBSD SCA files can be downloaded from the following
# fetch https://people.freebsd.org/~acm/ports/wazuh/wazuh-freebsd-sca.tar.gz
Extract and put them to /var/ossec/etc/ruleset/sca. Do not forget change permissions
# chown root:wazuh /var/ossec/ruleset/sca/cis_freebsd*.yml
# chmod 640 /var/ossec/ruleset/sca/cis_freebsd*.yml
6) Aditional decoders and rules files can be download from:
# fetch https://people.freebsd.org/~acm/ports/wazuh/0600-freebsd_decoders.xml
# fetch https://people.freebsd.org/~acm/ports/wazuh/1000-freebsd_rules.xml
# cp 0600-freebsd_decoders.xml /var/ossec/ruleset/decoders
# cp 1000-freebsd_rules.xml /var/ossec/ruleset/rules
Do not forget change permissions
# chown root:wazuh /var/ossec/ruleset/decoders/0600-freebsd_decoders.xml
# chmod 640 /var/ossec/ruleset/decoders/0600-freebsd_decoders.xml
# chown root:wazuh /var/ossec/ruleset/rules/1000-freebsd_rules.xml
# chmod 640 /var/ossec/ruleset/rules/1000-freebsd_rules.xml
These decoders and rules are used for extract /var/log/userlog entries from
FreeBSD agents. It is necessary add a localfile entry to /var/ossec/etc/ossec.conf
<localfile>
<log_format>syslog</log_format>
<location>/var/log/userlog</location>
</localfile>
7) Add Wazuh manager to /etc/rc.conf
# sysrc wazuh_manager_enable="YES"
or
# service wazuh-manager enable
8) Start Wazuh manager
# service wazuh-manager start
9) Enjoy it ;)
security/wazuh-*: Update to 4.5.3
- security/wazuh-agent: Enable INOTIFY option by default. It enables Kevent
based real time monitoring. See some examples like use it at:
https://wazuh.com/blog/detecting-common-linux-persistence-techniques-with-wazuh/
- security/wazuh-manager: Add entries to pkg-message.in about FreeBSD SCA files
and FreeBSD decoders and rules files. I'll maintain update versions of these
files at https://github.com/alonsobsd/wazuh-freebsd
- security/wazuh-dashboard: Update project url to new one
- Othe minor modifications
(cherry picked from commit 45aab66eae1a9ebbfae9525805454f9e9fbadc41)
