إعداد Wazuh SIEM: إدارة معلومات وأحداث الأمان

git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0
cd wazuh-docker/single-node
docker compose -f generate-indexer-certs.yml run --rm generator
docker compose up -d

https://عنوان_IP_الخادم:443
اسم المستخدم: admin
كلمة المرور: SecretPassword

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

sudo apt update
sudo WAZUH_MANAGER='عنوان_IP_خادم_WAZUH' apt install wazuh-agent -y
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi -OutFile wazuh-agent.msi
msiexec.exe /i wazuh-agent.msi /q WAZUH_MANAGER='عنوان_IP_خادم_WAZUH'
NET START WazuhSvc

sudo /var/ossec/bin/agent_control -l
sudo /var/ossec/bin/agent_control -i AGENT_ID

<ossec_config>
  <remote>
    <connection>syslog</connection>
    <port>514</port>
    <protocol>udp</protocol>
    <allowed-ips>192.168.1.0/24</allowed-ips>
  </remote>
</ossec_config>

<ossec_config>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/myapp/app.log</location>
  </localfile>
  <localfile>
    <log_format>json</log_format>
    <location>/var/log/myapp/access.json</location>
  </localfile>
</ossec_config>

<decoder name="myapp">
  <program_name>myapp</program_name>
</decoder>

<decoder name="myapp-auth">
  <parent>myapp</parent>
  <regex>Authentication (\S+) for user (\S+) from (\S+)</regex>
  <order>status, user, srcip</order>
</decoder>

<group name="myapp,">
  <rule id="100001" level="5">
    <decoded_as>myapp-auth</decoded_as>
    <match>Authentication failed</match>
    <description>MyApp: محاولة تسجيل دخول فاشلة</description>
  </rule>

  <rule id="100002" level="10" frequency="5" timeframe="120">
    <if_matched_sid>100001</if_matched_sid>
    <same_source_ip />
    <description>MyApp: تم اكتشاف هجوم brute force</description>
  </rule>
</group>

<ossec_config>
  <syscheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
    <scan_on_start>yes</scan_on_start>
    <directories check_all="yes" realtime="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes" realtime="yes">/var/www/html</directories>
    <ignore>/etc/mtab</ignore>
    <ignore type="sregex">.log$|.swp$</ignore>
  </syscheck>
</ossec_config>

<ossec_config>
  <vulnerability-detector>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <run_on_start>yes</run_on_start>
    <provider name="canonical">
      <enabled>yes</enabled>
      <os>focal</os>
      <os>jammy</os>
    </provider>
    <provider name="nvd">
      <enabled>yes</enabled>
      <update_interval>1h</update_interval>
    </provider>
  </vulnerability-detector>
</ossec_config>

<ossec_config>
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>100002</rules_id>
    <timeout>3600</timeout>
  </active-response>
</ossec_config>

TOKEN=$(curl -k -X POST 'https://localhost:55000/security/user/authenticate' \
  -u wazuh-wui:MyS3cr37P450r.*- | jq -r '.data.token')

curl -k -X GET "https://localhost:55000/agents?pretty=true" \
  -H "Authorization: Bearer $TOKEN"

# التحديث
cd wazuh-docker/single-node
docker compose down
docker compose pull
docker compose up -d

# النسخ الاحتياطي
docker exec wazuh-manager tar -czf /tmp/wazuh-backup.tar.gz /var/ossec/etc /var/ossec/logs
docker cp wazuh-manager:/tmp/wazuh-backup.tar.gz ./wazuh-backup-$(date +%Y%m%d).tar.gz