Wazuh SIEM Kurulumu: Güvenlik Bilgi ve Olay Yönetimi

Wazuh, açık kaynaklı bir güvenlik platformudur. SIEM (Security Information and Event Management), IDS (Intrusion Detection System), güvenlik açığı tarama, dosya bütünlüğü izleme ve uyumluluk denetimi gibi kapsamlı güvenlik özelliklerini tek bir platformda sunar.

Wazuh Nedir?

Wazuh'un temel bileşenleri ve özellikleri:

Wazuh Server: Merkezi yönetim ve analiz sunucusu
Wazuh Indexer: OpenSearch tabanlı log indeksleme ve arama
Wazuh Dashboard: Kibana tabanlı web arayüzü
Wazuh Agent: Endpoint'lerde çalışan hafif ajan
Log Analizi: Gerçek zamanlı log toplama ve analiz
FIM (File Integrity Monitoring): Dosya bütünlüğü izleme
Vulnerability Detection: Güvenlik açığı tarama
Compliance: PCI DSS, GDPR, HIPAA uyumluluk denetimi
Active Response: Otomatik tehdit yanıtı
Cloud Security: AWS, Azure, GCP güvenlik izleme

Docker ile Kurulum

Tek Komutla Kurulum

hljs bash

# Wazuh Docker ortamını klonla
git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0
cd wazuh-docker/single-node

# SSL sertifikaları oluştur
docker compose -f generate-indexer-certs.yml run --rm generator

# Wazuh stack'ini başlat
docker compose up -d

Dashboard erişimi:

https://SUNUCU_IP:443
Kullanıcı: admin
Şifre: SecretPassword

Docker Compose Yapılandırması

hljs yaml

# docker-compose.yml (single-node)
version: '3.7'
services:
  wazuh.manager:
    image: wazuh/wazuh-manager:4.9.0
    container_name: wazuh-manager
    hostname: wazuh.manager
    restart: always
    ports:
      - "1514:1514"     # Agent bağlantısı
      - "1515:1515"     # Agent kayıt
      - "514:514/udp"   # Syslog
      - "55000:55000"   # API
    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
      - wazuh_etc:/var/ossec/etc
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
      - wazuh_var_multigroups:/var/ossec/var/multigroups
      - wazuh_integrations:/var/ossec/integrations
      - wazuh_active_response:/var/ossec/active-response/bin
      - wazuh_agentless:/var/ossec/agentless
      - wazuh_wodles:/var/ossec/wodles
      - filebeat_etc:/etc/filebeat
      - filebeat_var:/var/lib/filebeat
    environment:
      - INDEXER_URL=https://wazuh.indexer:9200
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - FILEBEAT_SSL_VERIFICATION_MODE=full

  wazuh.indexer:
    image: wazuh/wazuh-indexer:4.9.0
    container_name: wazuh-indexer
    hostname: wazuh.indexer
    restart: always
    ports:
      - "9200:9200"
    volumes:
      - wazuh-indexer-data:/var/lib/wazuh-indexer
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"

  wazuh.dashboard:
    image: wazuh/wazuh-dashboard:4.9.0
    container_name: wazuh-dashboard
    hostname: wazuh.dashboard
    restart: always
    ports:
      - "443:5601"
    environment:
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - WAZUH_API_URL=https://wazuh.manager
      - DASHBOARD_USERNAME=kibanaserver
      - DASHBOARD_PASSWORD=kibanaserver
      - API_USERNAME=wazuh-wui
      - API_PASSWORD=MyS3cr37P450r.*-
    volumes:
      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
    depends_on:
      - wazuh.indexer

volumes:
  wazuh_api_configuration:
  wazuh_etc:
  wazuh_logs:
  wazuh_queue:
  wazuh_var_multigroups:
  wazuh_integrations:
  wazuh_active_response:
  wazuh_agentless:
  wazuh_wodles:
  filebeat_etc:
  filebeat_var:
  wazuh-indexer-data:

Agent Kurulumu

Linux Agent

hljs bash

# Wazuh repository ekle
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

# Agent kur
sudo apt update
sudo WAZUH_MANAGER='WAZUH_SERVER_IP' apt install wazuh-agent -y

# Agent başlat
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent
sudo systemctl status wazuh-agent

Windows Agent

hljs powershell

# PowerShell ile kurulum
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi -OutFile wazuh-agent.msi
msiexec.exe /i wazuh-agent.msi /q WAZUH_MANAGER='WAZUH_SERVER_IP' WAZUH_REGISTRATION_SERVER='WAZUH_SERVER_IP'

# Servisi başlat
NET START WazuhSvc

Agent Yönetimi

hljs bash

# Agent listesi
sudo /var/ossec/bin/agent_control -l

# Agent durumu
sudo /var/ossec/bin/agent_control -i AGENT_ID

# Agent'ı yeniden başlat
sudo /var/ossec/bin/agent_control -R AGENT_ID

# API ile agent listesi
curl -k -X GET "https://localhost:55000/agents?pretty=true" \
  -H "Authorization: Bearer $(curl -k -X POST 'https://localhost:55000/security/user/authenticate' \
  -u wazuh-wui:MyS3cr37P450r.*- | jq -r '.data.token')"

Log Analizi

Syslog Toplama

hljs xml

<!-- /var/ossec/etc/ossec.conf -->
<ossec_config>
  <remote>
    <connection>syslog</connection>
    <port>514</port>
    <protocol>udp</protocol>
    <allowed-ips>192.168.1.0/24</allowed-ips>
  </remote>
</ossec_config>

Özel Log Dosyası İzleme

hljs xml

<!-- Agent ossec.conf -->
<ossec_config>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/myapp/app.log</location>
  </localfile>

  <localfile>
    <log_format>json</log_format>
    <location>/var/log/myapp/access.json</location>
  </localfile>

  <localfile>
    <log_format>multi-line:3</log_format>
    <location>/var/log/myapp/error.log</location>
  </localfile>
</ossec_config>

Özel Decoder ve Kural

hljs xml

<!-- /var/ossec/etc/decoders/local_decoder.xml -->
<decoder name="myapp">
  <program_name>myapp</program_name>
</decoder>

<decoder name="myapp-auth">
  <parent>myapp</parent>
  <regex>Authentication (\S+) for user (\S+) from (\S+)</regex>
  <order>status, user, srcip</order>
</decoder>

hljs xml

<!-- /var/ossec/etc/rules/local_rules.xml -->
<group name="myapp,">
  <rule id="100001" level="5">
    <decoded_as>myapp-auth</decoded_as>
    <match>Authentication failed</match>
    <description>MyApp: Başarısız giriş denemesi</description>
  </rule>

  <rule id="100002" level="10" frequency="5" timeframe="120">
    <if_matched_sid>100001</if_matched_sid>
    <same_source_ip />
    <description>MyApp: Brute force saldırısı tespit edildi</description>
  </rule>
</group>

Dosya Bütünlüğü İzleme (FIM)

hljs xml

<!-- /var/ossec/etc/ossec.conf -->
<ossec_config>
  <syscheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
    <scan_on_start>yes</scan_on_start>

    <!-- İzlenecek dizinler -->
    <directories check_all="yes" realtime="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes" realtime="yes">/var/www/html</directories>
    <directories check_all="yes" report_changes="yes">/etc/nginx</directories>

    <!-- Hariç tutulacak dosyalar -->
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore type="sregex">.log$|.swp$</ignore>

    <!-- Windows dizinleri -->
    <directories check_all="yes" realtime="yes">C:\Windows\System32</directories>
  </syscheck>
</ossec_config>

Güvenlik Açığı Tarama

hljs xml

<!-- /var/ossec/etc/ossec.conf -->
<ossec_config>
  <vulnerability-detector>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <min_full_scan_interval>6h</min_full_scan_interval>
    <run_on_start>yes</run_on_start>

    <provider name="canonical">
      <enabled>yes</enabled>
      <os>focal</os>
      <os>jammy</os>
      <update_interval>1h</update_interval>
    </provider>

    <provider name="debian">
      <enabled>yes</enabled>
      <os>bullseye</os>
      <os>bookworm</os>
      <update_interval>1h</update_interval>
    </provider>

    <provider name="nvd">
      <enabled>yes</enabled>
      <update_interval>1h</update_interval>
    </provider>
  </vulnerability-detector>
</ossec_config>

Active Response

Otomatik tehdit yanıtı yapılandırması:

hljs xml

<!-- /var/ossec/etc/ossec.conf -->
<ossec_config>
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>100002</rules_id>
    <timeout>3600</timeout>
  </active-response>

  <active-response>
    <command>host-deny</command>
    <location>local</location>
    <level>10</level>
    <timeout>600</timeout>
  </active-response>
</ossec_config>

Uyumluluk Denetimi

Wazuh, çeşitli güvenlik standartlarına uyumluluk denetimi sağlar:

PCI DSS: Ödeme kartı endüstrisi veri güvenliği standardı
GDPR: Genel Veri Koruma Yönetmeliği
HIPAA: Sağlık sigortası taşınabilirlik ve hesap verebilirlik yasası
NIST 800-53: Federal bilgi sistemleri güvenlik kontrolleri
TSC SOC2: Hizmet organizasyonu kontrolleri

Dashboard'da Compliance sekmesinden uyumluluk raporlarını görüntüleyebilirsiniz.

Wazuh API

hljs bash

# Token al
TOKEN=$(curl -k -X POST 'https://localhost:55000/security/user/authenticate' \
  -u wazuh-wui:MyS3cr37P450r.*- | jq -r '.data.token')

# Agent listesi
curl -k -X GET "https://localhost:55000/agents?pretty=true" \
  -H "Authorization: Bearer $TOKEN"

# Güvenlik açıkları
curl -k -X GET "https://localhost:55000/vulnerability/AGENT_ID?pretty=true" \
  -H "Authorization: Bearer $TOKEN"

# FIM olayları
curl -k -X GET "https://localhost:55000/syscheck/AGENT_ID?pretty=true" \
  -H "Authorization: Bearer $TOKEN"

Güncelleme

hljs bash

# Docker güncelleme
cd wazuh-docker/single-node
docker compose down
docker compose pull
docker compose up -d

Yedekleme

hljs bash

# Wazuh verilerini yedekle
docker exec wazuh-manager tar -czf /tmp/wazuh-backup.tar.gz /var/ossec/etc /var/ossec/logs /var/ossec/queue
docker cp wazuh-manager:/tmp/wazuh-backup.tar.gz ./wazuh-backup-$(date +%Y%m%d).tar.gz

# Indexer verilerini yedekle
docker exec wazuh-indexer tar -czf /tmp/indexer-backup.tar.gz /var/lib/wazuh-indexer
docker cp wazuh-indexer:/tmp/indexer-backup.tar.gz ./indexer-backup-$(date +%Y%m%d).tar.gz

REXE sunucularınızda Wazuh SIEM kurarak kapsamlı güvenlik izleme, log analizi, güvenlik açığı tarama ve uyumluluk denetimi yapabilirsiniz. Agent tabanlı mimari sayesinde tüm sunucularınızı merkezi bir dashboard'dan yönetebilirsiniz.

Wazuh SIEM Kurulumu: Güvenlik Bilgi ve Olay Yönetimi

İçindekiler