diff --git a/README.md b/README.md index f720e31dc4908a6db5675d528464b522ef5d1258..5eebdaa46c5f5b779bce3e6e868a4ca4906e3d42 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,15 @@ In addition to Wazuh, ClamAV is also installed on agent machines. > Note: neither of these two files has to be changed for `security-monitoring` to work. You can (and should; in case of `.env`) leave them unchanged. -4. Create and provision VMs: +4. Set `evidence-collector` package version inside `/ansible/globals/globals.yml`: + + ``` + evidence_collector_version: 'latest' + ``` + + This can be left untouched or changed to a specific version of `evidence-collector`. + +5. Create and provision VMs: ``` $ make create provision @@ -185,6 +193,7 @@ Wazuh manager and Evidence collector should be installed on the same, clean mach | ---- | ---- | | `elasticsearch_host_ip` | IP of the machine running Elasticsearch (same as Wazuh manager). | | `wazuh_manager_ip` | IP of the machine running Wazuh manager. | + | `evidence_collector_version` | `evidence-collector` version that will be deployed. Can be left set to `latest`. | 6. Set custom resource ID mapping scheme used by `evidence-collector`. Change it in `/custom-provision/resource-id-map.json`. diff --git a/ansible/custom-integration/tasks/main.yml b/ansible/custom-integration/tasks/main.yml index e8a012072954f8ba8b813c486cf8be29c5fa3e47..85f2f7f547a4351abaaa510884a964eabcf3f624 100644 --- a/ansible/custom-integration/tasks/main.yml +++ b/ansible/custom-integration/tasks/main.yml @@ -14,7 +14,9 @@ shell: sed -i 's/\\[Service\\]/\\[Service\\]\nTimeoutStartSec=300/' /usr/lib/systemd/system/wazuh-manager.service become: yes when: "grep_timeout.rc > 0" - + args: + warn: false + - name: Restart wazuh-manager service: name: wazuh-manager diff --git a/ansible/globals/globals.yml b/ansible/globals/globals.yml index 307fa0a1a354f4b48b3d1d7d13e9aea735f73ea5..e06a4af3449b0bdc195e6bdf0c5457d0e3777b15 100644 --- a/ansible/globals/globals.yml +++ b/ansible/globals/globals.yml @@ -4,4 +4,5 @@ custom_integration_alert_level: 10 custom_integration_alert_format: 'json' elasticsearch_host_ip: '192.168.33.10' wazuh_manager_ip: '192.168.33.10' -wazuh_check_interval: 300 \ No newline at end of file +wazuh_check_interval: 300 # should be the same as variable inside .env +evidence_collector_version: 'latest' \ No newline at end of file diff --git a/ansible/provision-evidence-collector.yml b/ansible/provision-evidence-collector.yml index f0d5741e07d1d7f559c569f4ea530b5049f941f9..05a09bd72e345e8e8eefbc3cf13043bd2d107075 100644 --- a/ansible/provision-evidence-collector.yml +++ b/ansible/provision-evidence-collector.yml @@ -4,6 +4,7 @@ become: yes pre_tasks: - import_tasks: "{{ ansible_dir }}/docker/credentials/vars.yml" + - import_tasks: "{{ ansible_dir }}/globals/vars.yml" roles: - docker tasks: @@ -46,7 +47,7 @@ - name: Run Docker container docker_container: name: evidence-collector - image: "{{ docker_registry }}/medina/evidence-collector:latest" + image: "{{ docker_registry }}/medina/evidence-collector:{{ evidence_collector_version }}" state: started pull: yes restart_policy: always diff --git a/ansible/provision-managers.yml b/ansible/provision-managers.yml index d3295f8beeb1387520fac8d73c73ec86a0cbbb11..0a2faa1f97651578fde392d307fadbbf1749d926 100644 --- a/ansible/provision-managers.yml +++ b/ansible/provision-managers.yml @@ -13,18 +13,83 @@ - role: custom-integration vars: single_node: true - wazuh_manager_integrations: - - name: custom-integration - hook_url: "{{ custom_integration_hook }}" - alert_level: "{{ custom_integration_alert_level }}" - alert_format: "{{ custom_integration_alert_format }}" - wazuh_manager_config: - email_notification: "yes" minimum_master_nodes: 1 elasticsearch_node_master: true elasticsearch_network_host: "0.0.0.0" filebeat_node_name: node-1 filebeat_output_elasticsearch_hosts: "{{ elasticsearch_host_ip }}" + instances: + node1: + name: node-1 # Important: must be equal to elasticsearch_node_name. + ip: "{{ elasticsearch_host_ip }}" + # ossec.conf + wazuh_manager_integrations: + - name: custom-integration + hook_url: "{{ custom_integration_hook }}" + alert_level: "{{ custom_integration_alert_level }}" + alert_format: "{{ custom_integration_alert_format }}" + wazuh_manager_email_notification: "yes" + wazuh_manager_rootcheck: + frequency: "{{ wazuh_check_interval }}" + wazuh_manager_syscollector: + disable: 'no' + interval: "{{ wazuh_check_interval }}" + scan_on_start: 'yes' + hardware: 'yes' + os: 'yes' + network: 'yes' + packages: 'yes' + ports_no: 'yes' + processes: 'yes' + wazuh_manager_sca: + enabled: 'yes' + scan_on_start: 'yes' + interval: "{{ wazuh_check_interval }}s" + skip_nfs: 'yes' + day: '' + wday: '' + time: '' + wazuh_manager_syscheck: + disable: 'no' + frequency: "{{ wazuh_check_interval }}" + scan_on_start: 'yes' + auto_ignore: 'no' + ignore: + - /etc/mtab + - /etc/hosts.deny + - /etc/mail/statistics + - /etc/random-seed + - /etc/random.seed + - /etc/adjtime + - /etc/httpd/logs + - /etc/utmpx + - /etc/wtmpx + - /etc/cups/certs + - /etc/dumpdates + - /etc/svc/volatile + ignore_linux_type: + - '.log$|.swp$' + no_diff: + - /etc/ssl/private.key + directories: + - dirs: /etc,/usr/bin,/usr/sbin + checks: '' + - dirs: /bin,/sbin,/boot + checks: '' + auto_ignore_frequency: + frequency: 'frequency="10"' + timeframe: 'timeframe="3600"' + value: 'no' + skip_nfs: 'yes' + skip_dev: 'yes' + skip_proc: 'yes' + skip_sys: 'yes' + process_priority: 10 + max_eps: 100 + sync_enabled: 'yes' + sync_interval: "{{ wazuh_check_interval }}s" + sync_max_interval: '1h' + sync_max_eps: 10 wazuh_manager_vulnerability_detector: enabled: 'yes' interval: "{{ wazuh_check_interval }}" @@ -54,11 +119,39 @@ update_from_year: '2010' update_interval: "{{ wazuh_check_interval }}" name: '"nvd"' - instances: - node1: - name: node-1 # Important: must be equal to elasticsearch_node_name. - ip: "{{ elasticsearch_host_ip }}" tasks: + # agent.conf + - name: Install python3.6 + package: + name: python36 + state: present + - name: Install lxml python package + pip: + name: lxml + executable: pip3 + - name: Edit agent.conf - add attribute to agent_config + xml: + path: /var/ossec/etc/shared/default/agent.conf + xpath: /agent_config + attribute: os + value: "Linux" + - name: Edit agent.conf - add syscheck config + xml: + path: /var/ossec/etc/shared/default/agent.conf + xpath: /agent_config/syscheck/frequency + value: "{{ wazuh_check_interval | string }}" + - name: Edit agent.conf - add rootcheck config + xml: + path: /var/ossec/etc/shared/default/agent.conf + xpath: /agent_config/rootcheck/frequency + value: "{{ wazuh_check_interval | string }}" + - name: Edit agent.conf - remove <?xml> + lineinfile: + dest: /var/ossec/etc/shared/default/agent.conf + regexp: "^<[?]xml .*[?]>" + state: absent + - name: Verify agent.conf + command: /var/ossec/bin/verify-agent-conf - name: Install firewalld action: yum name=firewalld state=installed - name: Enable firewalld on system reboot diff --git a/custom-provision/.env b/custom-provision/.env index f4ee6b4aca099d9579db6a2876ceac59f216e8e0..b895fc5826459dddfdcb1909bf6041985134459f 100644 --- a/custom-provision/.env +++ b/custom-provision/.env @@ -15,4 +15,5 @@ clouditor_port=9090 clouditor_oauth2_port=8080 clouditor_client_id=clouditor clouditor_client_secret=clouditor -wazuh_check_interval=300 \ No newline at end of file +wazuh_check_interval=300 +wazuh_rule_level=10 \ No newline at end of file diff --git a/environments/full-setup/.env b/environments/full-setup/.env index 6807497239268b89548c60c58072abb408cab028..1145270ea8b11e296abffe016b8dbc6baf3b399f 100644 --- a/environments/full-setup/.env +++ b/environments/full-setup/.env @@ -15,4 +15,5 @@ clouditor_port=9090 clouditor_oauth2_port=8080 clouditor_client_id=clouditor clouditor_client_secret=clouditor -wazuh_check_interval=300 \ No newline at end of file +wazuh_check_interval=300 +wazuh_rule_level=10 \ No newline at end of file