diff --git a/source/_static/js/redirects.js b/source/_static/js/redirects.js index 00be37c7aa..ee884a6cac 100644 --- a/source/_static/js/redirects.js +++ b/source/_static/js/redirects.js @@ -218,6 +218,26 @@ redirections.push( '4.8': '/migration-guide/files-backup/restoring/wazuh-central-components.html', '4.9': '/migration-guide/restoring/wazuh-central-components.html', }, + { + 'target': ['4.8=>4.9', '4.9=>4.8'], + '4.8': '/cloud-security/azure/activity-services/entra/graph.html', + '4.9': '/cloud-security/azure/graph.html', + }, + { + 'target': ['4.8=>4.9', '4.9=>4.8'], + '4.8': '/cloud-security/azure/activity-services/entra/index.html', + '4.9': '/cloud-security/azure/graph.html#microsoft-entra-id-use-case', + }, + { + 'target': ['4.8=>4.9'], + '4.8': '/cloud-security/azure/activity-services/index.html', + '4.9': '/cloud-security/azure/index.html', + }, + { + 'target': ['4.8=>4.9'], + '4.8': '/cloud-security/azure/activity-services/prerequisites/considerations.html', + '4.9': '/cloud-security/azure/platform-and-services.html#prerequisites', + }, ); /* Pages added in 4.9 */ @@ -258,6 +278,8 @@ newUrls['4.9'] = [ '/migration-guide/restoring/wazuh-central-components.html', '/cloud-security/amazon/services/prerequisites/aws-policy.html', '/cloud-security/amazon/services/prerequisites/iam-identities.html', + '/cloud-security/azure/graph.html', + '/cloud-security/azure/platform-and-services.html', ]; /* Pages no longer available in 4.9 */ @@ -302,6 +324,10 @@ removedUrls['4.9'] = [ '/migration-guide/files-backup/restoring/index.html', '/migration-guide/files-backup/restoring/wazuh-agent.html', '/migration-guide/files-backup/restoring/wazuh-central-components.html', + '/cloud-security/azure/activity-services/entra/graph.html', + '/cloud-security/azure/activity-services/entra/index.html', + '/cloud-security/azure/activity-services/index.html', + '/cloud-security/azure/activity-services/prerequisites/considerations.html', ]; /* *** RELEASE 4.8 ****/ diff --git a/source/_templates/cloud/notes.rst b/source/_templates/cloud/notes.rst index 6e1d3957f4..5be637359e 100644 --- a/source/_templates/cloud/notes.rst +++ b/source/_templates/cloud/notes.rst @@ -1,6 +1,6 @@ .. Copyright (C) 2015 Wazuh, Inc. -You can configure the integration with |service| either in the Wazuh manager or in a Wazuh agent. This choice depends solely on how you access your |service| infrastructure in your environment. +You can configure the Wazuh module for |service| either in the Wazuh manager or in a Wazuh agent. This choice depends solely on how you access your |service| infrastructure in your environment. You only need to install dependencies when configuring the integration with |service| in a Wazuh agent. The Wazuh manager already includes all the necessary dependencies. diff --git a/source/_templates/cloud/pip_installation.rst b/source/_templates/cloud/pip_installation.rst index 36c0ee6dae..e6e935c1be 100644 --- a/source/_templates/cloud/pip_installation.rst +++ b/source/_templates/cloud/pip_installation.rst @@ -51,5 +51,4 @@ If your pip version is less than 19.3, run the following command to upgrade the To prevent the modification, you can run ``pip3 install --upgrade pip`` within a virtual environment. You must update the shebang of the |module_script| Python script with the interpreter in your virtual environment. For example, ``#!/path/to/your/virtual/environment/bin/python3``. - .. End of include file diff --git a/source/_templates/cloud/python_installation.rst b/source/_templates/cloud/python_installation.rst index 588734ca7a..3460d454b4 100644 --- a/source/_templates/cloud/python_installation.rst +++ b/source/_templates/cloud/python_installation.rst @@ -1,6 +1,6 @@ .. Copyright (C) 2015 Wazuh, Inc. -The Wazuh module for |service| requires `Python 3 `__. Specifically, it's compatible with Python |py_cloud_cont_min|–|py_cloud_cont_max|. While later Python versions should work as well, we can't assure they are compatible. If you do not have Python 3 already installed, run the following command to install it on the endpoint where the Wazuh agent is installed. +The Wazuh module for |service| is compatible with Python |py_cloud_cont_min|–|py_cloud_cont_max|. While later `Python versions `__ should work as well, we can't assure they are compatible. If you do not have Python 3 already installed, run the following command on your monitored endpoint. .. tabs:: diff --git a/source/cloud-security/azure/activity-services/entra/graph.rst b/source/cloud-security/azure/activity-services/entra/graph.rst deleted file mode 100644 index b0eacca5f6..0000000000 --- a/source/cloud-security/azure/activity-services/entra/graph.rst +++ /dev/null @@ -1,200 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Learn how the Wazuh Azure module works in conjunction with the Microsoft Graph REST API in this section of the documentation. - -.. _azure_graph: - -Using Microsoft Graph -===================== - -Learn how to configure an application from the Microsoft Azure portal to be able to use the `Microsoft Graph REST API`. In this section you will find: - -- `Azure configuration`_ -- `Wazuh configuration`_ -- `Microsoft Graph use case`_ - -In order to know how the Wazuh Azure module works in conjunction with the `Microsoft Graph REST API`, it is important to understand first what are the Microsoft Entra ID activity reports and what kind of information they provide. Wazuh can process the logs from the following Microsoft Entra ID activity reports, each one of them requiring a different query to be executed: - -+---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ -| **Report type** | **Query** | -+---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ -| `Directory audits `_ | ``auditLogs/directoryaudits`` | -+---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ -| `Sign-ins `_ | ``auditLogs/signIns`` | -+---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ -| `Provisioning `_ | ``auditLogs/provisioning`` | -+---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ - - -Azure configuration -------------------- - -Creating the application -^^^^^^^^^^^^^^^^^^^^^^^^ - -This section explains the creation of an application that will use the Azure Log Analytics REST API. It is also possible to configure an existing application. If this is the case, skip this step. - -In the **Microsoft Entra ID** panel, select the option **App registrations**. Then, select **New registration**. - -.. thumbnail:: /images/cloud-security/azure/graph-1.png - :title: Log Analytics App - :align: center - :width: 100% - -Giving permissions to the application -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -#. Go to the **Overview** section and save the **Application (client) ID** for later authentication. - - .. thumbnail:: /images/cloud-security/azure/graph-2.png - :title: AAD - :align: center - :width: 75% - -#. Go to the **API permissions** section and select the **Add a permission** option. - - .. thumbnail:: /images/cloud-security/azure/graph-3.png - :title: AAD - :align: center - :width: 100% - -#. Select the API by searching for "Microsoft Graph". - - .. thumbnail:: /images/cloud-security/azure/graph-4.png - :title: AAD - :align: center - :width: 100% - -#. Select the permissions in **Applications permissions** that adapt to our infrastructure. In this case, **AuditLog** permissions will be granted. Then, click **Add permissions**. - - .. thumbnail:: /images/cloud-security/azure/graph-5.png - :title: AAD - :align: center - :width: 100% - -#. Grant admin consent for the tenant domain used for the permission added in the previous step. This must be done by an admin user. - - .. thumbnail:: /images/cloud-security/azure/graph-6.png - :title: AAD - :align: center - :width: 100% - - .. thumbnail:: /images/cloud-security/azure/graph-7.png - :title: AAD - :align: center - :width: 100% - -Obtaining the application key for authentication -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Select **Certificates & secrets** and fill in the **Description** and **Expires** fields. Copy the **value** once the key is saved. This is required to authenticate the application in order to use the Log Analytics API. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-create-key.png - :title: Log Analytics App - :align: center - :width: 100% - -.. thumbnail:: /images/cloud-security/azure/log-analytics-key-created.png - :title: Log Analytics App - :align: center - :width: 100% - - -Wazuh configuration -------------------- - -azure-logs module configuration -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Proceed with configuring the ``azure-logs`` module in the local configuration (``ossec.conf``). The `key and ID of the application` saved during the previous steps will be used here. In this case, both fields were saved in a `file` for authentication. - -Here is an example of how to get the audit log of the Microsoft Entra ID using Microsoft Graph. This example configuration includes a representative ``tag`` and is scheduled for every Monday at 02:00, using an offset of one day, which means only the log data from the last day is parsed: - -.. code-block:: xml - - - - no - Monday - - no - - - - /var/ossec/wodles/azure/credentials - wazuh.onmicrosoft.com - - - microsoft-entra_id - auditLogs/directoryAudits - 1d - - - - - - -Check the :doc:`azure-logs ` module reference for more information about how to use the different parameters available. - -.. note:: If an authentication file is used, as in this example, its content must follow the format ``field = value``. Here is an example of this format: - - .. code-block:: none - - application_id = 317...764 - application_key = wUj...9cj - -.. warning:: The field ``tenantdomain`` is mandatory. It can be obtained from the **Overview** section in Microsoft Entra ID. - -Microsoft Graph use case ------------------------- - -Here is an example of monitoring Microsoft Entra ID activity using the configuration described above. - -Wazuh Rules -^^^^^^^^^^^ - -In this example, the records are in ``.json`` format. The following rules are already included in Wazuh which means alerts will be generated for the logs in this example. - -.. code-block:: xml - - - json - azure-ad-graph - Azure: AD $(activity) - - -Create a new user -^^^^^^^^^^^^^^^^^ - -Create a new user in Azure. If the creation is successful, a log will be written to reflect it. This log can be retrieved using the ``auditLogs/directoryAudits`` query. - -.. thumbnail:: /images/cloud-security/azure/new-user.png - :title: AAD - :align: center - :width: 100% - -Azure portal visualization -^^^^^^^^^^^^^^^^^^^^^^^^^^ - -The resulting log from the user creation can be checked in the **Audit logs** section of Microsoft Entra ID. - -.. thumbnail:: /images/cloud-security/azure/portal-services.png - :title: AAD - :align: center - :width: 100% - -Wazuh dashboard visualization -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Once the integration is running, the results will be available in the Wazuh dashboard. - -.. thumbnail:: /images/cloud-security/azure/kibana-services-1.png - :title: AAD - :align: center - :width: 90% - -.. thumbnail:: /images/cloud-security/azure/kibana-services-2.png - :title: AAD - :align: center - :width: 80% diff --git a/source/cloud-security/azure/activity-services/entra/index.rst b/source/cloud-security/azure/activity-services/entra/index.rst deleted file mode 100644 index 7b20f5f576..0000000000 --- a/source/cloud-security/azure/activity-services/entra/index.rst +++ /dev/null @@ -1,26 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Discover the tools Wazuh provides to monitor Microsoft Entra ID in this section of the documentation. - -.. _azure_monitoring_services: - -Monitoring Microsoft Entra ID -============================= - -`Microsoft Entra ID `_ is the identity and directory management service that combines basic directory services, application access management, and identity protection in a single solution. The Wazuh ``azure-logs`` module requires dependencies to work as well as the right credentials to access the logs. Take a look at the :doc:`prerequisites ` section before proceeding. - -.. thumbnail:: /images/cloud-security/azure/aad-graph-intro.png - :title: AAD - :align: center - :width: 100% - -Wazuh is able to monitor the Microsoft Entra ID (ME-ID) service using the Activity reports provided by the `Microsoft Graph REST API `_. Microsoft Entra ID applications can make use of the Microsoft Graph API to perform read operations on directory data and objects. - - -.. topic:: Contents - - .. toctree:: - :maxdepth: 2 - - graph \ No newline at end of file diff --git a/source/cloud-security/azure/activity-services/index.rst b/source/cloud-security/azure/activity-services/index.rst deleted file mode 100644 index c39c7bca20..0000000000 --- a/source/cloud-security/azure/activity-services/index.rst +++ /dev/null @@ -1,27 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Discover how Wazuh can help you to monitor your Microsoft Azure activity and services in this section of our documentation. - -.. _azure_activity_services: - -Monitoring activity and services -================================ - -The Wazuh ``azure-logs`` module for Azure provides capabilities to monitor all the activity and the services of our infrastructure. - -From a wider perspective, the Microsoft Azure infrastructure resources can be divided into three types of logs: - -- `Activity logs` keep track of the operations performed on a resource from outside of the infrastructure. -- `Resource logs`, previously known as `Diagnostic logs`, provide insight into the operations performed within an Azure resource. -- `Microsoft Entra ID logs` contain the history of sign-in activity and audit information about the changes made to Microsoft Entra ID for a given tenant domain. - - -.. topic:: Contents - - .. toctree:: - :maxdepth: 2 - - prerequisites/index - services/index - entra/index diff --git a/source/cloud-security/azure/activity-services/prerequisites/considerations.rst b/source/cloud-security/azure/activity-services/prerequisites/considerations.rst deleted file mode 100644 index 06334744f5..0000000000 --- a/source/cloud-security/azure/activity-services/prerequisites/considerations.rst +++ /dev/null @@ -1,99 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Learn considerations for configuring multiple services with the Wazuh Azure module in this section of the Wazuh documentation. - -.. _azure_considerations: - -Considerations for configuration -================================ - -Reparse -------- - -.. warning:: - - Using the ``reparse`` option will fetch and process all the logs from the starting date until the present. This process may generate duplicate alerts. - -To fetch and process older logs, you need to manually run the module using the ``--reparse`` option. - -The ``la_time_offset`` value sets the time as an offset for the starting point. If you don't provide an ``la_time_offset`` value, the module goes back to the date of the first file processed. - -Find an example of running the module on a manager using the ``--reparse`` option. ``/var/ossec`` is the Wazuh installation path. - -.. code-block:: console - - # /var/ossec/wodles/azure/azure-logs --log_analytics --la_auth_path credentials_example --la_tenant_domain 'wazuh.example.domain' --la_tag azure-activity --la_query "AzureActivity" --workspace example-workspace --la_time_offset 50d --debug 2 --reparse - -The ``--debug 2`` parameter gets a verbose output. This is useful to show the script is working, specially when handling a large amount of data. - - -Configuring multiple services ------------------------------ - -It is possible to add more than one ``request`` block at the same time in the same configuration. Each request will be processed sequentially. Here is an example configuration: - -.. code-block:: xml - - - no - yes - - - /var/ossec/wodles/credentials/log_analytics_credentials - wazuh.onmicrosoft.com - - - azure-activity - AzureActivity | where SubscriptionId == 2d7...61d - d6b...efa - 36h - - - - azure-activity - AzureActivity | where SubscriptionId == 3f5...21g - d6b...efa - 2d - - - - - - /var/ossec/wodles/credentials/graph_credentials - wazuh.onmicrosoft.com - - - microsoft-entra_id-1 - auditLogs/directoryAudits - 1d - - - - microsoft-entra_id-2 - auditLogs/directoryAudits - 1d - - - - - - /var/ossec/wodles/credentials/storage_credentials - azure-activity - - - .json - json_inline - 24h - info-logs - - - - .txt - json_inline - 24h - info-logs - - - - \ No newline at end of file diff --git a/source/cloud-security/azure/activity-services/prerequisites/credentials.rst b/source/cloud-security/azure/activity-services/prerequisites/credentials.rst deleted file mode 100644 index 2e676aa39e..0000000000 --- a/source/cloud-security/azure/activity-services/prerequisites/credentials.rst +++ /dev/null @@ -1,182 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Learn what you need to provide access credentials to the Wazuh Azure module so it can successfully connect to Azure in this section of the Wazuh documentation. - -Configuring Azure credentials -============================= - -It is necessary to provide access credentials to the Wazuh Azure module so it can successfully connect to Azure. The credentials required vary depending on the type of monitoring. - - -.. _graph_and_log_analytics_credentials: - -Getting access credentials for Microsoft Graph and Log Analytics ----------------------------------------------------------------- -For :doc:`Microsoft Graph ` and :doc:`Log Analytics ` valid ``application_id`` and ``application_key`` values are required. The necessary ``application_key`` value for a given **App Registration** in **Microsoft Entra ID** can be obtained from the **Certificates & secrets** section while the ``application_id`` can be obtained from the **Overview** section: - -.. thumbnail:: /images/cloud-security/azure/log-analytics-create-key.png - :title: Log Analytics App - :align: center - :width: 100% - -.. thumbnail:: /images/cloud-security/azure/log-analytics-key-created.png - :title: Log Analytics App - :align: center - :width: 100% - - -Getting access credentials for Storage --------------------------------------- -:doc:`Azure Storage ` requires valid ``account_name`` and ``account_key`` values. They can be obtained in the **Access keys** section of **Storage accounts**: - -.. thumbnail:: /images/cloud-security/azure/account-credentials.png - :title: Storage - :align: center - :width: 100% - - -Authentication options ----------------------- - -There are two different ways to set up the Azure authentication: - -Using an authentication file -^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -It is possible to store the credentials in a file for authentication as long as the file content follows the `field = value` format explained below. - -The fields expected to be present in the credentials file will change depending on the type of service or activity to be monitored. - -.. rubric:: Microsoft Graph and Log Analytics - :class: h5 - -The file must contain only two lines, one for the application ID and another one for the application key obtained previously. - -.. code-block:: none - - application_id = - application_key = - -.. rubric:: Storage - :class: h5 - -The file must contain only two lines, one for the account name and the other one for the account key obtained previously: - -.. code-block:: none - - account_name = - account_key = - - -Regardless of the service or activity to be monitored, the authentication file is always specified in the ``ossec.conf`` configuration file using the ```` tag. Take a look at the following example: - -.. code-block:: none - :emphasize-lines: 6, 17, 27 - - - no - yes - - - /var/ossec/wodles/credentials/log_analytics_credentials - - wazuh.onmicrosoft.com - - AzureActivity - d6b...efa - 1d - - - - - /var/ossec/wodles/credentials/graph_credentials - - wazuh.onmicrosoft.com - - auditLogs/directoryAudits - 1d - - - - - /var/ossec/wodles/credentials/storage_credentials - - - .json - json_inline - 24h - - - - - -Check the :doc:`azure-logs wodle ` section from the ossec.conf reference page for more information about the ```` and other available parameters. - - -Inserting the credentials into the configuration -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. deprecated:: 4.4.0 - -Another authentication option is to set up credentials by storing them directly into the Wazuh configuration file ``/var/ossec/etc/ossec.conf``, inside of the ````, ```` and ```` blocks on the module configuration. - -The tags to use are different depending on the type of service or activity to be monitored: - -.. rubric:: Microsoft Graph and Log Analytics - :class: h5 - -.. code-block:: none - :emphasize-lines: 6, 7, 18, 19 - - - no - yes - - - 8b7...c14 - w22...91x - - wazuh.onmicrosoft.com - - AzureActivity - d6b...efa - 1d - - - - - 8b7...c14 - w22...91x - - wazuh.onmicrosoft.com - - auditLogs/directoryAudits - 1d - - - - -.. rubric:: Storage - :class: h5 - -.. code-block:: none - :emphasize-lines: 6, 7 - - - no - yes - - - exampleaccountname - w22...91x - - - .json - json_inline - 24h - - - - -Take a look at the :doc:`azure-logs wodle ` entry from the ``ossec.conf`` reference page for more information about the parameters. diff --git a/source/cloud-security/azure/activity-services/prerequisites/dependencies.rst b/source/cloud-security/azure/activity-services/prerequisites/dependencies.rst deleted file mode 100644 index f6f22774f2..0000000000 --- a/source/cloud-security/azure/activity-services/prerequisites/dependencies.rst +++ /dev/null @@ -1,48 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Learn about the required dependencies for using the AZURE integration in a Wazuh agent. - -Installing dependencies -======================= - -.. |service| replace:: Azure - -.. include:: /_templates/cloud/notes.rst - -Python ------- - -.. |py_cloud_cont_min| replace:: |PYTHON_CLOUD_CONTAINERS_MIN| -.. |py_cloud_cont_max| replace:: |PYTHON_CLOUD_CONTAINERS_MAX| - -.. include:: /_templates/cloud/python_installation.rst - -.. |module_script| replace:: ``/var/ossec/wodles/azure/azure-logs`` - -.. include:: /_templates/cloud/pip_installation.rst - -Azure Storage client library for Python ---------------------------------------- - -`Azure Storage Blobs client library `_ is the official Python library for Microsoft's Azure Blob storage. - -To install the dependencies, execute the following command: - -.. tabs:: - - .. group-tab:: Python 3.8–3.10 - - .. code-block:: console - - # pip3 install azure-storage-blob==12.20.0 azure-storage-common==2.1.0 azure-common==1.1.25 cryptography==3.3.2 cffi==1.14.4 pycparser==2.20 six==1.14.0 python-dateutil==2.8.1 requests==2.25.1 certifi==2022.12.07 chardet==3.0.4 idna==2.9 urllib3==1.26.18 SQLAlchemy==2.0.23 pytz==2020.1 - - .. group-tab:: Python 3.11–3.12 - - .. code-block:: console - - # pip3 install --break-system-packages azure-storage-blob==12.20.0 azure-storage-common==2.1.0 azure-common==1.1.25 cryptography==3.3.2 cffi==1.14.4 pycparser==2.20 six==1.14.0 python-dateutil==2.8.1 requests==2.25.1 certifi==2022.12.07 chardet==3.0.4 idna==2.9 urllib3==1.26.18 SQLAlchemy==2.0.23 pytz==2020.1 - - .. note:: - - If you're using a virtual environment, remove the ``--break-system-packages`` parameter from the command above. diff --git a/source/cloud-security/azure/activity-services/prerequisites/index.rst b/source/cloud-security/azure/activity-services/prerequisites/index.rst deleted file mode 100644 index 2a80795276..0000000000 --- a/source/cloud-security/azure/activity-services/prerequisites/index.rst +++ /dev/null @@ -1,20 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Learn what you need to install and configure the Wazuh module to monitor Azure activity and services in this section of the Wazuh documentation. - -.. _azure_prerequisites: - -Prerequisites -============= - -Install the dependencies required by this module and set the credentials to access the service. Check the `Considerations for configuration` section to learn more about configuring multiple services. - -.. topic:: Contents - - .. toctree:: - :maxdepth: 2 - - dependencies - credentials - considerations diff --git a/source/cloud-security/azure/activity-services/services/index.rst b/source/cloud-security/azure/activity-services/services/index.rst deleted file mode 100644 index bd4e1d6b3b..0000000000 --- a/source/cloud-security/azure/activity-services/services/index.rst +++ /dev/null @@ -1,23 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: The Azure Monitor Logs collects and organizes logs and performance data from monitored resources. Learn how to use Monitor Logs with Wazuh in this section. - -.. _azure_monitoring_activity: - -Monitoring Azure platform and services -====================================== - - -The `Azure Monitor Logs `_ collects and organizes logs and performance data from monitored resources, including Azure services, virtual machines, and applications. This insight can be sent to Wazuh using the `Azure Log Analytics REST API` or directly accessing the contents of an `Azure Storage` account. - -This section explains the two ways to proceed, looking at the steps to follow in the Microsoft Azure portal and using the ``azure-logs`` module on the Wazuh manager. The Wazuh ``azure-logs`` module requires dependencies as well as the right credentials to access the logs. Take a look at the :doc:`prerequisites ` section before proceeding. - - -.. topic:: Contents - - .. toctree:: - :maxdepth: 2 - - log-analytics - storage \ No newline at end of file diff --git a/source/cloud-security/azure/activity-services/services/log-analytics.rst b/source/cloud-security/azure/activity-services/services/log-analytics.rst deleted file mode 100644 index 8ef3410276..0000000000 --- a/source/cloud-security/azure/activity-services/services/log-analytics.rst +++ /dev/null @@ -1,230 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Azure Log Analytics is a service that monitors Azure infrastructures offering query capabilities. Learn how to use Log Analytics with Wazuh in this section. - -.. _azure_log_analytics: - -Using Azure Log Analytics -========================= - -`Azure Log Analytics `_ is a service that monitors your infrastructure offering query capabilities that allow you to perform advanced searches specific to your data. - -The Log Analytics solution helps you to analyze and search the Azure activity log in all your Azure subscriptions, providing information about the operations performed with the resources of your subscriptions. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-activity-send.png - :title: Microsoft Azure resources - :align: center - :width: 60% - -The data collected by Log Analytics can be consulted through the **Azure Log Analytics REST API**. The Azure Log Analytics API uses the Microsoft Entra ID authentication scheme. - -A qualified application or client is required to use the Azure Log Analytics REST API. This must be configured manually on the Microsoft Azure portal. - -- `Setting up the application`_ -- `Azure Log Analytics use case`_ - -Setting up the application ---------------------------- - -The process explained below details the creation of an application that will use the Azure Log Analytics REST API. It is also possible to configure an existing application. If this is the case, skip the **Creating the application** step. - -Creating the application -^^^^^^^^^^^^^^^^^^^^^^^^ - -In the **Microsoft Entra ID** panel, select the option **App registrations**. Then, select **New registration**. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-app-1.png - :title: Log Analytics App - :align: center - :width: 100% - -Giving permissions to the application -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -1. Go to the **Overview** section and save the **Application (client) ID** for later authentication. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-app-2.png - :title: Log Analytics App - :align: center - :width: 100% - -2. Go to the **API permissions** section and add the required permissions to the application. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-app-3.png - :title: Log Analytics App - :align: center - :width: 100% - -3. Search for the **Log Analytics API**. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-app-4.png - :title: Log Analytics App - :align: center - :width: 100% - -4. Select the **Read Log Analytics data** permission from **Applications permissions**. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-app-5.png - :title: Log Analytics App - :align: center - :width: 100% - -5. Grant admin consent for the tenant domain used for the permission added in the previous step. This must be done by an admin user. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-app-6.png - :title: Log Analytics App - :align: center - :width: 100% - - -Giving the application access to the Log Analytics API -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -#. Access **Log Analytics workspaces** and create a new workspace or choose an existing one. - - .. thumbnail:: /images/cloud-security/azure/log-analytics-workspace-1.png - :title: Log Analytics App - :align: center - :width: 100% - -#. In the **Overview** section, copy the ``Workspace Id`` value. The Wazuh configuration needs it to make requests to the API. - - .. thumbnail:: /images/cloud-security/azure/log-analytics-workspace-2.png - :title: Log Analytics App - :align: center - :width: 100% - -#. In the **Access control (IAM)** section, click **Add** and select **Add role assignment** to add the required role to the application. - - .. thumbnail:: /images/cloud-security/azure/log-analytics-workspace-3.png - :title: Log Analytics App - :align: center - :width: 100% - -#. In the **Role** tab, select the **Log Analytics Reader** role. - - .. thumbnail:: /images/cloud-security/azure/log-analytics-workspace-4.png - :title: Log Analytics App - :align: center - :width: 100% - -#. In the **Members** tab, select **User, group, or service principal** under **Assign access to**. Then, click **Select members** under **Members** and find the App registration created previously. - - .. thumbnail:: /images/cloud-security/azure/log-analytics-workspace-5.png - :title: Log Analytics App - :align: center - :width: 100% - -#. Click **Review + assign** to finish. - -Sending logs to the Workspace ------------------------------ - -To collect logs and send them to the Log Analytics Workspace created in the previous steps, you need to create a **diagnostic setting**. - -#. Go back to **Microsoft Entra ID**, scroll down on the left menu bar, and select the **Diagnostic settings** section. Click on **Add diagnostic setting**. - - .. thumbnail:: /images/cloud-security/azure/log-analytics-diagnostic-1.png - :title: Log Analytics App - :align: center - :width: 100% - -#. Choose the log categories you want to collect from, under **Logs Categories**. Check the **Send to Log Analytics workspace** option under **Destination details**. Select the Log Analytics Workspace you created in previous steps. - - .. thumbnail:: /images/cloud-security/azure/log-analytics-diagnostic-2.png - :title: Log Analytics App - :align: center - :width: 100% - -#. Click on **Save**. - -Now, Azure Log Analytics can stream new logs in the selected categories to your workspace. - -Obtaining the application key for authentication -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Wazuh requires valid credentials to pull logs from Log Analytics. Take a look at the :ref:`credentials ` section to learn how to generate a client secret so you can access the App registration. - - -Azure Log Analytics use case ----------------------------- - -Here is an example of monitoring the activity of the infrastructure using the previously mentioned Azure application. - -Creating a user -^^^^^^^^^^^^^^^ - -An easy way to test this is to create a new user in Microsoft Entra ID. A few minutes after the creation of the user, a new log will be available for Log Analytics reflecting this change. The log can be checked using the ``AuditLogs`` query, by accessing **Log Analytics** and running the ``AuditLogs`` query. - -.. thumbnail:: /images/cloud-security/azure/log-analytics-new-user.png - :title: Log Analytics App - :align: center - :width: 100% - -Wazuh configuration -^^^^^^^^^^^^^^^^^^^ - -Proceed with configuring the ``azure-logs`` module in the local configuration (``ossec.conf``). The `key and ID of the application` saved during the configuration of the application will be used here, as well as the `workspace ID`. In this case, both fields were saved in a `file` for authentication. Check the :doc:`credentials ` reference for more information about this topic. - -Through the following configuration, Wazuh is ready to search for any query accepted by Azure Log Analytics. This example configuration includes a representative ``tag`` and will be scheduled for every Monday at 02:00, using an offset of one day, which means only the log data from the last day will be parsed: - -.. code-block:: xml - - - no - no - - - /var/ossec/wodles/credentials/log_analytics_credentials - wazuh.onmicrosoft.com - - - azure-auditlogs - AuditLogs - d6b...efa - 1d - - - - - -Check the reference for more information about the :doc:`Azure module `. - -.. warning:: The field ``tenantdomain`` is mandatory. It can be obtained from the **Overview** section in Microsoft Entra ID. - -Wazuh Rules -^^^^^^^^^^^ - -The following rules are already included in Wazuh by default. With them, it it possible to monitor the infrastructure activity and get the related alerts. - -.. code-block:: xml - - - json - azure-log-analytics - Azure: Log analytics - - - - 87801 - AzureActivity - Azure: Log analytics activity - - - - 87810 - \.+ - Azure: Log analytics: $(OperationName) - - - -Alert visualization -^^^^^^^^^^^^^^^^^^^ - -Once the Wazuh configuration is set and the ``azure-logs`` module is running using the previous configuration, the event will be processed. The results can be checked in the Wazuh dashboard: - -.. thumbnail:: /images/cloud-security/azure/new-user-event.png - :title: Log Analytics App - :align: center - :width: 100% diff --git a/source/cloud-security/azure/activity-services/services/storage.rst b/source/cloud-security/azure/activity-services/services/storage.rst deleted file mode 100644 index ad01617a87..0000000000 --- a/source/cloud-security/azure/activity-services/services/storage.rst +++ /dev/null @@ -1,143 +0,0 @@ -.. Copyright (C) 2015, Wazuh, Inc. - -.. meta:: - :description: Azure Storage refers to the Microsoft Azure cloud storage solution. Learn how to use Azure Storage with Wazuh in this section of our documentation. - -.. _azure_storage: - -Using Azure Storage -=================== - -`Azure Storage `_ refers to the Microsoft Azure cloud storage solution, a service that provides a massively scalable object store for data objects, a messaging store for reliable messaging, a file system service for the cloud, and a NoSQL store. - -.. thumbnail:: /images/cloud-security/azure/storage-activity-log.png - :title: Storage - :align: center - :width: 60% - -As an alternative to the Azure Log Analytics REST API, Wazuh offers the possibility to access Azure Storage accounts in a simple way. The activity logs of the Microsoft Azure infrastructure can be exported to the storage accounts. - -This section explains how to use the Azure portal to archive the Azure activity log in a storage account and how to configure the ``azure-logs`` module. A use case is included to show a practical example. - - -Configuring the Activity log export ------------------------------------ - -#. Click **Activity log** in the **Monitor** service menu. You can type ``activity`` in the search bar to find the option. - - .. thumbnail:: /images/cloud-security/azure/storage-activity-4.png - :title: Storage - :align: center - :width: 80% - -#. Click **Export Activity logs**. - - .. thumbnail:: /images/cloud-security/azure/storage-activity-1.png - :title: Storage - :align: center - :width: 80% - -#. Click **Add diagnostic setting**. - - .. thumbnail:: /images/cloud-security/azure/storage-activity-2.png - :title: Storage - :align: center - :width: 80% - -#. Configure the following settings and click **Save**. - - - Tick **Administrative** checkbox. - - Tick the **Archive to a storage account** checkbox. - - Select your **Subscription**. - - Select your **Storage account**. - - .. thumbnail:: /images/cloud-security/azure/storage-activity-3.png - :title: Storage - :align: center - :width: 80% - -Azure Storage use case ----------------------- - -This is a basic example of how to monitor the activity of the infrastructure. A new user will be created, resulting in an Azure Activity Log that will be exported to Storage if the Activity Log export was configured successfully. - -Creating a user -^^^^^^^^^^^^^^^ - -An easy way to test this configuration is to create a new user in Microsoft Entra ID. A few minutes after the creation of the user, a new log will be available in a container named **insights-logs-auditlogs** inside the Storage account specified when configuring the Activity log export. - -.. thumbnail:: /images/cloud-security/azure/storage-new-user-1.png - :title: Storage - :align: center - :width: 80% - -.. thumbnail:: /images/cloud-security/azure/storage-new-user-2.png - :title: Storage - :align: center - :width: 80% - -Wazuh configuration -^^^^^^^^^^^^^^^^^^^ - -Proceed to configure the ``azure-logs`` module in the local configuration (``ossec.conf``). It is important to set the **account_name** and **account_key** of the Storage account to authenticate. This information can be found in the **Access keys** section of **Storage accounts**. Check the :doc:`credentials ` reference for more information about the different authentication options available. - -.. thumbnail:: /images/cloud-security/azure/account-credentials.png - :title: Storage - :align: center - :width: 80% - -Applying the following configuration, the integration will be executed every day using a credentials file for authentication. The ``insights-logs-auditlogs`` container content will be processed, downloading every blob available with the ``.json`` extension from the last ``24 hours``. The content for these blobs is expected to be in ``json_inline`` format. - -.. code-block:: xml - - - - no - 1d - yes - - - - /home/manager/Azure/storage_auth.txt - azure-activity - - - .json - json_inline - 24h - - - - - -Check the :doc:`Azure module ` reference page to learn more about the parameters available and how to use them. - -Wazuh rules -^^^^^^^^^^^ - -Thanks to the following rules, already included in the default Wazuh ruleset, it is possible to monitor the infrastructure activity and obtain related alerts: - -.. code-block:: xml - - - json - azure-storage - Azure: Storage - - - - 87803 - \.+ - Azure: Storage: $(OperationName) - - - -Alert visualization -^^^^^^^^^^^^^^^^^^^ - -Once the Wazuh configuration is set and the ``azure-logs`` module is running using the previous configuration, the event from the user creation example exported to Storage will be processed. The results can be checked in the Wazuh dashboard. - -.. thumbnail:: /images/cloud-security/azure/storage.png - :title: Storage - :align: center - :width: 80% \ No newline at end of file diff --git a/source/cloud-security/azure/graph.rst b/source/cloud-security/azure/graph.rst new file mode 100644 index 0000000000..a6fef069c8 --- /dev/null +++ b/source/cloud-security/azure/graph.rst @@ -0,0 +1,226 @@ +.. Copyright (C) 2015, Wazuh, Inc. + +.. meta:: + :description: In this section, you will learn how to monitor your Microsoft Entra ID activity using the Microsoft Graph REST API. + +Microsoft Graph +=============== + +In this section, you will learn how to monitor your Microsoft Entra ID activity using the Microsoft Graph REST API. This section contains: + +- :ref:`Azure configuration ` +- :ref:`Wazuh configuration ` +- :ref:`Microsoft Entra ID use case ` + +The following are endpoints in the Microsoft Graph REST API related to auditing and monitoring activities in Microsoft Entra ID. + ++---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ +| **Report type** | **Query** | ++---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ +| `Directory audits `_ | ``auditLogs/directoryaudits`` | ++---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ +| `Sign-ins `_ | ``auditLogs/signIns`` | ++---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ +| `Provisioning `_ | ``auditLogs/provisioning`` | ++---------------------------------------------------------------------------------------------------------------------------+-------------------------------+ + +These endpoints allow administrators and developers to monitor and audit activities within Microsoft Entra ID for security, compliance, and operational purposes. + +Wazuh can process Microsoft Entra ID activity reports using the above endpoints. Each one of them requires you to execute a different query. You will place these queries within the command block of your Wazuh module for Azure :ref:`configuration `. + +Configuration +------------- + +.. _azure_configuration: + +Azure +^^^^^ + +Creating the application +~~~~~~~~~~~~~~~~~~~~~~~~ + +This section explains creating an application using the Azure Log Analytics REST API. However, it is also possible to configure an existing application. If this is the case, skip this step. + +#. In the **Microsoft Entra ID** panel, select **App registrations**. Then, select **New registration**. + + .. thumbnail:: /images/cloud-security/azure/new-app-registration2.png + :align: center + :width: 80% + +#. Give the app a descriptive name, select the appropriate **account type**, and click **Register**. + + .. thumbnail:: /images/cloud-security/azure/register-application.png + :align: center + :width: 80% + +The app is now registered. + +.. thumbnail:: /images/cloud-security/azure/app-registrations.png + :align: center + :width: 80% + +Granting permissions to the application +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +#. Click on the application, go to the **Overview** section, and save the **Application (client) ID** for later authentication. + + .. thumbnail:: /images/cloud-security/azure/save-application-ID2.png + :align: center + :width: 80% + +#. Select the **Add a permission** option in the **API permissions** section. + + .. thumbnail:: /images/cloud-security/azure/add-api-permission2.png + :align: center + :width: 80% + +#. Search for *"Microsoft Graph"* and select the API. + + .. thumbnail:: /images/cloud-security/azure/select-microsoft-graph-api.png + :align: center + :width: 80% + +#. Select the permissions in **Applications permissions** that align with your infrastructure. In this case, ``AuditLog.Read.All`` permissions will be granted. Then, click **Add permissions**. + + .. thumbnail:: /images/cloud-security/azure/add-api-permissions.png + :align: center + :width: 80% + +#. Use an admin user to **Grant admin consent** for the tenant. + + .. thumbnail:: /images/cloud-security/azure/grant-admin-consent2.png + :align: center + :width: 80% + +Obtaining the application key for authentication +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +To use the Log Analytics API to retrieve the logs, we must generate an application key to authenticate the Log Analytics API. Follow the steps below to generate the application key. + +#. Select **Certificates & secrets**, then select **New client secret** to generate a key. + + .. thumbnail:: /images/cloud-security/azure/new-client-secret2.png + :align: center + :width: 80% + +#. Give an appropriate **description**, set a preferred duration for the key, and then click **Add**. + + .. thumbnail:: /images/cloud-security/azure/add-client-secret2.png + :align: center + :width: 80% + +#. Copy the key **value**. This would be later used for authentication. + + .. note:: + + Copy the key before exiting this page, as it will only be displayed once. If you do not copy it before exiting the page, you will have to generate a fresh key. + + .. thumbnail:: /images/cloud-security/azure/copy-client-secret3.png + :align: center + :width: 80% + +.. _wazuh_configuration: + +Wazuh server or agent +^^^^^^^^^^^^^^^^^^^^^ + +You will use the ``key`` and ``ID`` of the application saved during the previous steps here. In this case, both fields were saved in a file for authentication. Check the :ref:`configure_azure_credentials` section for more information about this topic. + +#. Apply the following configuration to the local configuration file ``/var/ossec/etc/ossec.conf`` of the Wazuh server or agent. This will depend on where you configured the Wazuh module for Azure: + + .. code-block:: xml + :emphasize-lines: 12 + + + no + Monday + + no + + + /var/ossec/wodles/azure/credentials + wazuh.com + + microsoft-entra_id + auditLogs/directoryAudits + 1d + + + + + + Where: + + - ```` is the full path of where the workspace secret key is stored. + - ```` is the tenant domain name. You can obtain this from the **Overview** section in Microsoft Entra ID + - ```` is the day of the week scheduled for the scan + - ```` is the path to where the audit logs are stored. + - ``