diff --git a/CHANGELOG.md b/CHANGELOG.md index abbc1cd38..8985d4ab5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file. - Added rules and decoders for macOS sshd logs ([#593](https://github.com/wazuh/wazuh-ruleset/pull/593)) - Added TSC/SOC compliance mapping ([#613](https://github.com/wazuh/wazuh-ruleset/pull/613)) - Added rules and decoders for PaloAlto logs ([#658](https://github.com/wazuh/wazuh-ruleset/pull/658)) +- Added groups for Wazuh-api rules ([#675](https://github.com/wazuh/wazuh-ruleset/pull/675)) ### Changed diff --git a/decoders/0520-wazuh-api_decoders.xml b/decoders/0520-wazuh-api_decoders.xml new file mode 100644 index 000000000..d10c0ad4a --- /dev/null +++ b/decoders/0520-wazuh-api_decoders.xml @@ -0,0 +1,68 @@ + + + + WazuhAPI + + + + + + wazuhapi + \d+-\d+-\d+ \d+:\d+:\d+ \S+: [\S+] \w+ \S+ - \d+ + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+): [(\S+)] (\w+) (\S+) - \d+ - error: '(\d+)' + timestamp,apiuser,remoteaddress,method,request,errorcode + + + + + + wazuhapi + + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+): (\.+): \d+ + timestamp,apiuser,exception_message + + + + + + wazuhapi + Listening on + (\d+-\d+-\d+ \d+:\d+:\d+) : Listening on: (\.+) + timestamp,apiurl + + + + + + + wazuhapi + Authentication failed + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+):\.+ Authentication failed + timestamp,apiuser + + + + + + + + wazuhapi + Address in use + (\d+-\d+-\d+ \d+:\d+:\d+) Error: Address in use \(port "(\d+)"\) + timestamp,port + + + + + + wazuhapi + Authentication error + (\d+-\d+-\d+ \d+:\d+:\d+) : [\.+] Authentication error: (\d+) - (\.+) + timestamp,auth_error,error_message + diff --git a/rules/0715-wazuh-api_rules.xml b/rules/0715-wazuh-api_rules.xml new file mode 100644 index 000000000..051ffc1de --- /dev/null +++ b/rules/0715-wazuh-api_rules.xml @@ -0,0 +1,198 @@ + + + + + + wazuhapi + + + + + + 66500 + ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: [(\S+)] \w+ \S+ - \d+ + Wazuh API request received. + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + + + 66501 + GET + Wazuh API GET request received. + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66502 + Wazuh API request $(method) $(request) with error code $(errorcode) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66503 + 0 + Wazuh API request $(method) $(request) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66501 + POST + Wazuh API request POST received. + + T1492 + + pci_dss_10.6.1,pci_dss_10.2.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.e + + + + 66505 + Wazuh API request $(method) $(request) with error code $(errorcode) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66505 + 0 + Wazuh API request $(method) $(request) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66501 + DELETE + Wazuh API request DELETE received. + + T1492 + + pci_dss_10.6.1,pci_dss_10.2.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.e + + + + 66508 + Wazuh API request $(method) $(request) got the error $(errorcode) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66508 + 0 + Wazuh API request $(method) $(request) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66501 + PUT + Wazuh API request PUT received. + + T1492 + + pci_dss_10.6.1,pci_dss_10.2.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.e + + + + 66511 + Wazuh API request $(method) $(request) got the error $(errorcode) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66511 + 0 + Wazuh API request $(method) $(request) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + + + + 66500 + ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: \.+: \d+ + An exception was given, the message is: $(exception_message) + pci_dss_10.6.1,pci_dss_10.6.3,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + + + 66500 + Authentication failed + Authentication with api from user $(apiuser) failed. + pci_dss_10.6.1,pci_dss_10.2.4,pci_dss_10.2.5,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.d,gdpr_IV_35.7.d,gdpr_IV_32.2, + + + + + 66500 + Authentication error + Authentication with api failed with the error $(auth_error) and the message: $(error_message). + pci_dss_10.6.1,pci_dss_10.2.4,pci_dss_10.2.5,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.d,gdpr_IV_35.7.d,gdpr_IV_32.2, + + + + + 66500 + Internal Error + Internal error detected in the API. + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + + 66517 + Internal Error: uncaughtException + Internal error detected in the API, an uncaught exception was thrown. + pci_dss_10.6.1,pci_dss_10.6.3,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + + 66500 + Exiting... + The API has just exited. + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + + + 66519 + Exiting... (SIGTERM) + The API has just exited. (SIGTERM) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66519 + Exiting... (SIGINT) + The API has just exited. (SIGINT) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + 66500 + Listening on + Api is hearing at $(apiurl) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + + 66500 + Address in use + Another instance is using the port $(port) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + + + diff --git a/tools/rules-testing/beforeruntest.sh b/tools/rules-testing/beforeruntest.sh new file mode 100755 index 000000000..67b92f349 --- /dev/null +++ b/tools/rules-testing/beforeruntest.sh @@ -0,0 +1,14 @@ +#!/bin/bash +WAZUH_MANAGER_DIR="/var/ossec" +WAZUH_REPO_DIR="/home/vagrant/wazuh-ruleset" +rm -rf ${WAZUH_MANAGER_DIR}/ruleset/rules/* +rm -rf ${WAZUH_MANAGER_DIR}/ruleset/decoders/* +cp -r ${WAZUH_REPO_DIR}/rules/* ${WAZUH_MANAGER_DIR}/ruleset/rules +cp -r ${WAZUH_REPO_DIR}/decoders/* ${WAZUH_MANAGER_DIR}/ruleset/decoders +chown -R root:ossec ${WAZUH_MANAGER_DIR}/ruleset/rules +chown -R root:ossec ${WAZUH_MANAGER_DIR}/ruleset/decoders +chmod 644 ${WAZUH_MANAGER_DIR}/ruleset/rules/0015-ossec_rules.xml +rm -rf ${WAZUH_MANAGER_DIR}/ruleset/rules/log-entries +rm -rf ${WAZUH_MANAGER_DIR}/ruleset/rules/translated +cd ${WAZUH_REPO_DIR}/tools/rules-testing/ +./runtests.py diff --git a/tools/rules-testing/tests/api.ini b/tools/rules-testing/tests/api.ini new file mode 100644 index 000000000..aa42ae49b --- /dev/null +++ b/tools/rules-testing/tests/api.ini @@ -0,0 +1,53 @@ +[Request to the api with errorcode 0] +log 1 pass = WazuhAPI 2019-02-27 15:23:17 user: [::ffff:11.0.0.19] GET /version? - 200 - error: '0'. +rule = 66504 +alert = 3 +decoder = wazuhapi + +[Generic exception message when the API is set in error mode] +log 1 pass = WazuhAPI 2019-03-19 13:46:48 foo: Agent does not exist: 500 -->