From 15327dc646f8b011dbcb4b45e544dd9a6d0f08e2 Mon Sep 17 00:00:00 2001 From: eliasgrana <43425223+eliasgrana@users.noreply.github.com> Date: Tue, 7 Apr 2020 17:14:00 +0200 Subject: [PATCH 1/5] Create 0685-wazuh-api_rules.xml --- rules/0685-wazuh-api_rules.xml | 165 +++++++++++++++++++++++++++++++++ 1 file changed, 165 insertions(+) create mode 100644 rules/0685-wazuh-api_rules.xml diff --git a/rules/0685-wazuh-api_rules.xml b/rules/0685-wazuh-api_rules.xml new file mode 100644 index 000000000..6c9d8a089 --- /dev/null +++ b/rules/0685-wazuh-api_rules.xml @@ -0,0 +1,165 @@ + + + + + + wazuhapi + + + + + + 30000 + ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: [(\S+)] \w+ \S+ - \d+ + Wazuh API request received. + + + + + + 30001 + GET + Wazuh API GET request received. + + + + 30002 + Wazuh API request $(method) $(request) with error code $(errorcode) + + + + 30003 + 0 + Wazuh API request $(method) $(request) + + + + 30001 + POST + Wazuh API request POST received. + + + + 30005 + Wazuh API request $(method) $(request) with error code $(errorcode) + + + + 30005 + 0 + Wazuh API request $(method) $(request) + + + + 30001 + DELETE + Wazuh API request DELETE received. + + + + 30008 + Wazuh API request $(method) $(request) got the error $(errorcode) + + + + 30008 + 0 + Wazuh API request $(method) $(request) + + + + 30001 + PUT + Wazuh API request PUT received. + + + + 30011 + Wazuh API request $(method) $(request) got the error $(errorcode) + + + + 30011 + 0 + Wazuh API request $(method) $(request) + + + + + + + 30000 + ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: \.+: \d+ + An exception was given, the message is: $(exception_message) + + + + + + 30000 + Authentication failed + Authentication with api from user $(apiuser) failed. + + + + + 30000 + Authentication error + Authentication with api failed with the error $(auth_error) and the message: $(error_message). + + + + + 30000 + Internal Error + Internal error detected in the API. + + + + + 30017 + Internal Error: uncaughtException + Internal error detected in the API, an uncaught exception was thrown. + + + + + 30000 + Exiting... + The API has just exited. + + + + + + 30019 + Exiting... (SIGTERM) + The API has just exited. (SIGTERM) + + + + 30019 + Exiting... (SIGINT) + The API has just exited. (SIGINT) + + + + 30000 + Listening on + Api is hearing at $(apiurl) + + + + + 30000 + Address in use + Another instance is using the port $(port) + + + From 256db814c1d00b8a104150500779c22133b55cf6 Mon Sep 17 00:00:00 2001 From: eliasgrana <43425223+eliasgrana@users.noreply.github.com> Date: Tue, 7 Apr 2020 17:12:14 +0200 Subject: [PATCH 2/5] Create 0495-wazuh-api_decoders.xml --- decoders/0495-wazuh-api_decoders.xml | 68 ++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 decoders/0495-wazuh-api_decoders.xml diff --git a/decoders/0495-wazuh-api_decoders.xml b/decoders/0495-wazuh-api_decoders.xml new file mode 100644 index 000000000..d10c0ad4a --- /dev/null +++ b/decoders/0495-wazuh-api_decoders.xml @@ -0,0 +1,68 @@ + + + + WazuhAPI + + + + + + wazuhapi + \d+-\d+-\d+ \d+:\d+:\d+ \S+: [\S+] \w+ \S+ - \d+ + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+): [(\S+)] (\w+) (\S+) - \d+ - error: '(\d+)' + timestamp,apiuser,remoteaddress,method,request,errorcode + + + + + + wazuhapi + + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+): (\.+): \d+ + timestamp,apiuser,exception_message + + + + + + wazuhapi + Listening on + (\d+-\d+-\d+ \d+:\d+:\d+) : Listening on: (\.+) + timestamp,apiurl + + + + + + + wazuhapi + Authentication failed + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+):\.+ Authentication failed + timestamp,apiuser + + + + + + + + wazuhapi + Address in use + (\d+-\d+-\d+ \d+:\d+:\d+) Error: Address in use \(port "(\d+)"\) + timestamp,port + + + + + + wazuhapi + Authentication error + (\d+-\d+-\d+ \d+:\d+:\d+) : [\.+] Authentication error: (\d+) - (\.+) + timestamp,auth_error,error_message + From 85fda12089fd518aee76f186dd664e462daaa1ee Mon Sep 17 00:00:00 2001 From: eliasgrana <43425223+eliasgrana@users.noreply.github.com> Date: Tue, 7 Apr 2020 17:16:06 +0200 Subject: [PATCH 3/5] Create api.ini --- tools/rules-testing/tests/api.ini | 53 +++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 tools/rules-testing/tests/api.ini diff --git a/tools/rules-testing/tests/api.ini b/tools/rules-testing/tests/api.ini new file mode 100644 index 000000000..cd4f9817f --- /dev/null +++ b/tools/rules-testing/tests/api.ini @@ -0,0 +1,53 @@ +[Request to the api with errorcode 0] +log 1 pass = WazuhAPI 2019-02-27 15:23:17 user: [::ffff:11.0.0.19] GET /version? - 200 - error: '0'. +rule = 30004 +alert = 3 +decoder = wazuhapi + +[Generic exception message when the API is set in error mode] +log 1 pass = WazuhAPI 2019-03-19 13:46:48 foo: Agent does not exist: 500 --> - - 30000 + + 66500 ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: [(\S+)] \w+ \S+ - \d+ Wazuh API request received. + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30001 + + 66501 GET Wazuh API GET request received. + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30002 + + 66502 Wazuh API request $(method) $(request) with error code $(errorcode) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30003 + + 66503 0 Wazuh API request $(method) $(request) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30001 + + 66501 POST Wazuh API request POST received. + + T1492 + + pci_dss_10.6.1,pci_dss_10.2.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.e - - 30005 + + 66505 Wazuh API request $(method) $(request) with error code $(errorcode) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30005 + + 66505 0 Wazuh API request $(method) $(request) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30001 + + 66501 DELETE Wazuh API request DELETE received. + + T1492 + + pci_dss_10.6.1,pci_dss_10.2.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.e - - 30008 + + 66508 Wazuh API request $(method) $(request) got the error $(errorcode) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30008 + + 66508 0 Wazuh API request $(method) $(request) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30001 + + 66501 PUT Wazuh API request PUT received. + + T1492 + + pci_dss_10.6.1,pci_dss_10.2.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.e - - 30011 + + 66511 Wazuh API request $(method) $(request) got the error $(errorcode) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30011 + + 66511 0 Wazuh API request $(method) $(request) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30000 + + 66500 ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: \.+: \d+ An exception was given, the message is: $(exception_message) + pci_dss_10.6.1,pci_dss_10.6.3,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30000 + + 66500 Authentication failed Authentication with api from user $(apiuser) failed. + pci_dss_10.6.1,pci_dss_10.2.4,pci_dss_10.2.5,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.d,gdpr_IV_35.7.d,gdpr_IV_32.2, - - 30000 + + 66500 Authentication error Authentication with api failed with the error $(auth_error) and the message: $(error_message). + pci_dss_10.6.1,pci_dss_10.2.4,pci_dss_10.2.5,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,tsc_CC7.4,hipaa_164.312.d,gdpr_IV_35.7.d,gdpr_IV_32.2, - - 30000 + + 66500 Internal Error Internal error detected in the API. + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30017 + + 66517 Internal Error: uncaughtException Internal error detected in the API, an uncaught exception was thrown. + pci_dss_10.6.1,pci_dss_10.6.3,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30000 + + 66500 Exiting... The API has just exited. + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30019 + + 66519 Exiting... (SIGTERM) The API has just exited. (SIGTERM) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30019 + + 66519 Exiting... (SIGINT) The API has just exited. (SIGINT) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30000 + + 66500 Listening on Api is hearing at $(apiurl) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, - - 30000 + + 66500 Address in use Another instance is using the port $(port) + pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + diff --git a/tools/rules-testing/beforeruntest.sh b/tools/rules-testing/beforeruntest.sh new file mode 100755 index 000000000..67b92f349 --- /dev/null +++ b/tools/rules-testing/beforeruntest.sh @@ -0,0 +1,14 @@ +#!/bin/bash +WAZUH_MANAGER_DIR="/var/ossec" +WAZUH_REPO_DIR="/home/vagrant/wazuh-ruleset" +rm -rf ${WAZUH_MANAGER_DIR}/ruleset/rules/* +rm -rf ${WAZUH_MANAGER_DIR}/ruleset/decoders/* +cp -r ${WAZUH_REPO_DIR}/rules/* ${WAZUH_MANAGER_DIR}/ruleset/rules +cp -r ${WAZUH_REPO_DIR}/decoders/* ${WAZUH_MANAGER_DIR}/ruleset/decoders +chown -R root:ossec ${WAZUH_MANAGER_DIR}/ruleset/rules +chown -R root:ossec ${WAZUH_MANAGER_DIR}/ruleset/decoders +chmod 644 ${WAZUH_MANAGER_DIR}/ruleset/rules/0015-ossec_rules.xml +rm -rf ${WAZUH_MANAGER_DIR}/ruleset/rules/log-entries +rm -rf ${WAZUH_MANAGER_DIR}/ruleset/rules/translated +cd ${WAZUH_REPO_DIR}/tools/rules-testing/ +./runtests.py diff --git a/tools/rules-testing/tests/api.ini b/tools/rules-testing/tests/api.ini index cd4f9817f..aa42ae49b 100644 --- a/tools/rules-testing/tests/api.ini +++ b/tools/rules-testing/tests/api.ini @@ -1,53 +1,53 @@ [Request to the api with errorcode 0] log 1 pass = WazuhAPI 2019-02-27 15:23:17 user: [::ffff:11.0.0.19] GET /version? - 200 - error: '0'. -rule = 30004 +rule = 66504 alert = 3 decoder = wazuhapi [Generic exception message when the API is set in error mode] log 1 pass = WazuhAPI 2019-03-19 13:46:48 foo: Agent does not exist: 500 -->