Extending Wazuh Detection with Elastic Stack Integration#

1
filter {
2
  # Threat intelligence enrichment
3
  if [data][srcip] {
4
    # Check against threat intel database
5
    jdbc_streaming {
6
      jdbc_driver_library => "/usr/share/logstash/jdbc/mysql-connector-java.jar"
7
      jdbc_driver_class => "com.mysql.cj.jdbc.Driver"
8
      jdbc_connection_string => "jdbc:mysql://threatintel-db:3306/threats"
9
      jdbc_user => "readonly"
10
      jdbc_password => "password"
11
      statement => "SELECT threat_level, threat_type FROM ip_threats WHERE ip = :ip"
12
      parameters => { "ip" => "[data][srcip]" }
13
      target => "threat_intel"
14
    }
15
  }
16

17
  # User context enrichment
18
  if [data][dstuser] {
19
    elasticsearch {
20
      hosts => ["https://elasticsearch:9200"]
21
      index => "user-context"
22
      query => "username:%{[data][dstuser]}"
23
      fields => {
24
        "department" => "[user][department]"
25
        "manager" => "[user][manager]"
26
        "risk_score" => "[user][risk_score]"
27
      }
28
    }
29
  }
30

31
  # Asset enrichment
32
  if [agent][name] {
33
    translate {
34
      field => "[agent][name]"
35
      destination => "[asset][criticality]"
36
      dictionary_path => "/etc/logstash/lookups/asset_criticality.yml"
37
      fallback => "medium"
38
    }
39
  }
40
}

1
{
2
  "version": "8.5.0",
3
  "objects": [
4
    {
5
      "id": "wazuh-security-overview",
6
      "type": "dashboard",
7
      "attributes": {
8
        "title": "Wazuh Security Overview",
9
        "kibanaSavedObjectMeta": {
10
          "searchSourceJSON": {
11
            "query": {
12
              "language": "kuery",
13
              "query": ""
14
            },
15
            "filter": []
16
          }
17
        },
18
        "panels": [
19
          {
20
            "version": "8.5.0",
21
            "type": "visualization",
22
            "gridData": {
23
              "x": 0,
24
              "y": 0,
25
              "w": 24,
26
              "h": 15,
27
              "i": "1"
28
            },
29
            "panelConfig": {
30
              "title": "Alert Trend",
31
              "type": "line",
32
              "params": {
33
                "grid": {
34
                  "categoryLines": false,
35
                  "style": {
36
                    "color": "#eee"
37
                  }
38
                },
39
                "categoryAxes": [{
40
                  "id": "CategoryAxis-1",
41
                  "type": "category",
42
                  "position": "bottom",
43
                  "show": true,
44
                  "style": {},
45
                  "scale": {
46
                    "type": "linear"
47
                  },
48
                  "labels": {
49
                    "show": true,
50
                    "truncate": 100
51
                  },
52
                  "title": {}
53
                }],
54
                "valueAxes": [{
55
                  "id": "ValueAxis-1",
56
                  "name": "LeftAxis-1",
57
                  "type": "value",
58
                  "position": "left",
59
                  "show": true,
60
                  "style": {},
61
                  "scale": {
62
                    "type": "linear",
63
                    "mode": "normal"
64
                  },
65
                  "labels": {
66
                    "show": true,
67
                    "rotate": 0,
68
                    "filter": false,
69
                    "truncate": 100
70
                  },
71
                  "title": {
72
                    "text": "Alert Count"
73
                  }
74
                }]
75
              }
76
            }
77
          },
78
          {
79
            "version": "8.5.0",
80
            "type": "visualization",
81
            "gridData": {
82
              "x": 24,
83
              "y": 0,
84
              "w": 24,
85
              "h": 15,
86
              "i": "2"
87
            },
88
            "panelConfig": {
89
              "title": "Top Threats",
90
              "type": "tagcloud",
91
              "params": {
92
                "scale": "linear",
93
                "orientation": "single",
94
                "minFontSize": 18,
95
                "maxFontSize": 72,
96
                "showLabel": true
97
              }
98
            }
99
          }
100
        ]
101
      }
102
    }
103
  ]
104
}

1
// Custom Vega visualization for alert correlation
2
{
3
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
4
  "data": {
5
    "url": {
6
      "index": "wazuh-alerts-*",
7
      "body": {
8
        "size": 0,
9
        "aggs": {
10
          "time_buckets": {
11
            "date_histogram": {
12
              "field": "@timestamp",
13
              "interval": "1h"
14
            },
15
            "aggs": {
16
              "rule_correlation": {
17
                "terms": {
18
                  "field": "rule.id",
19
                  "size": 10
20
                },
21
                "aggs": {
22
                  "agent_count": {
23
                    "cardinality": {
24
                      "field": "agent.id"
25
                    }
26
                  }
27
                }
28
              }
29
            }
30
          }
31
        }
32
      }
33
    }
34
  },
35
  "mark": "circle",
36
  "encoding": {
37
    "x": {
38
      "field": "key",
39
      "type": "temporal",
40
      "axis": {"title": "Time"}
41
    },
42
    "y": {
43
      "field": "rule_correlation.buckets.key",
44
      "type": "nominal",
45
      "axis": {"title": "Rule ID"}
46
    },
47
    "size": {
48
      "field": "rule_correlation.buckets.agent_count.value",
49
      "type": "quantitative",
50
      "scale": {"range": [100, 1000]}
51
    },
52
    "color": {
53
      "field": "rule_correlation.buckets.doc_count",
54
      "type": "quantitative",
55
      "scale": {"scheme": "blues"}
56
    }
57
  }
58
}

1
# Secure inter-node communication
2
Security Configuration:
3
  Transport Layer:
4
    - Enable TLS for all connections
5
    - Use strong cipher suites
6
    - Implement mutual authentication
7

8
  Access Control:
9
    - Use role-based access control
10
    - Implement API key authentication
11
    - Enable audit logging
12

13
  Network Isolation:
14
    - Use private networks for cluster communication
15
    - Implement firewall rules
16
    - Disable unnecessary ports

1
Optimization Strategies:
2
  Indexing:
3
    - Use bulk requests
4
    - Optimize refresh intervals
5
    - Implement proper sharding strategy
6

7
  Querying:
8
    - Use filters instead of queries
9
    - Implement caching strategies
10
    - Optimize aggregations
11

12
  Hardware:
13
    - Use SSDs for hot data
14
    - Allocate sufficient heap memory
15
    - Implement proper load balancing

1
filter {
2
  # Extract tenant information
3
  if [agent][labels][tenant] {
4
    mutate {
5
      add_field => { "[@metadata][tenant]" => "%{[agent][labels][tenant]}" }
6
    }
7
  } else {
8
    # Default tenant
9
    mutate {
10
      add_field => { "[@metadata][tenant]" => "default" }
11
    }
12
  }
13

14
  # Add tenant-specific enrichment
15
  if [@metadata][tenant] == "finance" {
16
    mutate {
17
      add_tag => ["pci-dss", "sensitive"]
18
    }
19
  }
20
}
21

22
output {
23
  elasticsearch {
24
    hosts => ["https://elasticsearch:9200"]
25
    # Route to tenant-specific index
26
    index => "wazuh-%{[@metadata][tenant]}-%{+YYYY.MM.dd}"
27
    # ... other settings
28
  }
29
}

1
filter {
2
  # Map rules to compliance frameworks
3
  if [rule][pci_dss] {
4
    mutate {
5
      add_field => { "[compliance][framework]" => "PCI-DSS" }
6
      add_field => { "[compliance][requirement]" => "%{[rule][pci_dss]}" }
7
    }
8
  }
9

10
  if [rule][gdpr] {
11
    mutate {
12
      add_field => { "[compliance][framework]" => "GDPR" }
13
      add_field => { "[compliance][article]" => "%{[rule][gdpr]}" }
14
    }
15
  }
16

17
  if [rule][hipaa] {
18
    mutate {
19
      add_field => { "[compliance][framework]" => "HIPAA" }
20
      add_field => { "[compliance][control]" => "%{[rule][hipaa]}" }
21
    }
22
  }
23
}

1
// Elasticsearch query for threat hunting
2
GET wazuh-alerts-*/_search
3
{
4
  "size": 0,
5
  "query": {
6
    "bool": {
7
      "must": [
8
        {
9
          "range": {
10
            "@timestamp": {
11
              "gte": "now-24h"
12
            }
13
          }
14
        }
15
      ]
16
    }
17
  },
18
  "aggs": {
19
    "suspicious_patterns": {
20
      "significant_terms": {
21
        "field": "data.win.eventdata.commandLine.keyword",
22
        "size": 20,
23
        "gnd": {
24
          "background_is_superset": false
25
        }
26
      }
27
    },
28
    "rare_processes": {
29
      "rare_terms": {
30
        "field": "data.win.eventdata.image.keyword",
31
        "max_doc_count": 2
32
      }
33
    }
34
  }
35
}

1
{
2
  "job_id": "wazuh-anomaly-detection",
3
  "analysis_config": {
4
    "bucket_span": "15m",
5
    "detectors": [
6
      {
7
        "detector_description": "Unusual number of authentication failures",
8
        "function": "high_count",
9
        "partition_field_name": "agent.name",
10
        "detector_index": 0
11
      }
12
    ],
13
    "influencers": ["agent.name", "data.srcip", "rule.id"]
14
  },
15
  "data_description": {
16
    "time_field": "@timestamp"
17
  },
18
  "datafeed_config": {
19
    "datafeed_id": "datafeed-wazuh-anomaly-detection",
20
    "job_id": "wazuh-anomaly-detection",
21
    "query": {
22
      "bool": {
23
        "must": [
24
          {"term": {"rule.groups": "authentication_failed"}}
25
        ]
26
      }
27
    },
28
    "indices": ["wazuh-alerts-*"]
29
  }
30
}

1
filter {
2
  # Correlate security events with APM data
3
  if [data][srcip] and [data][dstport] {
4
    elasticsearch {
5
      hosts => ["https://elasticsearch:9200"]
6
      index => "apm-*-transaction"
7
      query => "context.request.socket.remote_address:%{[data][srcip]} AND context.request.socket.local_port:%{[data][dstport]}"
8
      fields => {
9
        "service.name" => "[correlation][service_name]"
10
        "transaction.id" => "[correlation][transaction_id]"
11
        "trace.id" => "[correlation][trace_id]"
12
      }
13
    }
14
  }
15
}

1
Monitoring Metrics:
2
  Logstash:
3
    - Events per second (in/out)
4
    - Pipeline latency
5
    - JVM heap usage
6
    - Queue size and backpressure
7

8
  Elasticsearch:
9
    - Indexing rate
10
    - Query latency
11
    - Disk usage
12
    - Cluster health status
13

14
  End-to-End:
15
    - Alert ingestion delay
16
    - Dashboard load time
17
    - Search performance
18
    - Data retention compliance