Extending Wazuh Detection with OpenSearch Integration#

1
flowchart LR
2
    subgraph "Docker Host"
3
        D1[Docker Daemon]
4
        C1[Container 1]
5
        C2[Container 2]
6
        C3[Container N]
7
    end
8

9
    subgraph "Monitoring"
10
        WA[Wazuh Agent<br/>docker-listener]
11
        WS[Wazuh Server]
12
    end
13

14
    subgraph "Visualization"
15
        OS[OpenSearch]
16
        DD[Docker Dashboard]
17
    end
18

19
    D1 --> WA
20
    C1 --> WA
21
    C2 --> WA
22
    C3 --> WA
23

24
    WA --> WS
25
    WS --> OS
26
    OS --> DD
27

28
    style WA fill:#51cf66
29
    style DD fill:#ffd43b

1
filter {
2
  # Add GeoIP information
3
  if [data][srcip] {
4
    geoip {
5
      source => "[data][srcip]"
6
      target => "[data][geoip]"
7
    }
8
  }
9

10
  # Add custom fields
11
  mutate {
12
    add_field => {
13
      "environment" => "production"
14
      "processed_by" => "logstash"
15
    }
16
  }
17

18
  # Parse user agent strings
19
  if [data][http][user_agent] {
20
    useragent {
21
      source => "[data][http][user_agent]"
22
      target => "[data][user_agent_parsed]"
23
    }
24
  }
25
}

1
# Secure certificate storage
2
certificates:
3
  strict_permissions: true
4
  verification_mode: full
5

6
# Network isolation
7
firewall_rules:
8
  - source: logstash_server
9
    destination: wazuh_indexer
10
    port: 9200
11
    protocol: tcp
12

13
  - source: logstash_server
14
    destination: opensearch_cluster
15
    port: 9200
16
    protocol: tcp

1
monitoring_checklist:
2
  - metric: pipeline_throughput
3
    threshold: "> 1000 events/sec"
4
    action: scale_horizontally
5

6
  - metric: indexing_latency
7
    threshold: "< 100ms"
8
    action: optimize_bulk_settings
9

10
  - metric: error_rate
11
    threshold: "< 1%"
12
    action: investigate_failures

1
{
2
  "visualization": {
3
    "title": "Wazuh Security Events Timeline",
4
    "visState": {
5
      "type": "line",
6
      "params": {
7
        "grid": {
8
          "categoryLines": false,
9
          "style": {
10
            "color": "#eee"
11
          }
12
        },
13
        "categoryAxes": [{
14
          "id": "CategoryAxis-1",
15
          "type": "category",
16
          "position": "bottom",
17
          "show": true,
18
          "style": {},
19
          "scale": {
20
            "type": "linear"
21
          },
22
          "labels": {
23
            "show": true,
24
            "truncate": 100
25
          },
26
          "title": {}
27
        }],
28
        "valueAxes": [{
29
          "id": "ValueAxis-1",
30
          "name": "LeftAxis-1",
31
          "type": "value",
32
          "position": "left",
33
          "show": true,
34
          "style": {},
35
          "scale": {
36
            "type": "linear",
37
            "mode": "normal"
38
          },
39
          "labels": {
40
            "show": true,
41
            "rotate": 0,
42
            "filter": false,
43
            "truncate": 100
44
          },
45
          "title": {
46
            "text": "Event Count"
47
          }
48
        }],
49
        "seriesParams": [{
50
          "show": true,
51
          "type": "line",
52
          "mode": "normal",
53
          "data": {
54
            "label": "Security Events",
55
            "id": "1"
56
          },
57
          "valueAxis": "ValueAxis-1",
58
          "drawLinesBetweenPoints": true,
59
          "showCircles": true
60
        }]
61
      }
62
    }
63
  }
64
}

1
// Custom OpenSearch query for correlation
2
GET wazuh-alerts-*/_search
3
{
4
  "size": 0,
5
  "aggs": {
6
    "correlations": {
7
      "composite": {
8
        "sources": [
9
          { "agent": { "terms": { "field": "agent.name" } } },
10
          { "rule": { "terms": { "field": "rule.id" } } }
11
        ]
12
      },
13
      "aggs": {
14
        "alert_count": {
15
          "value_count": {
16
            "field": "_id"
17
          }
18
        },
19
        "severity_stats": {
20
          "stats": {
21
            "field": "rule.level"
22
          }
23
        }
24
      }
25
    }
26
  }
27
}

1
# Compliance-specific pipeline
2
input {
3
  opensearch {
4
    hosts => ["<WAZUH_INDEXER>:9200"]
5
    index => "wazuh-alerts-4.x-*"
6
    query => '{
7
      "query": {
8
        "bool": {
9
          "should": [
10
            { "exists": { "field": "rule.pci_dss" } },
11
            { "exists": { "field": "rule.gdpr" } },
12
            { "exists": { "field": "rule.hipaa" } }
13
          ]
14
        }
15
      }
16
    }'
17
    schedule => "*/10 * * * *"
18
  }
19
}
20

21
output {
22
  opensearch {
23
    hosts => ["<OPENSEARCH>"]
24
    index => "wazuh-compliance-%{+YYYY.MM}"
25
    # ... configuration
26
  }
27
}

1
filter {
2
  # Enrich with threat intelligence
3
  translate {
4
    field => "[data][srcip]"
5
    destination => "[threat][classification]"
6
    dictionary_path => "/etc/logstash/threat_intel.yml"
7
  }
8

9
  # Add threat score
10
  ruby {
11
    code => "
12
      if event.get('[threat][classification]')
13
        threat_scores = {
14
          'malicious' => 10,
15
          'suspicious' => 7,
16
          'unknown' => 5
17
        }
18
        event.set('[threat][score]',
19
          threat_scores[event.get('[threat][classification]')] || 0)
20
      end
21
    "
22
  }
23
}

1
# Route alerts to tenant-specific indices
2
filter {
3
  # Determine tenant based on agent metadata
4
  if [agent][labels][tenant] {
5
    mutate {
6
      add_field => { "[@metadata][tenant]" => "%{[agent][labels][tenant]}" }
7
    }
8
  } else {
9
    mutate {
10
      add_field => { "[@metadata][tenant]" => "default" }
11
    }
12
  }
13
}
14

15
output {
16
  opensearch {
17
    hosts => ["<OPENSEARCH>"]
18
    index => "wazuh-%{[@metadata][tenant]}-%{+YYYY.MM.dd}"
19
    # ... configuration
20
  }
21
}

1
kpi_monitoring:
2
  pipeline_metrics:
3
    - events_received_rate
4
    - events_filtered_rate
5
    - events_out_rate
6
    - queue_push_duration
7
    - queue_backpressure
8

9
  opensearch_metrics:
10
    - indexing_rate
11
    - indexing_latency
12
    - search_latency
13
    - disk_usage
14
    - heap_usage
15

16
  system_metrics:
17
    - cpu_usage
18
    - memory_usage
19
    - network_throughput
20
    - disk_io