Integrating Wazuh with Shuffle SOAR for Security Orchestration#

1
<ossec_config>
2
  <integration>
3
    <name>shuffle</name>
4
    <hook_url>https://YOUR_SHUFFLE_URL/api/v1/hooks/HOOK_ID</hook_url>
5
    <level>3</level>
6
    <alert_format>json</alert_format>
7
  </integration>
8
</ossec_config>

1
<!-- Forward specific rule ID -->
2
<rule_id>92026</rule_id>
3

4
<!-- Forward specific rule group -->
5
<group>authentication_failed</group>
6

7
<!-- Forward from specific location -->
8
<event_location>server1</event_location>

1
<ossec_config>
2
  <integration>
3
    <name>shuffle</name>
4
    <hook_url>https://YOUR_SHUFFLE_URL/api/v1/hooks/HOOK_ID</hook_url>
5
    <rule_id>92026</rule_id>
6
    <alert_format>json</alert_format>
7
  </integration>
8
</ossec_config>

1
Workflow: "Brute Force Response"
2
Trigger: "rule.groups:authentication_failed AND frequency>=5"
3
Actions:
4
  1. Extract source IP
5
  2. Check IP reputation (VirusTotal/AbuseIPDB)
6
  3. If malicious:
7
     - Block IP on firewall
8
     - Add to threat intel feeds
9
  4. If internal IP:
10
     - Disable user account
11
     - Quarantine host
12
     - Alert security team
13
  5. Create incident with timeline

1
Workflow: "Malware Response"
2
Trigger: "rule.groups:malware"
3
Actions:
4
  1. Isolate infected host
5
  2. Collect forensic artifacts
6
  3. Scan other hosts for same IoCs
7
  4. Update antivirus signatures
8
  5. Create incident report
9
  6. Notify stakeholders

1
Workflow: "Data Exfiltration Response"
2
Trigger: "rule.groups:data_loss"
3
Actions:
4
  1. Block outbound connections
5
  2. Identify affected data
6
  3. Revoke user credentials
7
  4. Notify legal/compliance team
8
  5. Initiate breach procedures
9
  6. Document timeline

1
{
2
  "workflow": "Conditional Response",
3
  "conditions": {
4
    "if": "$exec.all_fields.rule.level >= 10",
5
    "then": "execute_critical_response",
6
    "else": "execute_standard_response"
7
  },
8
  "actions": {
9
    "critical_response": [
10
      "disable_user_account",
11
      "isolate_host",
12
      "notify_ciso"
13
    ],
14
    "standard_response": [
15
      "log_incident",
16
      "notify_analyst"
17
    ]
18
  }
19
}

1
# Orchestration example
2
class SecurityOrchestrator:
3
    def handle_alert(self, alert):
4
        # Stage 1: Immediate containment
5
        containment_result = self.contain_threat(alert)
6

7
        # Stage 2: Investigation
8
        if containment_result.success:
9
            investigation = self.investigate_threat(alert)
10

11
            # Stage 3: Response escalation
12
            if investigation.severity == "Critical":
13
                self.escalate_response(alert, investigation)
14

15
        # Stage 4: Recovery
16
        recovery_plan = self.create_recovery_plan(alert)
17
        self.execute_recovery(recovery_plan)
18

19
        # Stage 5: Lessons learned
20
        self.update_playbooks(alert, investigation)

1
def track_workflow_metrics():
2
    """Track SOAR workflow performance"""
3

4
    metrics = {
5
        "total_workflows_executed": 0,
6
        "successful_executions": 0,
7
        "failed_executions": 0,
8
        "average_execution_time": 0,
9
        "most_triggered_workflows": [],
10
        "error_patterns": []
11
    }
12

13
    # Collect from Shuffle API
14
    workflows = shuffle_client.get_workflow_executions()
15

16
    for workflow in workflows:
17
        metrics["total_workflows_executed"] += 1
18

19
        if workflow.status == "SUCCESS":
20
            metrics["successful_executions"] += 1
21
        else:
22
            metrics["failed_executions"] += 1
23
            metrics["error_patterns"].append(workflow.error)
24

25
    # Calculate success rate
26
    success_rate = (metrics["successful_executions"] /
27
                   metrics["total_workflows_executed"]) * 100
28

29
    return metrics, success_rate

1
def generate_soar_report():
2
    """Generate SOAR effectiveness report"""
3

4
    report = {
5
        "period": "Last 30 days",
6
        "total_alerts_processed": 0,
7
        "automated_responses": 0,
8
        "manual_interventions": 0,
9
        "response_times": {
10
            "avg_containment_time": 0,
11
            "avg_investigation_time": 0,
12
            "avg_recovery_time": 0
13
        },
14
        "top_response_actions": [],
15
        "effectiveness_metrics": {
16
            "false_positive_rate": 0,
17
            "containment_success_rate": 0,
18
            "mttr": 0  # Mean Time to Resolution
19
        }
20
    }
21

22
    return report

1
def audit_soar_actions():
2
    """Audit all SOAR actions for compliance"""
3

4
    audit_log = {
5
        "timestamp": datetime.now().isoformat(),
6
        "action": "user_account_disabled",
7
        "performer": "shuffle_automation",
8
        "target": "user@company.com",
9
        "reason": "credential_dumping_detected",
10
        "authorization": "auto_policy_violation",
11
        "success": True
12
    }
13

14
    # Send to audit system
15
    send_to_audit_log(audit_log)
16

17
    # Compliance reporting
18
    generate_compliance_report(audit_log)