Scheduling Remote Commands for Wazuh Agents#

1
#!/bin/bash
2
# disk-usage.sh - Monitor disk usage and format output for Wazuh
3

4
df -h | while IFS= read -r line;
5
do
6
  echo "disk-usage: $line"
7
done

1
<agent_config os="Linux">
2
  <wodle name="command">
3
    <disabled>no</disabled>
4
    <tag>disk-usage</tag>
5
    <command>/bin/bash /var/ossec/etc/shared/disk-usage.sh</command>
6
    <interval>1h</interval>
7
    <run_on_start>yes</run_on_start>
8
    <timeout>10</timeout>
9
    <verify_md5>450d8f0ce1271aa72529ad58af2ed150</verify_md5>
10
    <verify_sha1>97cc6260454a7243b55c46f1e39758f2419e6d38</verify_sha1>
11
    <verify_sha256>724a10acf512747b3cc0657ec40d54708edf4bdd15b5115dd63c9a049efd1bc3</verify_sha256>
12
  </wodle>
13
</agent_config>

1
<decoder name="disk-usage">
2
  <prematch>^disk-usage: </prematch>
3
  <regex offset="after_prematch">(\S+)\s*\t*(\S+)\s*\t*(\S+)\s*\t*(\S+)\s*\t*(\S+)%\s*\t*(\S+)</regex>
4
  <order>filesystem, size, used, available, usage, mnt</order>
5
</decoder>

1
<group name="local,monitor,stats">
2
  <!-- Base rule for disk usage -->
3
  <rule id="100001" level="0">
4
    <decoded_as>disk-usage</decoded_as>
5
    <description>Disk-usage monitoring rules.</description>
6
  </rule>
7

8
  <!-- Disk usage over 50% -->
9
  <rule id="100002" level="3">
10
    <if_sid>100001</if_sid>
11
    <field name="usage">^6\d|^5\d</field>
12
    <description>Filesystem $(filesystem) over 50% ($(usage)%).</description>
13
  </rule>
14

15
  <!-- Disk usage over 70% -->
16
  <rule id="100003" level="5">
17
    <if_sid>100001</if_sid>
18
    <field name="usage">^7\d</field>
19
    <description>Filesystem $(filesystem) over 70% ($(usage)%).</description>
20
  </rule>
21

22
  <!-- Disk usage over 80% -->
23
  <rule id="100004" level="7">
24
    <if_sid>100001</if_sid>
25
    <field name="usage">^9\d|^8\d</field>
26
    <description>Filesystem $(filesystem) over 80% ($(usage)%).</description>
27
  </rule>
28

29
  <!-- Disk full -->
30
  <rule id="100005" level="9">
31
    <if_sid>100001</if_sid>
32
    <field name="usage">100</field>
33
    <description>No space left at filesystem $(filesystem).</description>
34
    <options>alert_by_email</options>
35
  </rule>
36
</group>

1
#!/bin/bash
2
# security-compliance.sh - Check security configurations
3

4
echo "security-check: SSH_CONFIG"
5
grep -E "^PermitRootLogin|^PasswordAuthentication" /etc/ssh/sshd_config
6

7
echo "security-check: SUDO_USERS"
8
grep -v '^#' /etc/sudoers | grep -v '^$'
9

10
echo "security-check: OPEN_PORTS"
11
ss -tlnp | grep LISTEN
12

13
echo "security-check: FAILED_LOGINS"
14
lastb | head -5

1
<wodle name="command">
2
  <disabled>no</disabled>
3
  <tag>security-compliance</tag>
4
  <command>/bin/bash /var/ossec/etc/shared/security-compliance.sh</command>
5
  <interval>6h</interval>
6
  <run_on_start>yes</run_on_start>
7
  <timeout>30</timeout>
8
</wodle>

1
#!/usr/bin/env python3
2
# app-health.py - Monitor application health
3

4
import requests
5
import json
6
import sys
7

8
def check_app_health():
9
    """Check application health endpoints"""
10

11
    endpoints = [
12
        {'name': 'web-app', 'url': 'http://localhost:8080/health'},
13
        {'name': 'api', 'url': 'http://localhost:3000/health'},
14
        {'name': 'database', 'url': 'http://localhost:5432/health'}
15
    ]
16

17
    for endpoint in endpoints:
18
        try:
19
            response = requests.get(endpoint['url'], timeout=5)
20
            status = 'UP' if response.status_code == 200 else 'DOWN'
21
            print(f"app-health: {endpoint['name']} {status} {response.status_code}")
22
        except:
23
            print(f"app-health: {endpoint['name']} DOWN 0")
24

25
if __name__ == "__main__":
26
    check_app_health()

1
#!/bin/bash
2
# log-analysis.sh - Analyze logs for specific patterns
3

4
# Check for error patterns in application logs
5
echo "log-analysis: ERROR_COUNT"
6
grep -c "ERROR\|FATAL" /var/log/app/application.log || echo "0"
7

8
# Check for specific security events
9
echo "log-analysis: AUTH_FAILURES"
10
grep -c "authentication failed" /var/log/app/security.log || echo "0"
11

12
# Check for performance issues
13
echo "log-analysis: SLOW_QUERIES"
14
grep -c "slow query" /var/log/app/database.log || echo "0"

1
#!/usr/bin/env python3
2
# resource-monitor.py - Monitor system resources
3

4
import psutil
5
import json
6

7
def get_system_metrics():
8
    """Collect system resource metrics"""
9

10
    # CPU metrics
11
    cpu_percent = psutil.cpu_percent(interval=1)
12
    cpu_count = psutil.cpu_count()
13

14
    # Memory metrics
15
    memory = psutil.virtual_memory()
16

17
    # Disk metrics
18
    disk = psutil.disk_usage('/')
19

20
    # Network metrics
21
    network = psutil.net_io_counters()
22

23
    # Format output for Wazuh
24
    print(f"resource-monitor: CPU {cpu_percent}% {cpu_count}")
25
    print(f"resource-monitor: MEMORY {memory.percent}% {memory.used} {memory.total}")
26
    print(f"resource-monitor: DISK {disk.percent}% {disk.used} {disk.total}")
27
    print(f"resource-monitor: NETWORK {network.bytes_sent} {network.bytes_recv}")
28

29
if __name__ == "__main__":
30
    get_system_metrics()

1
<agent_config os="Windows">
2
  <wodle name="command">
3
    <disabled>no</disabled>
4
    <tag>windows-info</tag>
5
    <command>powershell.exe -ExecutionPolicy Bypass -File C:\Program Files (x86)\ossec-agent\shared\system-info.ps1</command>
6
    <interval>1d</interval>
7
    <run_on_start>yes</run_on_start>
8
    <timeout>60</timeout>
9
  </wodle>
10
</agent_config>

1
Security Guidelines:
2
  Command Validation:
3
    - Always use checksum verification
4
    - Limit command paths to specific directories
5
    - Avoid running commands as root when possible
6

7
  Output Handling:
8
    - Sanitize sensitive information
9
    - Limit output size to prevent flooding
10
    - Use structured output formats
11

12
  Access Control:
13
    - Enable remote commands only on trusted agents
14
    - Use agent groups for targeted deployment
15
    - Regularly audit command configurations

1
#!/usr/bin/env python3
2
# optimized-command.py - Efficient command execution
3

4
import subprocess
5
import time
6
import os
7

8
def run_with_timeout(command, timeout=30):
9
    """Run command with timeout and resource limits"""
10

11
    try:
12
        # Set resource limits
13
        env = os.environ.copy()
14
        env['TIMEOUT'] = str(timeout)
15

16
        # Run command with timeout
17
        result = subprocess.run(
18
            command,
19
            shell=True,
20
            capture_output=True,
21
            text=True,
22
            timeout=timeout,
23
            env=env
24
        )
25

26
        return result.stdout
27
    except subprocess.TimeoutExpired:
28
        return f"ERROR: Command timed out after {timeout} seconds"
29
    except Exception as e:
30
        return f"ERROR: {str(e)}"

1
#!/bin/bash
2
# robust-command.sh - Command with error handling
3

4
set -euo pipefail
5

6
# Trap errors
7
trap 'echo "command-error: Script failed at line $LINENO"' ERR
8

9
# Check prerequisites
10
command -v df >/dev/null 2>&1 || { echo "command-error: df command not found"; exit 1; }
11

12
# Execute with error handling
13
if output=$(df -h 2>&1); then
14
    echo "$output" | while IFS= read -r line; do
15
        echo "disk-check: $line"
16
    done
17
else
18
    echo "command-error: Failed to get disk usage"
19
    exit 1
20
fi

1
{
2
  "visualization": {
3
    "title": "Command Module - Disk Usage",
4
    "visState": {
5
      "type": "line",
6
      "params": {
7
        "grid": {
8
          "categoryLines": false,
9
          "style": {
10
            "color": "#eee"
11
          }
12
        },
13
        "categoryAxes": [{
14
          "id": "CategoryAxis-1",
15
          "type": "category",
16
          "position": "bottom",
17
          "show": true,
18
          "style": {},
19
          "scale": {
20
            "type": "linear"
21
          },
22
          "labels": {
23
            "show": true,
24
            "truncate": 100
25
          },
26
          "title": {}
27
        }],
28
        "valueAxes": [{
29
          "id": "ValueAxis-1",
30
          "name": "LeftAxis-1",
31
          "type": "value",
32
          "position": "left",
33
          "show": true,
34
          "style": {},
35
          "scale": {
36
            "type": "linear",
37
            "mode": "normal"
38
          },
39
          "labels": {
40
            "show": true,
41
            "rotate": 0,
42
            "filter": false,
43
            "truncate": 100
44
          },
45
          "title": {
46
            "text": "Disk Usage %"
47
          }
48
        }],
49
        "seriesParams": [{
50
          "show": true,
51
          "type": "line",
52
          "mode": "normal",
53
          "data": {
54
            "label": "Disk Usage",
55
            "id": "1"
56
          },
57
          "valueAxis": "ValueAxis-1",
58
          "drawLinesBetweenPoints": true,
59
          "showCircles": true
60
        }]
61
      }
62
    }
63
  }
64
}

1
<!-- Correlate multiple command outputs -->
2
<rule id="100010" level="10" frequency="2" timeframe="300">
3
  <if_sid>100004</if_sid>
4
  <same_field>agent.id</same_field>
5
  <description>Multiple filesystems with high disk usage</description>
6
  <options>alert_by_email</options>
7
</rule>
8

9
<!-- Correlate with system events -->
10
<rule id="100011" level="12">
11
  <if_group>syscheck</if_group>
12
  <if_sid>100005</if_sid>
13
  <same_field>agent.id</same_field>
14
  <description>File changes detected on full filesystem</description>
15
</rule>

1
#!/usr/bin/env python3
2
# command-active-response.py - React to command module alerts
3

4
import json
5
import sys
6
import subprocess
7

8
def handle_disk_full(alert):
9
    """Handle disk full alerts from command module"""
10

11
    filesystem = alert['data']['filesystem']
12
    usage = alert['data']['usage']
13
    agent = alert['agent']['name']
14

15
    # Clean up old logs
16
    if filesystem == '/var/log':
17
        cleanup_commands = [
18
            'find /var/log -name "*.log.*" -mtime +7 -delete',
19
            'journalctl --vacuum-time=3d'
20
        ]
21

22
        for cmd in cleanup_commands:
23
            subprocess.run(cmd, shell=True)
24

25
    # Notify administrators
26
    send_notification(f"Disk full on {agent}: {filesystem} at {usage}%")
27

28
def main():
29
    # Read alert from stdin
30
    alert = json.load(sys.stdin)
31

32
    if alert['rule']['groups'] == ['local', 'monitor', 'stats']:
33
        if alert['rule']['id'] == '100005':
34
            handle_disk_full(alert)
35

36
if __name__ == "__main__":
37
    main()

1
#!/bin/bash
2
# conditional-command.sh - Execute based on conditions
3

4
# Only run during business hours
5
hour=$(date +%H)
6
if [ $hour -ge 8 ] && [ $hour -le 18 ]; then
7
    echo "business-hours: CHECK_RUNNING"
8
    # Your commands here
9
else
10
    echo "business-hours: SKIPPED"
11
fi
12

13
# Only run on specific days
14
day=$(date +%u)
15
if [ $day -le 5 ]; then  # Monday to Friday
16
    echo "weekday-check: RUNNING"
17
    # Your commands here
18
fi

1
<!-- Run commands in sequence -->
2
<wodle name="command">
3
  <disabled>no</disabled>
4
  <tag>backup-check</tag>
5
  <command>/bin/bash -c '/var/ossec/scripts/pre-backup.sh && /var/ossec/scripts/backup.sh && /var/ossec/scripts/post-backup.sh'</command>
6
  <interval>1d</interval>
7
  <timeout>3600</timeout>
8
</wodle>

1
#!/usr/bin/env python3
2
# dynamic-command.py - Generate commands based on system state
3

4
import os
5
import json
6

7
def generate_commands():
8
    """Generate commands based on current system state"""
9

10
    commands = []
11

12
    # Check which services are running
13
    services = ['nginx', 'mysql', 'redis', 'elasticsearch']
14

15
    for service in services:
16
        if os.system(f'systemctl is-active {service} >/dev/null 2>&1') == 0:
17
            commands.append(f'systemctl status {service}')
18

19
    # Execute generated commands
20
    for cmd in commands:
21
        print(f"dynamic-check: Executing {cmd}")
22
        os.system(cmd)
23

24
if __name__ == "__main__":
25
    generate_commands()

1
#!/bin/bash
2
# config-drift.sh - Detect configuration changes
3

4
# Generate current configuration hash
5
current_hash=$(find /etc -name "*.conf" -type f -exec md5sum {} \; | sort | md5sum)
6
echo "config-drift: CURRENT_HASH $current_hash"
7

8
# Compare with baseline
9
if [ -f /var/ossec/baseline/config.hash ]; then
10
    baseline_hash=$(cat /var/ossec/baseline/config.hash)
11
    if [ "$current_hash" != "$baseline_hash" ]; then
12
        echo "config-drift: CHANGE_DETECTED"
13
        # List changed files
14
        diff <(cat /var/ossec/baseline/config.list) \
15
             <(find /etc -name "*.conf" -type f -exec md5sum {} \; | sort)
16
    else
17
        echo "config-drift: NO_CHANGES"
18
    fi
19
else
20
    # Create baseline
21
    echo "$current_hash" > /var/ossec/baseline/config.hash
22
    find /etc -name "*.conf" -type f -exec md5sum {} \; | sort > /var/ossec/baseline/config.list
23
    echo "config-drift: BASELINE_CREATED"
24
fi

1
#!/usr/bin/env python3
2
# user-activity.py - Monitor user activities
3

4
import subprocess
5
import pwd
6
import datetime
7

8
def monitor_user_activity():
9
    """Monitor and report user activities"""
10

11
    # Get logged in users
12
    result = subprocess.run(['who'], capture_output=True, text=True)
13
    users = result.stdout.strip().split('\n')
14

15
    print(f"user-activity: LOGGED_IN_USERS {len(users)}")
16

17
    for user_line in users:
18
        if user_line:
19
            parts = user_line.split()
20
            username = parts[0]
21
            terminal = parts[1]
22
            login_time = ' '.join(parts[2:4])
23
            print(f"user-activity: USER {username} {terminal} {login_time}")
24

25
    # Check sudo usage
26
    try:
27
        with open('/var/log/auth.log', 'r') as f:
28
            lines = f.readlines()[-100:]  # Last 100 lines
29
            sudo_count = sum(1 for line in lines if 'sudo:' in line)
30
            print(f"user-activity: RECENT_SUDO_COMMANDS {sudo_count}")
31
    except:
32
        pass
33

34
if __name__ == "__main__":
35
    monitor_user_activity()