1
<syscheck>
2
  <disabled>no</disabled>
3
  <frequency>300</frequency>
4
  <scan_on_start>yes</scan_on_start>
5

6
  <!-- Monitor critical system files -->
7
  <directories check_all="yes" realtime="yes" report_changes="yes">
8
    /etc,/usr/bin,/usr/sbin,/bin,/sbin
9
  </directories>
10

11
  <!-- Monitor Windows registry -->
12
  <windows_registry>HKEY_LOCAL_MACHINE\Software</windows_registry>
13
  <windows_registry>HKEY_LOCAL_MACHINE\System</windows_registry>
14

15
  <!-- Alert on specific file changes -->
16
  <alert_new_files>yes</alert_new_files>
17
</syscheck>

1
<rootcheck>
2
  <disabled>no</disabled>
3
  <check_unixaudit>yes</check_unixaudit>
4
  <check_files>yes</check_files>
5
  <check_trojans>yes</check_trojans>
6
  <check_dev>yes</check_dev>
7
  <check_sys>yes</check_sys>
8
  <check_pids>yes</check_pids>
9
  <check_ports>yes</check_ports>
10
  <check_if>yes</check_if>
11

12
  <!-- Frequency of rootkit checks (in seconds) -->
13
  <frequency>43200</frequency>
14

15
  <!-- Rootkit files database -->
16
  <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
17
  <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
18
</rootcheck>

1
<ossec_config>
2
  <global>
3
    <logall>yes</logall>
4
    <logall_json>yes</logall_json>
5
  </global>
6

7
  <alerts>
8
    <log_alert_level>3</log_alert_level>
9
    <email_alert_level>12</email_alert_level>
10
  </alerts>
11

12
  <remote>
13
    <connection>secure</connection>
14
    <port>1514</port>
15
    <protocol>tcp</protocol>
16
    <allowed-ips>192.168.1.0/24</allowed-ips>
17
  </remote>
18
</ossec_config>

1
# Example: Signature Detection Logic
2
class SignatureDetector:
3
    def __init__(self):
4
        self.signatures = {
5
            'sql_injection': [
6
                r"(\bUNION\b.*\bSELECT\b)",
7
                r"(\bOR\b.*=.*)",
8
                r"(--|\#|\/\*)",
9
                r"(\bDROP\b.*\bTABLE\b)"
10
            ],
11
            'xss_attack': [
12
                r"<script[^>]*>",
13
                r"javascript:",
14
                r"on\w+\s*=",
15
                r"<iframe[^>]*>"
16
            ],
17
            'command_injection': [
18
                r";\s*(ls|cat|wget|curl|bash|sh)",
19
                r"\|\s*(ls|cat|wget|curl|bash|sh)",
20
                r"`[^`]*`",
21
                r"\$\([^)]*\)"
22
            ]
23
        }
24

25
    def detect(self, payload):
26
        detections = []
27
        for attack_type, patterns in self.signatures.items():
28
            for pattern in patterns:
29
                if re.search(pattern, payload, re.IGNORECASE):
30
                    detections.append({
31
                        'type': attack_type,
32
                        'pattern': pattern,
33
                        'severity': self.calculate_severity(attack_type)
34
                    })
35
        return detections
36

37
    def calculate_severity(self, attack_type):
38
        severity_map = {
39
            'sql_injection': 'high',
40
            'xss_attack': 'medium',
41
            'command_injection': 'critical'
42
        }
43
        return severity_map.get(attack_type, 'low')

1
# Example: Behavioral Anomaly Detection
2
import numpy as np
3
from sklearn.ensemble import IsolationForest
4

5
class AnomalyDetector:
6
    def __init__(self):
7
        self.model = IsolationForest(
8
            contamination=0.1,
9
            random_state=42
10
        )
11
        self.baseline_established = False
12

13
    def establish_baseline(self, normal_traffic):
14
        """Train on normal behavior patterns"""
15
        features = self.extract_features(normal_traffic)
16
        self.model.fit(features)
17
        self.baseline_established = True
18

19
    def detect_anomalies(self, current_traffic):
20
        """Detect deviations from baseline"""
21
        if not self.baseline_established:
22
            raise Exception("Baseline not established")
23

24
        features = self.extract_features(current_traffic)
25
        predictions = self.model.predict(features)
26

27
        anomalies = []
28
        for i, pred in enumerate(predictions):
29
            if pred == -1:  # Anomaly detected
30
                anomalies.append({
31
                    'timestamp': current_traffic[i]['timestamp'],
32
                    'source': current_traffic[i]['source'],
33
                    'anomaly_score': self.model.score_samples([features[i]])[0],
34
                    'features': features[i]
35
                })
36

37
        return anomalies
38

39
    def extract_features(self, traffic):
40
        """Extract statistical features from traffic"""
41
        features = []
42
        for packet in traffic:
43
            features.append([
44
                packet.get('packet_size', 0),
45
                packet.get('inter_arrival_time', 0),
46
                packet.get('port_number', 0),
47
                packet.get('protocol_type', 0),
48
                packet.get('flag_count', 0)
49
            ])
50
        return np.array(features)

1
# Example: User Behavior Analytics
2
class BehaviorAnalyzer:
3
    def __init__(self):
4
        self.user_profiles = {}
5
        self.alert_threshold = 0.7
6

7
    def build_profile(self, user_id, historical_data):
8
        """Build behavioral profile for user"""
9
        profile = {
10
            'login_times': self.analyze_login_patterns(historical_data),
11
            'accessed_resources': self.analyze_resource_access(historical_data),
12
            'typical_locations': self.analyze_locations(historical_data),
13
            'data_transfer_patterns': self.analyze_data_transfers(historical_data)
14
        }
15
        self.user_profiles[user_id] = profile
16

17
    def detect_anomalous_behavior(self, user_id, current_activity):
18
        """Detect deviations from user's normal behavior"""
19
        if user_id not in self.user_profiles:
20
            return None
21

22
        profile = self.user_profiles[user_id]
23
        anomaly_scores = {
24
            'login_anomaly': self.check_login_anomaly(
25
                current_activity, profile['login_times']
26
            ),
27
            'access_anomaly': self.check_access_anomaly(
28
                current_activity, profile['accessed_resources']
29
            ),
30
            'location_anomaly': self.check_location_anomaly(
31
                current_activity, profile['typical_locations']
32
            ),
33
            'transfer_anomaly': self.check_transfer_anomaly(
34
                current_activity, profile['data_transfer_patterns']
35
            )
36
        }
37

38
        overall_score = np.mean(list(anomaly_scores.values()))
39

40
        if overall_score > self.alert_threshold:
41
            return {
42
                'user_id': user_id,
43
                'anomaly_score': overall_score,
44
                'details': anomaly_scores,
45
                'recommendation': self.get_recommendation(anomaly_scores)
46
            }
47

48
        return None

1
<ossec_config>
2
  <active-response>
3
    <disabled>no</disabled>
4
    <ca_store>/var/ossec/etc/wpk_root.pem</ca_store>
5
  </active-response>
6

7
  <!-- Block IP after brute force detection -->
8
  <active-response>
9
    <command>firewall-drop</command>
10
    <location>local</location>
11
    <rules_id>5712</rules_id>
12
    <timeout>3600</timeout>
13
  </active-response>
14

15
  <!-- Disable account after privilege escalation -->
16
  <active-response>
17
    <command>disable-account</command>
18
    <location>local</location>
19
    <rules_id>100010</rules_id>
20
  </active-response>
21

22
  <!-- Custom response script -->
23
  <active-response>
24
    <command>custom-block</command>
25
    <location>defined-agent</location>
26
    <agent_id>001</agent_id>
27
    <rules_id>100020</rules_id>
28
  </active-response>
29
</ossec_config>

1
#!/bin/bash
2
# Snort Installation Script - Ubuntu/Debian
3

4
# Update system
5
sudo apt update && sudo apt upgrade -y
6

7
# Install dependencies
8
sudo apt install -y \
9
    build-essential \
10
    autotools-dev \
11
    libdumbnet-dev \
12
    libluajit-5.1-dev \
13
    libpcap-dev \
14
    zlib1g-dev \
15
    pkg-config \
16
    libhwloc-dev \
17
    cmake \
18
    liblzma-dev \
19
    openssl \
20
    libssl-dev \
21
    cpputest \
22
    libsqlite3-dev \
23
    libtool \
24
    uuid-dev \
25
    git \
26
    autoconf \
27
    bison \
28
    flex \
29
    libcmocka-dev \
30
    libnetfilter-queue-dev \
31
    libunwind-dev \
32
    libmnl-dev \
33
    ethtool \
34
    libjemalloc-dev \
35
    libpcre++-dev
36

37
echo "Dependencies installed successfully"

1
-- /usr/local/etc/snort/snort.lua
2
-- Snort 3 Main Configuration File
3

4
---------------------------------------------------------------------------
5
-- 1. Configure home network
6
---------------------------------------------------------------------------
7
HOME_NET = '192.168.1.0/24'
8
EXTERNAL_NET = '!$HOME_NET'
9

10
---------------------------------------------------------------------------
11
-- 2. Configure ports
12
---------------------------------------------------------------------------
13
HTTP_PORTS = '80 443 8080 8443'
14
SHELLCODE_PORTS = '!80'
15
ORACLE_PORTS = 1521
16
SSH_PORTS = 22
17
FTP_PORTS = 21
18
SIP_PORTS = '5060 5061'
19
FILE_DATA_PORTS = '$HTTP_PORTS'
20

21
---------------------------------------------------------------------------
22
-- 3. Configure paths
23
---------------------------------------------------------------------------
24
RULE_PATH = '/usr/local/etc/snort/rules'
25
BUILTIN_RULE_PATH = '/usr/local/etc/snort/builtin_rules'
26
PLUGIN_RULE_PATH = '/usr/local/etc/snort/so_rules'
27
WHITE_LIST_PATH = '/usr/local/etc/snort/lists'
28
BLACK_LIST_PATH = '/usr/local/etc/snort/lists'
29

30
---------------------------------------------------------------------------
31
-- 4. Configure decoder
32
---------------------------------------------------------------------------
33
require('snort_defaults')
34

35
stream = {
36
    reassembly = 'yes',
37
    track_tcp = 'yes',
38
    track_udp = 'yes',
39
    track_icmp = 'no',
40
    max_tcp = 262144,
41
    max_udp = 131072,
42
}
43

44
---------------------------------------------------------------------------
45
-- 5. Configure inspectors
46
---------------------------------------------------------------------------
47
stream_tcp = {
48
    policy = 'windows',
49
    overlap_limit = 10,
50
    max_window = 0,
51
    require_3whs = 180,
52
    track_only = false,
53
    small_segments = {
54
        count = 3,
55
        maximum_size = 150
56
    }
57
}
58

59
http_inspect = {
60
    global_policy = 'all',
61
    default_policy = {
62
        normalize_cookies = true,
63
        normalize_headers = true,
64
        normalize_utf = true,
65
        compress_depth = 0,
66
        decompress_depth = 0
67
    }
68
}
69

70
---------------------------------------------------------------------------
71
-- 6. Configure detection
72
---------------------------------------------------------------------------
73
detection = {
74
    pcre_match_limit = 3500,
75
    pcre_match_limit_recursion = 1500,
76
    pcre_detect_override = true,
77
    debug = false,
78
    debug_print_rule_group_build_details = false,
79
    debug_print_rule_msgs = false,
80
    debug_print_fast_pattern = false,
81
    trace = 0
82
}
83

84
---------------------------------------------------------------------------
85
-- 7. Configure logging
86
---------------------------------------------------------------------------
87
alert_fast = {
88
    file = true,
89
    packet = false,
90
    limit = 10
91
}
92

93
alert_full = {
94
    file = true
95
}
96

97
alert_json = {
98
    file = true,
99
    limit = 100,
100
    fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action'
101
}
102

103
unified2 = {
104
    limit = 128,
105
    nostamp = true
106
}
107

108
---------------------------------------------------------------------------
109
-- 8. Configure outputs
110
---------------------------------------------------------------------------
111
outputs = {
112
    alert_fast = alert_fast,
113
    alert_full = alert_full,
114
    alert_json = alert_json,
115
    unified2 = unified2
116
}
117

118
---------------------------------------------------------------------------
119
-- 9. Include custom rules
120
---------------------------------------------------------------------------
121
ips = {
122
    enable_builtin_rules = true,
123
    include = RULE_PATH .. '/local.rules',
124
    variables = default_variables
125
}

1
action protocol src_ip src_port -> dst_ip dst_port (options)

1
# Add to /etc/suricata/suricata.yaml
2
outputs:
3
  - eve-log:
4
      enabled: yes
5
      filetype: regular
6
      filename: /var/log/suricata/eve.json
7
      types:
8
        - alert:
9
            payload: yes
10
            payload-buffer-size: 4kb
11
            payload-printable: yes
12
            packet: yes
13
            metadata:
14
              app-layer: true
15
              flow: true
16
              rule: true

1
<!-- /var/ossec/etc/ossec.conf on Wazuh Agent -->
2
<ossec_config>
3
  <localfile>
4
    <log_format>json</log_format>
5
    <location>/var/log/suricata/eve.json</location>
6
  </localfile>
7
</ossec_config>