Wazuh for CMMC Compliance: Complete Implementation Guide#

1
{
2
  "version": "4.12.0",
3
  "objects": [
4
    {
5
      "id": "cmmc-dashboard",
6
      "type": "dashboard",
7
      "attributes": {
8
        "title": "CMMC Compliance Overview",
9
        "hits": 0,
10
        "description": "CMMC compliance monitoring for AU, AC, and RA domains",
11
        "panelsJSON": "[...]",
12
        "timeRestore": false,
13
        "kibanaSavedObjectMeta": {
14
          "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"}}"
15
        }
16
      }
17
    }
18
  ]
19
}

1
#!/usr/bin/env python3
2
import requests
3
import json
4
from datetime import datetime, timedelta
5

6
class CMMCReporter:
7
    def __init__(self, wazuh_api, api_user, api_pass):
8
        self.api = wazuh_api
9
        self.auth = (api_user, api_pass)
10

11
    def generate_au_report(self):
12
        """Generate Audit & Accountability report"""
13
        # Query authentication failures
14
        endpoint = f"{self.api}/security/events"
15
        params = {
16
            "pretty": "true",
17
            "q": "rule.groups:authentication_failed",
18
            "time_frame": "7d"
19
        }
20

21
        response = requests.get(endpoint, auth=self.auth, params=params)
22
        return self.format_au_report(response.json())
23

24
    def generate_ac_report(self):
25
        """Generate Access Control report"""
26
        # Query active response actions
27
        endpoint = f"{self.api}/security/events"
28
        params = {
29
            "pretty": "true",
30
            "q": "rule.groups:active_response",
31
            "time_frame": "30d"
32
        }
33

34
        response = requests.get(endpoint, auth=self.auth, params=params)
35
        return self.format_ac_report(response.json())
36

37
    def generate_ra_report(self):
38
        """Generate Risk Assessment report"""
39
        # Query vulnerabilities
40
        endpoint = f"{self.api}/vulnerability/{agent_id}"
41

42
        critical_vulns = []
43
        for agent in self.get_agents():
44
            response = requests.get(
45
                f"{endpoint}/{agent['id']}",
46
                auth=self.auth
47
            )
48
            vulns = response.json()
49
            critical_vulns.extend([
50
                v for v in vulns
51
                if v['severity'] in ['Critical', 'High']
52
            ])
53

54
        return self.format_ra_report(critical_vulns)

1
<!-- Add to local_rules.xml -->
2
<group name="cmmc_compliance,">
3
  <!-- AU Compliance Check -->
4
  <rule id="130001" level="12">
5
    <if_sid>999999</if_sid>
6
    <match>log_retention_check_failed</match>
7
    <description>CMMC AU.L2-3.3.1: Log retention policy violation detected</description>
8
    <group>cmmc_audit,compliance_failure,</group>
9
  </rule>
10

11
  <!-- AC Compliance Check -->
12
  <rule id="130002" level="10">
13
    <if_sid>5501</if_sid>
14
    <time_period>86400</time_period>
15
    <frequency>10</frequency>
16
    <same_user />
17
    <description>CMMC AC.L2-3.1.1: Excessive authentication attempts from user</description>
18
    <group>cmmc_access,compliance_warning,</group>
19
  </rule>
20

21
  <!-- RA Compliance Check -->
22
  <rule id="130003" level="14">
23
    <if_sid>23504</if_sid>
24
    <field name="data.vulnerability.severity">Critical</field>
25
    <time_period>604800</time_period>
26
    <description>CMMC RA.L2-3.11.2: Critical vulnerability unpatched for 7 days</description>
27
    <group>cmmc_risk,compliance_critical,</group>
28
  </rule>
29
</group>

1
# Export CMMC compliance data to GRC platform
2
def export_to_grc(compliance_data):
3
    """Export CMMC compliance metrics to GRC platform"""
4

5
    grc_payload = {
6
        "framework": "CMMC",
7
        "level": 2,
8
        "timestamp": datetime.utcnow().isoformat(),
9
        "controls": {
10
            "AU.L2-3.3.1": {
11
                "status": "compliant",
12
                "evidence": compliance_data['audit_logs'],
13
                "last_verified": datetime.utcnow().isoformat()
14
            },
15
            "AC.L2-3.1.11": {
16
                "status": "compliant",
17
                "evidence": compliance_data['access_controls'],
18
                "automated_controls": True
19
            },
20
            "RA.L2-3.11.2": {
21
                "status": "partial",
22
                "evidence": compliance_data['vulnerabilities'],
23
                "remediation_plan": "Patch Tuesday implementation"
24
            }
25
        }
26
    }
27

28
    # Send to GRC API
29
    response = requests.post(
30
        "https://grc-platform.com/api/compliance",
31
        json=grc_payload,
32
        headers={"Authorization": f"Bearer {GRC_TOKEN}"}
33
    )
34

35
    return response.status_code == 200

1
# Wazuh RBAC configuration for CMMC
2
roles:
3
  cmmc_auditor:
4
    - indices:
5
        - "wazuh-alerts-*"
6
      privileges:
7
        - read
8
      query: |
9
        {
10
          "bool": {
11
            "should": [
12
              {"match": {"rule.groups": "cmmc_audit"}},
13
              {"match": {"rule.groups": "cmmc_access"}},
14
              {"match": {"rule.groups": "cmmc_risk"}}
15
            ]
16
          }
17
        }
18

19
  security_analyst:
20
    - indices:
21
        - "wazuh-alerts-*"
22
      privileges:
23
        - read
24
        - write
25
      query: |
26
        {
27
          "match_all": {}
28
        }

1
<!-- ossec.conf optimizations -->
2
<ossec_config>
3
  <!-- Increase memory for compliance checks -->
4
  <global>
5
    <memory_size>2048</memory_size>
6
    <max_output_size>20480</max_output_size>
7
  </global>
8

9
  <!-- Dedicated compliance monitoring -->
10
  <localfile>
11
    <location>/var/log/cmmc-compliance.log</location>
12
    <log_format>json</log_format>
13
    <label key="cmmc">compliance</label>
14
  </localfile>
15

16
  <!-- Optimize vulnerability detection frequency -->
17
  <wodle name="vulnerability-detector">
18
    <disabled>no</disabled>
19
    <interval>6h</interval>
20
    <min_full_scan_interval>6h</min_full_scan_interval>
21
  </wodle>
22
</ossec_config>