Filtering Security Data with the Wazuh Query Language (WQL)#

1
fieldname operator value

1
flowchart TB
2
    subgraph "WQL-Enabled Dashboard Areas"
3
        A[Security Configuration Assessment]
4
        B[Endpoint Summary]
5
        C[MITRE ATT&CK Intelligence]
6
        D[Agent Inventory Data]
7
        E[Rule Management]
8
        F[Decoder Management]
9
        G[CDB List Management]
10
        H[Group Management]
11
    end
12

13
    subgraph "Query Types"
14
        Q1[Simple Queries]
15
        Q2[Compound Queries]
16
        Q3[API Queries]
17
    end
18

19
    Q1 --> A
20
    Q2 --> B
21
    Q3 --> C
22
    Q1 --> D
23
    Q2 --> E
24
    Q3 --> F
25
    Q1 --> G
26
    Q2 --> H
27

28
    style Q1 fill:#51cf66
29
    style Q2 fill:#4dabf7
30
    style Q3 fill:#ffd43b

1
# Find high-severity vulnerabilities in web packages
2
(name ~ apache or name ~ nginx) and severity < Medium and status = Active
3

4
# Find agents offline for more than 24 hours
5
status = disconnected and last_keepalive < 24h and os.platform = linux

1
# Find all log4j related packages
2
name ~ log4j*
3

4
# Find IP addresses in specific range
5
ip ~ 192.168.1.*

1
# Find recent authentication failures
2
rule.id = 5503 and timestamp > now-1h
3

4
# Find vulnerabilities discovered this week
5
detection_time > now-7d and severity = Critical

1
flowchart LR
2
    subgraph "Inefficient"
3
        I1[Broad Search]
4
        I2[Multiple OR conditions]
5
        I3[No field specification]
6
    end
7

8
    subgraph "Efficient"
9
        E1[Specific Fields]
10
        E2[Indexed Values]
11
        E3[Logical Grouping]
12
    end
13

14
    I1 -->|Optimize| E1
15
    I2 -->|Optimize| E2
16
    I3 -->|Optimize| E3
17

18
    style I1 fill:#ff6b6b
19
    style I2 fill:#ff6b6b
20
    style I3 fill:#ff6b6b
21
    style E1 fill:#51cf66
22
    style E2 fill:#51cf66
23
    style E3 fill:#51cf66

1
# Template: Find authentication anomalies
2
rule.groups ~ authentication and rule.level > 10 and agent.name = $AGENT_NAME
3

4
# Template: Compliance violations
5
rule.groups ~ compliance and (rule.gdpr = * or rule.pci_dss = *)
6

7
# Template: Network security events
8
rule.groups ~ network and (data.dstport < 1024 or data.srcip ~ 10.*)

1
# Step 1: All vulnerabilities
2
severity = Critical
3

4
# Step 2: Add package filter
5
severity = Critical and name ~ kernel
6

7
# Step 3: Add time constraint
8
severity = Critical and name ~ kernel and detection_time > now-24h

1
#!/usr/bin/env python3
2
import requests
3
import json
4

5
# Wazuh API configuration
6
API_URL = "https://wazuh-server:55000"
7
API_USER = "wazuh"
8
API_PASS = "wazuh"
9

10
def run_wql_query(endpoint, query):
11
    """Execute WQL query via Wazuh API"""
12

13
    response = requests.get(
14
        f"{API_URL}/{endpoint}?{query}",
15
        auth=(API_USER, API_PASS),
16
        verify=False
17
    )
18

19
    return response.json()
20

21
# Example: Find critical vulnerabilities
22
vulns = run_wql_query(
23
    "vulnerability/001",
24
    "severity=Critical&status=Active"
25
)
26

27
# Example: Find specific processes
28
processes = run_wql_query(
29
    "syscollector/001/processes",
30
    "name=python3&state=running"
31
)

1
# 1. Find compromised user accounts
2
rule.groups ~ authentication_failed and data.srcuser = $SUSPECTED_USER
3

4
# 2. Track lateral movement
5
rule.mitre.technique ~ T1021 and agent.ip ~ 192.168.*
6

7
# 3. Identify data exfiltration
8
rule.groups ~ network and data.bytes_out > 1000000
9

10
# 4. Detect privilege escalation
11
rule.groups ~ privilege_escalation or rule.mitre.technique ~ T1548

1
# PCI DSS violations
2
rule.pci_dss ~ 10.* and rule.level > 7
3

4
# GDPR compliance checks
5
rule.gdpr ~ * and rule.groups ~ compliance
6

7
# HIPAA related events
8
rule.hipaa ~ 164.* and timestamp > now-24h