Wazuh — SIEM/XDR déploiement et agents

Agents Linux/Windows/macOS
          port 1514 logs chiffrs
          port 1515 enrollment
        
  Wazuh Manager  analyse rgles active response
          Filebeat
        
  Wazuh Indexer OpenSearch 9200
        
        
  Wazuh Dashboard 443

cd monitoring
# 1. Générer les certificats TLS
bash generate-certs.sh
# 2. Adapter .env (mots de passe)
nano env
# 3. Démarrer le stack Wazuh
docker compose --profile wazuh up -d
# Suivre l'initialisation (peut prendre 3-5 min)
docker compose logs -f wazuh-manager wazuh-indexer

# Télécharger et installer le package agent
curl -s https//packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --dearmor -o /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" 
  | tee /etc/apt/sources.list.d/wazuh.list
apt update && apt install -y wazuh-agent
# Enregistrer l'agent auprès du manager
WAZUH_MANAGER"<IP_MANAGER>" WAZUH_AGENT_NAME"$(hostname)" 
  dpkg-reconfigure wazuh-agent
systemctl enable --now wazuh-agent
systemctl status wazuh-agent

# Télécharger l'installeur MSI
Invoke-WebRequest -Uri "https://packages.wazuh.com/4.x/windows/wazuh-agent-4.7.3-1.msi" `
  -OutFile wazuh-agent.msi
# Installer avec enregistrement automatique
msiexec /i wazuh-agent.msi /q `
  WAZUH_MANAGER="<IP_MANAGER>" `
  WAZUH_AGENT_NAME="$env:COMPUTERNAME" `
  WAZUH_REGISTRATION_SERVER="<IP_MANAGER>"
# Démarrer le service
Start-Service WazuhSvc
Set-Service WazuhSvc -StartupType Automatic

curl -so wazuh-agent.pkg 
  https//packages.wazuh.com/4.x/macos/wazuh-agent-4.7.3-1.pkg
/bin/bash -c WAZUH_MANAGER'<IP_MANAGER>' 
  WAZUH_AGENT_NAME'$(hostname)' 
  installer -pkg /wazuh-agent.pkg -target 
/Library/Ossec/bin/wazuh-control start

# Lister les agents enregistrés
docker exec wazuh-manager /var/ossec/bin/manage_agents -l
# Supprimer un agent
docker exec wazuh-manager /var/ossec/bin/manage_agents -r <ID>
# Statut du manager
docker exec wazuh-manager /var/ossec/bin/wazuh-control status
# Tester la configuration
docker exec wazuh-manager /var/ossec/bin/wazuh-logtest
# Alertes en temps réel
docker exec wazuh-manager tail -f /var/ossec/logs/alerts/alerts.json | jq
# Relancer l'analyse des règles
docker exec wazuh-manager /var/ossec/bin/wazuh-control restart

# Obtenir un token JWT
TOKENcurl -su wazuh-wui:changeme_wazuh_2024 
  https//localhost55000/security/user/authenticate 
  -k | jq -r '.data.token'
# Lister les agents
curl -s -k -H "Authorization: Bearer $TOKEN" 
  https//localhost55000/agents | jq '.data.affected_items[] | {id, name, status, ip}'
# Résumé du manager
curl -s -k -H "Authorization: Bearer $TOKEN" 
  https//localhost55000/manager/info | jq
# Forcer un scan FIM sur un agent
curl -s -k -X PUT -H "Authorization: Bearer $TOKEN" 
  "https://localhost:55000/syscheck?agents_list=001"
# Scan de vulnérabilités
curl -s -k -X PUT -H "Authorization: Bearer $TOKEN" 
  "https://localhost:55000/vulnerability?agents_list=001"

# Voir les alertes FIM des dernières 24h
docker exec wazuh-manager grep "ossec: File" /var/ossec/logs/alerts/alerts.log | tail -20
# Forcer un scan FIM complet sur tous les agents
docker exec wazuh-manager /var/ossec/bin/wazuh-control restart

# Tester l'active response manuellement
docker exec wazuh-manager /var/ossec/active-response/bin/firewall-drop 
  add  1921681100 1234 5763
# Vérifier les actions actives
docker exec wazuh-manager cat /var/ossec/logs/active-responses.log | tail -20

# Statut du module vulnérabilités
curl -s -k -H "Authorization: Bearer $TOKEN" 
  https//localhost55000/vulnerability/001 | jq '.data.affected_items[0:5]'
# Via Dashboard : Vulnerability Detection → Agents → sélectionner l'agent