ELK + Wazuh — Intégration et règles de détection

cd monitoring
bash generate-certs.sh
docker compose --profile all up -d

# Sur le host du manager, ajouter dans filebeat.yml :
filebeatinputs
   type log
    paths
       /var/lib/docker/volumes/wazuh-manager-data/_data/logs/alerts/alerts.json
    jsonkeys_under_root true
    jsonoverwrite_keys true
    tags "wazuh" "security"
    fields
      log_type wazuh-alert
    fields_under_root true
outputelasticsearch
  hosts "http://localhost:9200"
  username elastic
  password "${ELASTIC_PASSWORD}"
  index "wazuh-alerts-%{+YYYY.MM.dd}"

# Créer l'index pattern wazuh-alerts-*
curl -X POST "http://localhost:5601/api/index_patterns/index_pattern" 
  -H "Content-Type: application/json" 
  -H "kbn-xsrf: true" -u elasticchangeme -d 
  "index_pattern" 
    "title" "wazuh-alerts-*"
    "timeFieldName" "timestamp"
  

# Alertes de niveau critique (>= 12)
rulelevel > 12
# Brute-force SSH
ruleid 5763 AND datasrcip 
# Modifications FIM (fichiers système)
rulegroups syscheck AND full_log "/etc/*"
# Connexions réussies avec compte privilégié
ruleid 5501 AND datasrcuser root
# Malware détecté
rulegroups rootcheck OR rulegroups virustotal
# Alertes par agent spécifique
agentname "srv-prod-01" AND rulelevel > 7
# Timeline : toutes les alertes des 24 dernières heures
timestamp > now-24h AND rulelevel > 3

# Top 10 des règles les plus déclenchées
curl -s "http://elastic:changeme@localhost:9200/wazuh-alerts-*/_search" 
  -H "Content-Type: application/json" -d 
  "size" 0
  "aggs" 
    "top_rules" 
      "terms"  "field" "rule.description.keyword" "size" 10 
    
  
' | jq 'aggregationstop_rulesbuckets
# IPs sources les plus actives
curl -s "http://elastic:changeme@localhost:9200/wazuh-alerts-*/_search" 
  -H "Content-Type: application/json" -d 
  "size" 0
  "query"  "range"  "timestamp"  "gte" "now-24h"   
  "aggs" 
    "top_ips" 
      "terms"  "field" "data.srcip.keyword" "size" 20 
    
  
' | jq 'aggregationstop_ipsbuckets
# Alertes critiques (niveau >= 12)
curl -s "http://elastic:changeme@localhost:9200/wazuh-alerts-*/_search" 
  -H "Content-Type: application/json" -d 
  "query" 
    "bool" 
      "must" 
         "range"  "rule.level"  "gte" 12   
         "range"  "timestamp"  "gte" "now-1h"   
      
    
  
  "sort"  "timestamp"  "order" "desc"  
  "size" 20
' | jq 'hitshits_source | timestamp agent_name agentname rule ruledescription level rulelevel

# Créer une règle d'alerte sur brute-force SSH
curl -X POST "http://localhost:5601/api/alerting/rule" 
  -H "Content-Type: application/json" 
  -H "kbn-xsrf: true" -u elasticchangeme -d 
  "name" "SSH Brute Force Alert"
  "rule_type_id" ".es-query"
  "schedule"  "interval" "5m" 
  "params" 
    "index" "wazuh-alerts-*"
    "timeField" "timestamp"
    "timeWindowSize" 10
    "timeWindowUnit" "m"
    "thresholdComparator" ">="
    "threshold" 5
    "esQuery" "{\"query\":{\"match\":{\"rule.id\":\"5763\"}}}"
  
  "actions" 

Wazuh Rule IDs  5763 Multiple failed SSH 5551 sshd
Seuil  > 5 tentatives en 2 min depuis la mme IP
Active Response  firewall-drop blocage 
Index KQL  ruleid 5763

Wazuh Rule ID  40101 Nmap scan detected
Logstash  parser les logs Snort/Suricata
Index KQL  rulegroups ids AND dataaction DROP

Wazuh FIM Rule IDs  550 553 554
Rpertoires surveills  /etc /bin /usr/sbin
KQL  rulegroups syscheck AND full_log "/etc/passwd"
Svrit  7 modification 12 suppression de fichier critique

Wazuh Rule IDs  5902 sudo 5930 su
KQL  ruleid 5902 OR 5930 AND datadstuser root

# Activer le module GeoIP dans Logstash (pipeline inclus)
# Kibana Maps : visualiser les IPs sources par pays
# Alerte : connexion SSH réussie depuis pays != FR