{"id":12471,"date":"2022-05-01T08:45:58","date_gmt":"2022-05-01T05:45:58","guid":{"rendered":"https:\/\/kifarunix.com\/?p=12471"},"modified":"2024-03-09T14:52:42","modified_gmt":"2024-03-09T11:52:42","slug":"process-modsecurity-logs-using-wazuh","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/process-modsecurity-logs-using-wazuh\/","title":{"rendered":"Process ModSecurity Logs using Wazuh"},"content":{"rendered":"\n

This guide will take you through how to process ModSecurity logs using Wazuh. ModSecurity<\/a> WAF can be integrated with Wazuh in order to process the generated alert logs for better analysis and visualization.<\/p>\n\n\n\n

Process ModSecurity Logs using Wazuh<\/h2>\n\n\n\n

Install and setup Wazuh server;<\/h3>\n\n\n\n

If not already configured, use the guides below to install and setup Wazuh;<\/p>\n\n\n\n

Install and Configure Wazuh Manager on Ubuntu 22.04<\/a><\/p>\n\n\n\n

Install Wazuh Server on Rocky Linux 8<\/a><\/p>\n\n\n\n

Install and Configure ModSecurity WAF<\/h3>\n\n\n\n

On you web servers, you need to install and activate ModSecurity WAF to protect your web server against attacks. You can use the guides below on how to install and configure ModSecurity WAF;<\/p>\n\n\n\n

Install ModSecurity with Apache on Ubuntu 22.04<\/a><\/p>\n\n\n\n

Install ModSecurity 3 with Apache in a Docker Container<\/a><\/p>\n\n\n\n

Modsecurity Logging<\/h3>\n\n\n\n

By default, ModSecurity logs attack related logs to HTTP server Error log file or to the ModSecurity audit logs file.<\/p>\n\n\n\n

In order to be able to process the ModSecurity Logs using Wazuh, the logs that are written to the HTTP server needs to be collected using Wazuh agent and pushed to the Wazuh manager for processing.<\/p>\n\n\n\n

In my current setup, my Modsecurity WAF is logging to Apache Error log file;<\/p>\n\n\n\n

grep denied \/var\/log\/apache2\/error.log<\/code><\/pre>\n\n\n\n
Sample log;<\/p>\n\n\n\n
[Sat Apr 30 23:42:36.559613 2022] [:error] [pid 4504:tid 140114027435584] [client 127.0.0.1:57026] [client 127.0.0.1] ModSecurity: Access denied with code 403 (phase 2). Matched phrase \"bin\/ls\" at ARGS:doc. [file \"\/etc\/modsecurity\/crs\/rules\/REQUEST-932-APPLICATION-ATTACK-RCE.conf\"] [line \"518\"] [id \"932160\"] [msg \"Remote Command Execution: Unix Shell Code Found\"] [data \"Matched Data: bin\/ls found within ARGS:doc: \/bin\/ls\"] [severity \"CRITICAL\"] [ver \"OWASP_CRS\/3.2.0\"] [tag \"application-multi\"] [tag \"language-shell\"] [tag \"platform-unix\"] [tag \"attack-rce\"] [tag \"paranoia-level\/1\"] [tag \"OWASP_CRS\"] [tag \"OWASP_CRS\/WEB_ATTACK\/COMMAND_INJECTION\"] [tag \"WASCTC\/WASC-31\"] [tag \"OWASP_TOP_10\/A1\"] [tag \"PCI\/6.5.2\"] [hostname \"localhost\"] [uri \"\/\"] [unique_id \"Ym2fPFtd6Nody7X50nHgUwAAAAA\"]<\/code><\/pre>\n\n\n\n
Configure Wazuh Agent to Read ModSecurity Logs<\/h3>\n\n\n\n
Thus, you can now configure Wazuh agents to read the Apache error log and push the ModSecurity events to the Wazuh manager for processing.<\/p>\n\n\n\n
vim \/var\/ossec\/etc\/ossec.conf<\/code><\/pre>\n\n\n\n
Within the <ossec_config><\/code><\/strong> and <\/ossec_config><\/code><\/strong>, paste the configuration lines below;<\/p>\n\n\n\n
\n  <localfile>\n    <log_format>apache<\/log_format>\n    <location>\/var\/log\/apache2\/access.log<\/location>\n  <\/localfile>\n  <localfile>\n    <log_format>apache<\/log_format>\n    <location>\/var\/log\/apache2\/error.log<\/location>\n  <\/localfile>\n<\/code><\/pre>\n\n\n\n
Save and exit the file;<\/p>\n\n\n\n
Check for any syntax error;<\/p>\n\n\n\n
\/var\/ossec\/bin\/wazuh-syscheckd<\/code><\/pre>\n\n\n\n
Exit status is 0 if no error.<\/p>\n\n\n\n
Restart Wazuh agent;<\/p>\n\n\n\n
systemctl restart wazuh-agent<\/code><\/pre>\n\n\n\n
Verify Wazuh ModSecurity Log Processing<\/h3>\n\n\n\n
By default, Wazuh manager ships with ruleset that can process ModSecurity events for better visualization and analysis.<\/p>\n\n\n\n
Thus, navigate to Wazuh web interface and check the events related to the Wazuh agent shipping the ModSecurity logs.<\/p>\n\n\n\n
Sample events;<\/p>\n\n\n\n
\"Process<\/figure><\/a><\/div>\n\n\n\n
Expanding the event;<\/p>\n\n\n\n
\"Process<\/figure>\n\n\n\n
And that is how you can use Wazuh to process ModSecurity Logs.<\/p>\n\n\n\n
Want to apply further processing to ModSecurity logs? Check the guide below;<\/p>\n\n\n\n
Process and Visualize ModSecurity Logs on ELK Stack<\/a><\/p>\n\n\n\n
Other Tutorials<\/p>\n\n\n\n
Create Kibana Visualization Dashboards for ModSecurity Logs<\/a><\/p>\n\n\n\n
Restrict Access to WordPress Login Page to Specific IPs with libModSecurity<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
This guide will take you through how to process ModSecurity logs using Wazuh. ModSecurity WAF can be integrated with Wazuh in order to process the<\/p>\n","protected":false},"author":3,"featured_media":12474,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,1207,72,34],"tags":[4982,1141,4984,3824,4985,4983],"class_list":["post-12471","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-modsecurity","category-monitoring","category-security","tag-integrate-modsecurity-with-wazuh","tag-modsecurity-3","tag-process-modsecurity-logs-using-wazuh","tag-wazuh","tag-wazuh-analyze-modsecurity-logs","tag-wazuh-and-modsecurity","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/12471"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=12471"}],"version-history":[{"count":2,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/12471\/revisions"}],"predecessor-version":[{"id":20554,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/12471\/revisions\/20554"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/12474"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=12471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=12471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=12471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}