52 lines
2.1 KiB
XML
52 lines
2.1 KiB
XML
<!--
|
|
Fleet auditd rules — install on the SIEM node (wazuh.master) at
|
|
/var/ossec/etc/rules/local_rules.xml, then restart the manager. Pairs with
|
|
local_decoder.xml.
|
|
|
|
Design: the BASE rule is level 0 — every decoded fleet auditd record is captured
|
|
(searchable, archived) but does NOT raise an alert, so the high-volume
|
|
SYSCALL/PATH/PROCTITLE/EOE stream (e.g. Chromium) doesn't flood alerts.json.
|
|
Security-relevant record TYPES are bumped to alerting levels below. Tune to your
|
|
detection needs. To see the FULL audit trail (not just alerts) in the dashboard,
|
|
enable archive indexing (wazuh-archives-*) — see README.
|
|
-->
|
|
<group name="fleet_audit,">
|
|
|
|
<!-- base: any decoded fleet auditd record (level 0 = logged, not alerted) -->
|
|
<rule id="100100" level="0">
|
|
<decoded_as>fleet-auditd</decoded_as>
|
|
<description>Fleet auditd: $(audit.type) on $(audit.node)</description>
|
|
</rule>
|
|
|
|
<!-- authentication / credential events -->
|
|
<rule id="100110" level="5">
|
|
<if_sid>100100</if_sid>
|
|
<field name="audit.type">^USER_LOGIN$|^USER_AUTH$|^USER_ACCT$|^USER_ERR$|^CRED_</field>
|
|
<description>Fleet audit: authentication event $(audit.type) on $(audit.node)</description>
|
|
<group>authentication,</group>
|
|
</rule>
|
|
|
|
<!-- failed auth (res/success = failed/no/0) -> higher -->
|
|
<rule id="100111" level="8">
|
|
<if_sid>100110</if_sid>
|
|
<field name="audit.res">^failed$|^no$|^0$</field>
|
|
<description>Fleet audit: FAILED authentication $(audit.type) on $(audit.node)</description>
|
|
<group>authentication_failed,</group>
|
|
</rule>
|
|
|
|
<!-- SELinux denials / kernel anomaly records -->
|
|
<rule id="100120" level="7">
|
|
<if_sid>100100</if_sid>
|
|
<field name="audit.type">^AVC$|^SELINUX_ERR$|^ANOM_|^USER_AVC$</field>
|
|
<description>Fleet audit: SELinux/anomaly $(audit.type) on $(audit.node)</description>
|
|
</rule>
|
|
|
|
<!-- privilege use / config changes worth surfacing -->
|
|
<rule id="100130" level="5">
|
|
<if_sid>100100</if_sid>
|
|
<field name="audit.type">^USER_CMD$|^USYS_CONFIG$|^ADD_USER$|^DEL_USER$|^ADD_GROUP$|^ROLE_</field>
|
|
<description>Fleet audit: privileged/config event $(audit.type) on $(audit.node)</description>
|
|
</rule>
|
|
|
|
</group>
|