Okay, time to start our rule creation journey.
Let's exec into the wazuh‑manager‑container. Custom rules are
defined within the etc/rules directory.
You might be wondering,
how do custom files get into the container? For this, check out
the Wazuh containers volume section within the Docker Compose
file. For additional context on this,
please check out course notes number 10 and number 11.
Okay, let's go ahead and check out our first rule.
At this point, we see two custom rules.
The first rule fires when a change to etc preload occurs.
The second rule fires when multiple changes to etc preload occur.
For now,
let's focus on the first rule. We'll get to the other one a little bit later.
Why do we need this first rule?
As a brief recap, the ossec.conf file configured
syscheck to monitor these paths.
This configuration,
coupled with the syscheck rules that we previously saw, allows
Wazuh to create alerts for file operations.
However, we want to trigger a custom script whenever etc preload changes.
For that, we need to create a more granular rule.
First,
we define an overarching group for our customizations. In
general, Wazuh uses local to refer to custom rules.
Second,
we declare the rule. Wazuh reserves rule ids 100000 to 120000 for custom rules.
Next up is the rule severity,
which can be between 0 and 15, 11 maps to integrity checking warning.
To see a mapping of all of the severity levels,
please go to course notes number 12.
The ignore field makes sure this rule is only triggered
every 1 second. As a blue teamer,
you need to think of how attackers can use your mitigations in unintended ways.
If a rule triggers a resource‑intensive script,
we don't want a flood of alerts to cause a denial‑of‑service attack on
Wazuh. If we were using this rule in production,
the ignore value would be a little bit higher.
However,
I'll keep that value low for testing purposes. To make sure the rule is
active, I'm going to delete the noalert attribute. If_group means that this
rule will fire if another rule in the syscheck group is triggered. In an
earlier section, we saw that FIM rules for adding, modifying, and deleting
files were housed within the syscheck group.
Okay, so what about match?
Match will match text somewhere within the alert body.
Alright, onto the description tag.
This text appears within the Kibana alert.
So if you want to stay on the pleasant side of your teammates,
you'd want to make this somewhat descriptive.
Alright, nice, we're done.
I'm going to save our changes and exit.