Monitoring tool for CTF-Creator
Set up a Wazuh environment with extended monitoring, specialized in supervising cybersecurity training environments created by the CTF-Creator
Wazuh: Wazuh Website
Grafana: Grafana Website
CTF-Creator: GitHub Page
sudo ./set_up.sh
Set up the components on the same or different systems
- Install and set up Docker on Systems where the Wazuh Manager and Grafana should run.
sudo ./set_up_docker.sh
If you have Docker already installed, make sure the current user is inside a Docker group:
sudo groupadd docker
sudo usermod -aG docker $user
- Install and set up Wazuh Manager:
sudo ./WazuhDocker/set_up.sh
more info: Wazuh Manager
- Install and set up Wazuh Agent:
sudo ./WazuhAgent/set_up_agent.sh
If the Agent is on a different system than the Manager, you need to provide the Manager's IP:
sudo ./WazuhAgent/set_up_agent.sh --manager=<manager_ip_address>
more info: Wazuh Agent
- Install and set up cAdvisor
sudo ./cAdvisorDocker/set_up_cadvisor.sh
on the supervised system.
more info: cAdvisor Docker
- Install and set up Grafana
sudo ./GrafanaDocker/set_up_grafana.sh
If Grafana is on a different system than the Manager, you need to provide the Manager's IP:
sudo ./GrafanaDocker/set_up_grafana.sh --manager=<manager_ip_address>
more info: Grafana Dashboard
- Now you can visit the Wazuh and Grafana dashboards in your browser via:
Wazuh:
https://<wazuh_ip>
Default user is Admin and password is SecretPassword
Grafana:
https://<grafana_ip>:3000
Default user is Admin and password is Admin
Incomplete list of Grafana Dashboard Features
- Live surveillance of the Wazuh Manager System resources
- Number of current active users, as well as an active user timeline
- All currently active users and from where they are connected
- All commands executed by users. Filterable by user. Sudo commands are highlighted.
- A life graph tracking the number of successful and unsuccessful SSH requests
- A list of all active UFW Rules
- A List of Blocked UFW Events
- A list of heiDPId flow events. Traffic outside is highlighted.
- A list of heiDPId packed events. Traffic outside is highlighted.
- Traffic outside is visualized and pinpointed on a world map.
The custom Wazuh alerts, their ID, and level.
| Description | Rule ID | Level |
|---|---|---|
| CPU / MEMORY / DISK usage metrics | 100100 | 3 |
| Memory usage is high | 100101 | 12 |
| CPU usage is high | 100102 | 12 |
| Disk space is running low | 100103 | 12 |
| Load average metrics | 100104 | 3 |
| Memory metrics | 100105 | 3 |
| Disk metrics | 100106 | 3 |
| Description | Rule ID | Level |
|---|---|---|
| Active user check | 100201 | 3 |
| Active user number check | 100202 | 1 |
| Description | Rule ID | Level |
|---|---|---|
| sshd: authentication failed | 100301 | 5 |
| Description | Rule ID | Level |
|---|---|---|
| Bash command used | 100401 | 3 |
| Description | Rule ID | Level |
|---|---|---|
| heiDPI flow event | 100501 | 3 |
| heiDPI packet event | 100502 | 3 |
| Description | Rule ID | Level |
|---|---|---|
| UFW Status | 100600 | 3 |
| Firewall block event | 100601 | 5 |
| Multiple Firewall block events from same source | 100602 | 5 |
| Description | Rule ID | Level |
|---|---|---|
| OpenVPN access server messages grouped | 100701 | 1 |
| OpenVPN remote connection established | 100702 | 3 |
If you want to make changes to the setup, change the following files:
Custom Wazuh Rules can be created as described in the Wazuh Documentation. If you only want to change them in a running setup, keep in mind that the mentioned files and commands must be altered and executed inside the corresponding Docker container. You can easily work inside a container with
docker exec -it <container_id_or_name>
Else, modify local_file_ossec_conf, local_decoder.xml and local_rules.xml and use this project as usual.
Simply modify the dashboard via the Grafana UI.
If you want to use your custom dashboard in this project, export it via the Grafana UI. Make sure to use the 'Export the dashboard to use in another instance' setting and encase the output in a dashboard key: {"dashboard":<outuput>}
Then override the wazuh_dashboard.json and use this project as usual.
The setup ignores containers created from specific images. They are defined by the EXCLUDED_IMAGES array at the top of the files
set_up.sh and
container_logging_set_up.sh. Add or remove image names to include or exclude their containers.