Doc::Secure: Difference between revisions
Created page with "== Introduction == The department offers a security and vulnerability monitoring service. It is primarily aimed at Linux based machines, but also supports Windows and Mac. == How it Works == The service is based on Wazuh (https://wazuh.com/). It runs a lightweight agent on the endpoint that automatically scans the machine for vulnerabilities, and reports any alerts to our central service. Here are some examples of the type of things wazuh scans for: * Malware detectio..." |
No edit summary |
||
(8 intermediate revisions by the same user not shown) | |||
Line 25: | Line 25: | ||
protect=1 | protect=1 | ||
EOF | EOF | ||
sudo WAZUH_MANAGER=' | sudo WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD=$'secure' yum install wazuh-agent | ||
</pre> | </pre> | ||
* '''Note:''' If you have specific wazuh group that you want to join, you can add <code>WAZUH_AGENT_GROUP='<groupname>'</code> | |||
== Ubuntu or Debian based Linux === | === Ubuntu or Debian based Linux === | ||
Run the following commands, requires sudo access: | Run the following commands, requires sudo access: | ||
<pre> | <pre> | ||
Line 34: | Line 35: | ||
sudo echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list | sudo echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list | ||
sudo apt update | sudo apt update | ||
sudo WAZUH_MANAGER=' | sudo WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD=$'secure' apt install wazuh-agent | ||
</pre> | </pre> | ||
* '''Note:''' If you have specific wazuh group that you want to join, you can add <code>WAZUH_AGENT_GROUP='<groupname>'</code> | |||
=== Other RPM based Linux === | === Other RPM based Linux === | ||
Line 41: | Line 43: | ||
<pre> | <pre> | ||
curl -o wazuh-agent-4.9.0-1.x86_64.rpm https://packages.wazuh.com/4.x/yum/wazuh-agent-4.9.0-1.x86_64.rpm | curl -o wazuh-agent-4.9.0-1.x86_64.rpm https://packages.wazuh.com/4.x/yum/wazuh-agent-4.9.0-1.x86_64.rpm | ||
sudo WAZUH_MANAGER=' | sudo WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD=$'secure' rpm -ihv wazuh-agent-4.9.0-1.x86_64.rpm | ||
sudo systemctl daemon-reload | sudo systemctl daemon-reload | ||
sudo systemctl enable --now wazuh-agent | sudo systemctl enable --now wazuh-agent | ||
</pre> | </pre> | ||
* '''Note:''' If you have specific wazuh group that you want to join, you can add <code>WAZUH_AGENT_GROUP='<groupname>'</code> | |||
=== Other DEB based Linux === | === Other DEB based Linux === | ||
Line 50: | Line 53: | ||
<pre> | <pre> | ||
wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.0-1_amd64.deb | wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.0-1_amd64.deb | ||
sudo WAZUH_MANAGER=' | sudo WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD=$'secure' dpkg -i ./wazuh-agent_4.9.0-1_amd64.deb | ||
sudo systemctl daemon-reload | sudo systemctl daemon-reload | ||
sudo systemctl enable --now wazuh-agent | sudo systemctl enable --now wazuh-agent | ||
</pre> | </pre> | ||
* '''Note:''' If you have specific wazuh group that you want to join, you can add <code>WAZUH_AGENT_GROUP='<groupname>'</code> | |||
=== Windows === | |||
Run the following powershell commands, run as administrator: | |||
<pre> | |||
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi -OutFile ${env.tmp}\wazuh-agent; msiexec.exe /i ${env.tmp}\wazuh-agent /q WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD='secure' | |||
NET START WazuhSvc | |||
</pre> | |||
* '''Note:''' If you have specific wazuh group that you want to join, you can add <code>WAZUH_AGENT_GROUP='<groupname>'</code> | |||
=== Silicon based Mac === | |||
Run the following in a terminal shell, requires administrator access: | |||
<pre> | |||
curl -so wazuh-agent.pkg https://packages.wazuh.com/4.x/macos/wazuh-agent-4.9.0-1.arm64.pkg && echo "WAZUH_MANAGER='secure.cs.vt.edu' && WAZUH_REGISTRATION_PASSWORD='secure'\n" > /tmp/wazuh_envs && sudo installer -pkg ./wazuh-agent.pkg -target / | |||
sudo /Library/Ossec/bin/wazuh-control start | |||
</pre> | |||
* '''Note:''' If you have specific wazuh group that you want to join, you can add <code>WAZUH_AGENT_GROUP='<groupname>'</code> | |||
=== Intel based Mac === | |||
Run the following in a terminal shell, requires administrator access: | |||
<pre> | |||
curl -so wazuh-agent.pkg https://packages.wazuh.com/4.x/macos/wazuh-agent-4.9.0-1.intel64.pkg && echo "WAZUH_MANAGER='secure.cs.vt.edu' && WAZUH_REGISTRATION_PASSWORD='secure'\n" > /tmp/wazuh_envs && sudo installer -pkg ./wazuh-agent.pkg -target / | |||
sudo /Library/Ossec/bin/wazuh-control start | |||
</pre> | |||
* '''Note:''' If you have specific wazuh group that you want to join, you can add <code>WAZUH_AGENT_GROUP='<groupname>'</code> | |||
=== Alerts === | |||
Alerts will be monitored by Techstaff. If you want to get emailed directly when alerts happen, [[Contact Techstaff]]. |
Latest revision as of 09:37, 17 October 2024
Introduction
The department offers a security and vulnerability monitoring service. It is primarily aimed at Linux based machines, but also supports Windows and Mac.
How it Works
The service is based on Wazuh (https://wazuh.com/). It runs a lightweight agent on the endpoint that automatically scans the machine for vulnerabilities, and reports any alerts to our central service. Here are some examples of the type of things wazuh scans for:
- Malware detection
- Known software vulnerabilties
- File Integrity - changes to known system files
- Logs for active threats
Install
Installing the CS secure service is easy, and usually a set and forget operation.
Redhat, Rocky, or CentOS based Linux
Run the following commands, requires sudo access:
sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH sudo cat > /etc/yum.repos.d/wazuh.repo << EOF [wazuh] gpgcheck=1 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH enabled=1 name=EL-\$releasever - Wazuh baseurl=https://packages.wazuh.com/4.x/yum/ protect=1 EOF sudo WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD=$'secure' yum install wazuh-agent
- Note: If you have specific wazuh group that you want to join, you can add
WAZUH_AGENT_GROUP='<groupname>'
Ubuntu or Debian based Linux
Run the following commands, requires sudo access:
sudo curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg sudo echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list sudo apt update sudo WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD=$'secure' apt install wazuh-agent
- Note: If you have specific wazuh group that you want to join, you can add
WAZUH_AGENT_GROUP='<groupname>'
Other RPM based Linux
Run the following commands, requires sudo access:
curl -o wazuh-agent-4.9.0-1.x86_64.rpm https://packages.wazuh.com/4.x/yum/wazuh-agent-4.9.0-1.x86_64.rpm sudo WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD=$'secure' rpm -ihv wazuh-agent-4.9.0-1.x86_64.rpm sudo systemctl daemon-reload sudo systemctl enable --now wazuh-agent
- Note: If you have specific wazuh group that you want to join, you can add
WAZUH_AGENT_GROUP='<groupname>'
Other DEB based Linux
Run the following commands, request sudo access:
wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.0-1_amd64.deb sudo WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD=$'secure' dpkg -i ./wazuh-agent_4.9.0-1_amd64.deb sudo systemctl daemon-reload sudo systemctl enable --now wazuh-agent
- Note: If you have specific wazuh group that you want to join, you can add
WAZUH_AGENT_GROUP='<groupname>'
Windows
Run the following powershell commands, run as administrator:
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi -OutFile ${env.tmp}\wazuh-agent; msiexec.exe /i ${env.tmp}\wazuh-agent /q WAZUH_MANAGER='secure.cs.vt.edu' WAZUH_REGISTRATION_PASSWORD='secure' NET START WazuhSvc
- Note: If you have specific wazuh group that you want to join, you can add
WAZUH_AGENT_GROUP='<groupname>'
Silicon based Mac
Run the following in a terminal shell, requires administrator access:
curl -so wazuh-agent.pkg https://packages.wazuh.com/4.x/macos/wazuh-agent-4.9.0-1.arm64.pkg && echo "WAZUH_MANAGER='secure.cs.vt.edu' && WAZUH_REGISTRATION_PASSWORD='secure'\n" > /tmp/wazuh_envs && sudo installer -pkg ./wazuh-agent.pkg -target / sudo /Library/Ossec/bin/wazuh-control start
- Note: If you have specific wazuh group that you want to join, you can add
WAZUH_AGENT_GROUP='<groupname>'
Intel based Mac
Run the following in a terminal shell, requires administrator access:
curl -so wazuh-agent.pkg https://packages.wazuh.com/4.x/macos/wazuh-agent-4.9.0-1.intel64.pkg && echo "WAZUH_MANAGER='secure.cs.vt.edu' && WAZUH_REGISTRATION_PASSWORD='secure'\n" > /tmp/wazuh_envs && sudo installer -pkg ./wazuh-agent.pkg -target / sudo /Library/Ossec/bin/wazuh-control start
- Note: If you have specific wazuh group that you want to join, you can add
WAZUH_AGENT_GROUP='<groupname>'
Alerts
Alerts will be monitored by Techstaff. If you want to get emailed directly when alerts happen, Contact Techstaff.