Putting Host-based Intrusion Detection
Into Practice Using OSSEC
Clay Wells (clayw at upenn.edu)
School of Arts and Sciences
Slide 2
Slide 2 text
“By 2020, 75% of enterprises' information security
budgets will be allocated for rapid detection and
response approaches, up from less than 10% in
2012.”
- Gartner, Inc.
Slide 3
Slide 3 text
OSSEC
Agenda
Introduction
Rules
Email Alerts
Active Response
OSSEC Commands
Reports
Graphs
Future Work
Slide 4
Slide 4 text
OSSEC-HIDS
Open Source Security
Host-based Intrusion Detection System
Rules
Atomic – single events, no correlation
5700
fatal: Timeout before authentication for
Timeout while logging in (sshd).
Composite – multiple events
5710
SSHD brute force trying to get access to
the system.
authentication_failures,
Custom Rules
103006
^128.91.|^130.91.|^165.123.|^158.130.
Possible web attack from a Penn IP address
Slide 20
Slide 20 text
Decoders (complex)
sshd
^reverse mapping checking
^\w+ for \S+ [(\S+)] |^\w+ for (\S+)
srcip
Slide 21
Slide 21 text
Decoders (simple)
^MySQL log:
Slide 22
Slide 22 text
Output & Alert Options
Sending alerts via syslog
Sending alerts via E-Mail*
Storing alerts as JSON
Sending output to a Database*
Daily E-Mail Reports*
Sending alerts to picviz
Sending output to prelude
Slide 23
Slide 23 text
Email Alerts
Single Notification addresses
Granular Notifications to any number of addresses
Daily Reports
agent_control
# bin/agent_control -h
agent_control: Control remote agents.
Available options:
-l List available (active or not) agents.
-lc List active agents.
-i Extracts information from an agent.
-R Restarts agent.
-r -a Runs the integrity/rootkit checking on all agents now.
-r -u Runs the integrity/rootkit checking on one agent now.
-b Blocks the specified ip address.
-f Used with -b, specifies which response to run.
-L List available active responses.
-s Changes the output to CSV (comma delimited).
Slide 36
Slide 36 text
agent_control
# bin/agent_control -l
OSSEC HIDS agent_control. List of available agents:
ID: 000, Name: info_.___.___.edu (server), IP: 127.0.0.1, Active/Local
ID: 002, Name: v__.___.___.edu, IP: 128.###.###.142, Active
ID: 004, Name: s__.___.___.edu, IP: 128.###.###.66, Disconnected
Slide 37
Slide 37 text
agent_control
# bin/agent_control -i 002
OSSEC HIDS agent_control. Agent information:
Agent ID: 002
Agent Name: v__.___.___.edu
IP address: 128.###.###.142
Status: Active
Operating system: Linux v_.__.__.edu 2.6.18-400.1.1.el5 #1 SMP ..
Client version: OSSEC HIDS v2.7
Last keep alive: Sun Feb 7 20:15:05 2016
Syscheck last started at: Sun Feb 7 00:31:07 2016
Rootcheck last started at: Sun Feb 7 00:46:24 2016
Slide 38
Slide 38 text
rootcheck_control
# bin/rootcheck_control -h
rootcheck_control: Manages the policy and auditing database.
-i Prints database for the agent.
-r Used with -i, prints all the resolved issues.
-q Used with -i, prints all the outstanding issues.
-L Used with -i, prints the last scan.
-s Changes the output to CSV (comma delimited).
Slide 39
Slide 39 text
rootcheck_control
# bin/rootcheck_control -i 002
Policy and auditing events for agent 'v__.__.___.edu (002) - 128.###.###.142':
Resolved events:
2013 Jun 27 00:45:12 (first time detected: 2013 May 28 14:50:04)
System Audit: System Audit: CIS - Testing against the CIS Red Hat
Enterprise Linux 5 Benchmark v1.1. File: /etc/redhat-release. Reference:
http://www.ossec.net/wiki/index.php/CIS_RHEL5 .
2013 Jun 27 00:45:12 (first time detected: 2013 May 28 14:50:04)
System Audit: System Audit: CIS - RHEL5 4.4 - GUI login enabled. File:
/etc/inittab. Reference: http://www.ossec.net/wiki/index.php/CIS_RHEL5 .
Slide 40
Slide 40 text
syscheck_control
# bin/syscheck_control -h
syscheck_control: Manages the integrity checking database.
-i List modified files for the agent.
-r -i List modified registry entries for the agent (Windows only).
-f Prints information about a modified file.
-s Changes the output to CSV (comma delimited).
Slide 41
Slide 41 text
syscheck_control
# bin/syscheck_control -i 002
Changes for 2015 Nov 13:
2015 Nov 13 22:52:58,2 - /etc/passwd
2015 Nov 13 22:53:04,2 - /etc/ld.so.cache
2015 Nov 13 22:58:08,2 - /etc/shadow
2015 Nov 13 22:58:12,2 - /etc/group
2015 Nov 13 22:58:22,2 - /etc/gshadow
Changes for 2015 Nov 14:
2015 Nov 14 22:56:11,0 - /usr/bin/curve_keygen
2015 Nov 14 22:57:09,0 - /usr/bin/python26
2015 Nov 14 22:57:09,0 - /usr/bin/python2.6
Reports
# bin/ossec-reportd -h
ossec-reportd: Generate reports (via stdin).
Available options:
-f Filter the results.
-r Show related entries.
-n Creates a description for the report.
-s Show the alert dump.
Filters allowed: group, rule, level, location,
user, srcip, filename
Examples:
-f group authentication_success (to filter on login success).
-f level 10 (to filter on level >= 10).
-f group authentication -r user srcip (to show the srcip for all users).
Reports
Related entries for 'Rule':
------------------------------------------------
104570 - Common web attack. Attempt to do di.. |70
srcip: '68.180.228.162'
srcip: '37.57.231.111'
srcip: '220.181.108.82'
srcip: '217.73.208.147'