Wazuh: Add correlation for multiple log sources - AND condition

[soulmaster43]

Hi guys,

I was recently working on fine-tuning some rules and configuration for wazuh and it occured to me that I am unable to correlate a field from two different log sources.
A possible use case would be correlating a common field such as between web logs and IDS.
If the same source IP is noticed in both logs within a set timeframe, trigger an alert.
This would be useful if I wanted to check if the alerts triggered by a NIDS are actually succesful attacks, searching for the status of the possible attack in the web alerts.
Probably the best way to implement this would be to insert an AND condition for , allowing the correlation of a common field between two (or more) rules, provided the field exists in the underlying rules. Does that make any sense to you?
I think it will provide a lot of value in the long run.

Thank you.

[Zenidd]

Hello @soulmaster43,

I was recently working on fine-tuning some rules and configuration for wazuh and it occured to me that I am unable to correlate a field from two different log sources.

Several users have reported us that they would like to see this feature in Wazuh, in fact, we have two open issues with a similar topic:

• https://github.com/wazuh/wazuh/issues/3852
• https://github.com/wazuh/wazuh/issues/1477

You could track our progress in the task in these issues.

Probably the best way to implement this would be to insert an AND condition for , allowing the correlation of a common field between two (or more) rules, provided the field exists in the underlying rules. Does that make any sense to you?

I really like the syntax you proposed here, so I'm writing here a dummy example rule ---even though it raises a lot of questions for me--- :

  <rule id="100007" level="14" frequency="10" timeframe="240">
    <if_matched_sid>100006|222000</if_matched_sid>
    <description>Server 500 error code (Internal Error). 4 hits in 4 mins</description>
  </rule>

Talking about the implementation of a correlation system, we are still investigating and deciding the best way to implement it, so, stay tuned for updates!

Greetings, JP Sáez

[soulmaster43]

Hi JP,

Thank you for your reply.
I will monitor the issues already opened for progress.

As far as the syntax proposed, I would like to try to give you some examples as to how I would see this implemented and try to explain my logic, maybe it will clarify some things for you.

<rule id="100007" level="14" frequency="2" timeframe="240">
<if_matched_sid>100006&&222000|100006&&222001</if_matched_sid>
<same_field>srcip</same_field>
<description>Successful exploitation of Apache/IIS vulnerability</description>
</rule>

&& - the operator AND
| - the operator OR

Assuming that rule 100006 monitors IDS logs for attacks and rule 222000 monitors apache weblogs for successful requests and 222001 monitors iis logs for similar requests, the correlation would be done by source IP in this case. Alternatively, more <same_field> statements would add more elements to be correlated: srcport, dstip, dstport etc.
The frequency is set to 2 because 2 occurrences must be noticed of the same source IP: one for rule 100006 and one for rule 222000 or 222001. If 3 rules were correlated with an AND statement, then the frequency should in increased to 3. (100006&&222000&&222001)

I'm hoping this will help.

Best,

[Nikkhah]

100006&&222000|

Hi
Did you check and or logic in if_matche_sid tag?
I used it but it doesn't work!
Error: Invalid configuration. Element 'if_matched_sid': 5720|5716

[soulmaster43]

@Nikkhah This is a proposed feature, not an implemented one.