Wazuh

Wazuh can run a custom integration for alerts that match chosen rule groups. This one looks up the alert's source address and sends the result back into Wazuh, where a rule raises a new alert when the address is listed.

Set it up on the Wazuh manager

1. Save the integration as /var/ossec/integrations/custom-isipsafe (the name must start with custom-), then chmod 750 and chown root:wazuh it:

   #!/var/ossec/framework/python/bin/python3
   # Wazuh calls: custom-isipsafe <alert file> <api key> <hook url>
   import json, socket, sys
   import requests
   
   alert = json.load(open(sys.argv[1]))
   key, url = sys.argv[2], sys.argv[3]
   ip = alert.get("data", {}).get("srcip")
   if not ip:
       sys.exit(0)
   
   r = requests.get(url, params={"ip": ip, "maxAgeInDays": 30}, headers={"Authorization": "Bearer " + key}, timeout=10)
   if r.status_code != 200:
       sys.exit(0)
   d = r.json()["data"]
   if not d.get("isPublic"):
       sys.exit(0)
   
   msg = {
       "integration": "isipsafe",
       "isipsafe": {
           "ip": ip,
           "score": d["abuseConfidenceScore"],
           "listed": "yes" if d["abuseConfidenceScore"] >= 75 else "no",
           "reports": d["totalReports"],
           "country": d.get("countryCode") or "",
           "categories": ",".join(d.get("categories", [])),
           "link": d.get("link", ""),
           "source_rule": alert.get("rule", {}).get("id"),
       },
   }
   sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
   sock.connect("/var/ossec/queue/sockets/queue")
   sock.send(("1:isipsafe:" + json.dumps(msg)).encode())
   sock.close()

2. Enable it in /var/ossec/etc/ossec.conf, for the rule groups whose alerts carry an attacker's address:

   <integration>
     <name>custom-isipsafe</name>
     <hook_url>https://isipsafe.com/api/v1/check</hook_url>
     <api_key>sl_your_key_here</api_key>
     <group>authentication_failed,authentication_failures,sshd,web,</group>
     <alert_format>json</alert_format>
   </integration>

3. Add rules in /var/ossec/etc/rules/local_rules.xml:

   <group name="isipsafe,">
     <rule id="100650" level="3">
       <decoded_as>json</decoded_as>
       <field name="integration">isipsafe</field>
       <description>isIPsafe: $(isipsafe.ip) has abuse confidence $(isipsafe.score)</description>
     </rule>
     <rule id="100651" level="10">
       <if_sid>100650</if_sid>
       <field name="isipsafe.listed">yes</field>
       <description>isIPsafe: $(isipsafe.ip) is a known attacker ($(isipsafe.score)%, $(isipsafe.categories))</description>
     </rule>
   </group>

4. Restart with systemctl restart wazuh-manager. Listed addresses now raise level 10 alerts you can tie to an active response, such as firewall-drop on rule 100651.

Each matching alert is one lookup, counted against your daily allowance. Narrow the <group> list, or add <level> to only look up alerts above a severity.

Need a hand?

If something here does not work with your version of Wazuh, or you have improved it, tell us. We update these pages with what people send.

Wazuh and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.