| 1 | Windows custom active response configuration |
| 2 | |
| 3 | You can implement the custom Python script on Windows endpoints using two methods. The first method converts Python scripts to executable applications, while the second method uses a Windows Batch launcher to run the Python script. |
| 4 | |
| 5 | Both methods require Python installed on the Windows endpoint. Use the following steps below to install Python on the Windows endpoint. |
| 6 | |
| 7 | #. Download Python executable installer from the `official Python website <https://www.python.org/downloads/windows/>`\_\_. |
| 8 | #. Run the Python installer once downloaded. Check the following boxes when prompted and start the installation: |
| 9 | |
| 10 | - **Use admin privileges when installing py.exe**. |
| 11 | - **Add python.exe to PATH**. This places the interpreter in the execution path. |
| 12 | |
| 13 | Or you can use the following PowerShell command to install Python: |
| 14 | |
| 15 | ``` |
| 16 | Invoke-WebRequest -Uri "https://www.python.org/ftp/python/3.11.0/python-3.11.0-amd64.exe" -OutFile "$env:TEMP\python-3.11.0-amd64.exe"; Start-Process -FilePath "$env:TEMP\python-3.11.0-amd64.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1" -Wait -NoNewWindow |
| 17 | ``` |
| 18 | |
| 19 | Method 1: Convert the Python script to an executable application |
| 20 | """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" |
| 21 | |
| 22 | #. Open an administrator PowerShell terminal and use `pip` to install `pyinstaller`: |
| 23 | |
| 24 | > pip install pyinstaller |
| 25 | > pyinstaller --version |
| 26 | |
| 27 | #. Run the following command using PowerShell with administrator privileges to create the executable file: |
| 28 | |
| 29 | ❗ - Make sure to point to the Wazuh DLLs |
| 30 | |
| 31 | ```powershell |
| 32 | pyinstaller --log-level DEBUG --add-data "C:\Program Files (x86)\ossec-agent\libwazuhext.dll;." --add-data "C:\Program Files (x86)\ossec-agent\libwinpthread-1.dll;." --add-data "C:\Program Files (x86)\ossec-agent\libwazuhshared.dll;." -F <PATH_TO_CUSTOM-AR.PY> |
| 33 | ``` |
| 34 | |
| 35 | You can find the created `custom-ar.exe` executable in the `C:\Users\<USER>\dist\` directory. |
| 36 | |
| 37 | #. Copy the `custom-ar.exe` executable file to `C:\Program Files (x86)\ossec-agent\active-response\bin\` directory on the monitored endpoint. |
| 38 | #. Restart the Wazuh agent using PowerShell with administrator privileges to apply the changes: |
| 39 | |
| 40 | .. code-block:: console |
| 41 | |
| 42 | > Restart-Service -Name wazuh |
| 43 | |
| 44 | #. On the Wazuh server, add the `<command>` and `<active-response>` blocks below to the `/var/ossec/etc/ossec.conf` configuration file. This uses the `custom-ar.exe` executable for Windows endpoints. |
| 45 | |
| 46 | ```xml |
| 47 | <command> |
| 48 | <name>windows_firewall</name> |
| 49 | <executable>windows_firewall.exe</executable> |
| 50 | <timeout_allowed>no</timeout_allowed> |
| 51 | </command> |
| 52 | |
| 53 | <active-response> |
| 54 | <disabled>no</disabled> |
| 55 | <command>windows_firewall</command> |
| 56 | <location>local</location> |
| 57 | <timeout>60</timeout> |
| 58 | </active-response> |
| 59 | ``` |