| 1 | # Windows Firewall |
| 2 | |
| 3 | ## Description |
| 4 | |
| 5 | Wazuh Active Response capable of creating a new rule in the Windows Firewall to block or unblock traffic to a specific IP address. |
| 6 | |
| 7 | ### Requirements |
| 8 | |
| 9 | - Python 3.11 or later installed on the Windows agent. |
| 10 | - `windows_firewall.exe` - The executable file that will be used to create the rule in the Windows Firewall. Provided by SOCFortress at `https://repo.socfortress.co/repository/socfortress/active-response/windows_firewall.exe`. |
| 11 | |
| 12 | - Must be placed in the `C:\Program Files (x86)\ossec-agent\active-response\bin` directory on the Windows agent. |
| 13 | |
| 14 | ### Download Python 3.11 |
| 15 | |
| 16 | ```powershell |
| 17 | Invoke-WebRequest -Uri "https://www.python.org/ftp/python/3.11.0/python-3.11.0-amd64.exe" -OutFile "$env:TEMP\python-3.11.0-amd64.exe"; Start-Process -FilePath "$env:TEMP\python-3.11.0-amd64.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1" -Wait -NoNewWindow |
| 18 | ``` |
| 19 | |
| 20 | ### Download Script Via PowerShell |
| 21 | |
| 22 | ```powershell |
| 23 | Invoke-WebRequest -Uri "https://repo.socfortress.co/repository/socfortress/active-response/windows_firewall.exe" -OutFile "C:\Program Files (x86)\ossec-agent\active-response\bin\windows_firewall.exe" -Credential (New-Object System.Management.Automation.PSCredential ("socfortress_installer", (ConvertTo-SecureString "6cV8uJqnQffDa3Upx" -AsPlainText -Force))) |
| 24 | ``` |
| 25 | |
| 26 | ## Wazuh Manager Configuration |
| 27 | |
| 28 | The following configuration must be added to the `ossec.conf` file on the Wazuh manager. |
| 29 | |
| 30 | ```xml |
| 31 | <command> |
| 32 | <name>windows_firewall</name> |
| 33 | <executable>windows_firewall.exe</executable> |
| 34 | <timeout_allowed>no</timeout_allowed> |
| 35 | </command> |
| 36 | |
| 37 | <active-response> |
| 38 | <disabled>no</disabled> |
| 39 | <command>windows_firewall</command> |
| 40 | <location>local</location> |
| 41 | <timeout>60</timeout> |
| 42 | </active-response> |
| 43 | ``` |
| 44 | |
| 45 | #. Create the rules file `/var/ossec/etc/rules/600000-active_response.xml` and add the following rule to trigger the custom active response: |
| 46 | |
| 47 | ```xml |
| 48 | <group name="active_response,"> |
| 49 | <rule id="600000" level="10"> |
| 50 | <decoded_as>json</decoded_as> |
| 51 | <field name="active_response">windows_firewall</field> |
| 52 | <description>Windows Firewall Active Response triggered.</description> |
| 53 | <group>socfortress,</group> |
| 54 | <options>no_full_log</options> |
| 55 | </rule> |
| 56 | </group> |
| 57 | ``` |
| 58 | |
| 59 | #. Restart the Wazuh manager to apply the changes: |
| 60 | |
| 61 | ```bash |
| 62 | # Restart the Wazuh manager to apply the changes |
| 63 | systemctl restart wazuh-manager |
| 64 | ``` |
| 65 | |
| 66 | With this configuration, Wazuh runs an executable instead of a Python script when triggering an active response on a Windows endpoint. |