Update Wazuh active response configuration for Windows endpoint
Taylor committed
Feb 28, 2024 at 07:22 UTC
4c582db4f233b6df969972fc984279f81abcb7ba
2 files changed
+18
-22
backend/app/active_response/README.md
-22
@@ -57,25 +57,3 @@ You can find the created `custom-ar.exe` executable in the `C:\Users\<USER>\dist
57
<timeout>60</timeout>
58
</active-response>
59
```
60
-
61
-#. Create the rules file `/var/ossec/etc/rules/600000-active_response.xml` and add the following rule to trigger the custom active response:
62
-
63
-```xml
64
-<group name="active_response,">
65
- <rule id="600000" level="10">
66
- <decoded_as>json</decoded_as>
67
- <field name="active_response">windows_firewall</field>
68
- <description>Windows Firewall Active Response triggered.</description>
69
- <group>socfortress,</group>
70
- <options>no_full_log</options>
71
- </rule>
72
-</group>
73
-```
74
-
75
-#. Restart the Wazuh manager to apply the changes:
76
-
77
-```console
78
-systemctl restart wazuh-manager
79
-```
80
-
81
-With this configuration, Wazuh runs an executable instead of a Python script when triggering an active response on a Windows endpoint.
backend/app/active_response/scripts/windows/windows_firewall.md
+18
@@ -42,7 +42,25 @@ The following configuration must be added to the `ossec.conf` file on the Wazuh
42
</active-response>
43
```
44
45
+#. Create the rules file `/var/ossec/etc/rules/600000-active_response.xml` and add the following rule to trigger the custom active response:
46
+
47
+```xml
48
+<group name="active_response,">
49
+ <rule id="600000" level="10">
50
+ <decoded_as>json</decoded_as>
51
+ <field name="active_response">windows_firewall</field>
52
+ <description>Windows Firewall Active Response triggered.</description>
53
+ <group>socfortress,</group>
54
+ <options>no_full_log</options>
55
+ </rule>
56
+</group>
57
+```
58
+
59
+#. Restart the Wazuh manager to apply the changes:
60
+
61
```bash
62
# Restart the Wazuh manager to apply the changes
63
systemctl restart wazuh-manager
64
```
65
+
66
+With this configuration, Wazuh runs an executable instead of a Python script when triggering an active response on a Windows endpoint.