OSSEC

9/26/20245 min read

OSSEC (Open Source Security Event Correlator) is a comprehensive, opensource hostbased intrusion detection system (HIDS). It is designed to monitor and analyze multiple aspects of a systems state and behavior to detect malicious activities, policy violations, and unauthorized system changes. OSSEC is known for its flexibility, scalability, and realtime capabilities. It provides critical security monitoring across various environments, including physical, virtual, cloud, and containerbased systems.

Key Features of OSSEC:

1. File Integrity Monitoring (FIM):

OSSEC can monitor files and directories for changes such as modifications, deletions, and permission changes. This is crucial for detecting unauthorized access to critical files, configuration changes, or attacks that modify key system files (e.g., web defacements or system configuration tampering).

2. Rootkit and malware detection:

OSSEC includes built-in capabilities to detect rootkits and malware by inspecting the system for hidden processes, untrusted binaries, and known rootkit signatures.

3. LogBased Intrusion Detection:

OSSEC parses and analyzes logs in realtime from various sources (e.g., operating systems, network devices, applications). It correlates events across these logs to identify suspicious activities, policy violations, or attacks (e.g., bruteforce attacks, failed login attempts, web server anomalies).

It supports a wide variety of log sources such as Apache, NGINX, MySQL, firewall logs, and system logs, making it highly extensible.

4. RealTime Alerts and Active Response:

OSSEC can generate realtime alerts when suspicious or malicious behavior is detected. Alerts can be customized based on severity, type of event, and frequency.

The Active Response feature allows OSSEC to take predefined actions in response to detected threats (e.g., blocking an IP address, restarting a service, or disabling a user account).

5. Log Correlation and SIEM Integration:

OSSEC correlates logs and events across multiple sources and nodes, which helps detect complex attack patterns. It can also integrate with SIEM platforms (Security Information and Event Management), such as Splunk or ELK Stack, for advanced log management and alerting.

6. MultiPlatform Support:

OSSEC works across various operating systems including Linux, Windows, macOS, Solaris, AIX, and more. This makes it suitable for heterogeneous environments where different types of systems need to be monitored centrally.

7. Centralized Monitoring:

OSSEC offers centralized monitoring and management of multiple agents (deployed on hosts) via a serveragent architecture. This is ideal for organizations with many servers, workstations, or devices distributed across different networks.

8. Compliance Monitoring:

OSSEC can be configured to monitor systems for compliance with security standards (such as PCI DSS, HIPAA, or SOX). It can track configuration changes, audit logs, and user access, helping organizations maintain compliance.

9. Custom Rules and Decoders:

OSSEC allows the creation of custom rules and decoders to detect specific events or behaviors unique to your environment. These rules help in finetuning the system to monitor for precise conditions and actions, making OSSEC extremely flexible.

10. Active Directory Integration (Windows Monitoring):

OSSEC can monitor Windows systems, including file integrity, Windows Registry changes, and Event Logs. It can detect attacks on Active Directory, privilege escalation attempts, or suspicious user behavior by monitoring specific Windows events.

OSSEC Components:

1. OSSEC Server:

The central component responsible for receiving, storing, and analyzing data sent from OSSEC agents deployed on monitored systems. The server performs log analysis, correlation, and alerting.

2. OSSEC Agents:

These lightweight agents are deployed on endpoints (servers, desktops, etc.). They collect and send log data, file integrity data, and system event data to the OSSEC server for analysis.

3. Agentless Monitoring:

OSSEC also supports agentless monitoring via SSH, SNMP, or WMI (on Windows). This is useful for network devices or systems where agents cannot be installed.

4. Web Interface (Optional):

OSSEC offers a web interface (such as the opensource OSSEC WUI) for managing alerts, visualizing trends, and overseeing system status. This interface can be extended with additional dashboards and analytics.

RuleBased Detection:

OSSEC uses a rules engine to detect suspicious activity. It processes logs and system data based on predefined rules that define how certain events should be interpreted (e.g., failed login attempts, file modifications). Rules are divided into different categories:

Authentication Failures: Detects brute force attacks, failed logins, and suspicious authentication behavior.

File Integrity: Monitors changes to system files, configuration files, and other sensitive files (e.g., /etc/passwd, registry keys on Windows).

Rootkits: Detects signs of rootkits by scanning for hidden processes and altered binaries.

Syslog/Event Log Parsing: Parses logs from various sources to detect suspicious patterns and log anomalies (e.g., failed connections, SQL injection attempts in web logs).

Custom Rules: Users can define their own rules to detect specific behavior or monitor applicationspecific logs.

Example Rule for BruteForce Detection:

OSSEC provides several builtin rules for detecting various attack patterns. Below is an example rule to detect repeated failed SSH login attempts, which could indicate a bruteforce attack.

<decoded_as>sshd</decoded_as>

<description>Multiple failed SSH login attempts.</description>

<group>authentication_failures,</group>

<alert_by_email>yes</alert_by_email>

</rule>

frequency: Specifies the number of failed attempts (5).

timeframe: Time period within which the failed attempts should occur (60 seconds).

alert_by_email: Indicates whether an email alert should be sent when the rule is triggered.

Active Response Example (Blocking IPs):

OSSEC can automatically take action when certain conditions are met. For instance, it can block an IP address attempting to bruteforce SSH logins. Here’s an example of using the Active Response feature to block an IP via firewall:

1. Configure the Active Response section in ossec.conf:

<command>firewalldrop</command>

<location>global</location>

<rules_id>5710, 5712</rules_id>

</activeresponse>

command: Specifies the action to take (e.g., firewalldrop).

rules_id: Identifies the rule ID that triggers this response (e.g., 5710 for failed SSH logins).

timeout: Specifies how long the IP should be blocked (600 seconds in this case).

2. Define the Active Response script in ossec.conf:

<name>firewalldrop</name>

<executable>firewalldrop.sh</executable>

<expect>srcip</expect>

</command>

The script firewalldrop.sh would contain commands to add the offending IP to the system’s firewall rules (e.g., using iptables or firewalld).

OSSEC Architecture:

| OSSEC Server |

OSSEC Agent 1 | | OSSEC Agent 2 |

In this architecture:

OSSEC Server collects and correlates data from OSSEC Agents.

Each OSSEC Agent monitors hostlevel activity, logs, and files, sending data back to the server for analysis.

Use Cases:

1. Server Monitoring:

Track file integrity and logs on critical servers. For example, monitor changes to sensitive files such as /etc/passwd, /etc/shadow, or specific configuration files.

2. Compliance Monitoring:

Ensure that configurations and file states adhere to security policies (e.g., for PCIDSS compliance) by regularly checking file integrity and system states.

3. Threat Detection:

Detect bruteforce attacks, privilege escalation, rootkit installations, or unauthorized file changes on Linux and Windows machines.

4. Log Analysis for Threat Hunting:

Analyze logs in realtime to detect anomalies in authentication patterns, configuration changes, or application logs (e.g., for SQL injection or webbased attacks).

Conclusion:

OSSEC is a powerful, multiplatform tool that offers comprehensive hostbased monitoring and intrusion detection. Its ability to perform file integrity monitoring, log analysis, rootkit detection, and realtime response makes it invaluable for defending modern IT environments. Its flexible architecture, custom rules, and integration with security platforms (SIEMs) make it suitable for organizations of all sizes, offering both reactive and proactive security measures.

OSSEC

CONTACT