Configures host-based intrusion detection systems (HIDS) like Wazuh, OSSEC, AIDE on Linux/Windows endpoints for file integrity monitoring (FIM), config changes, rootkit detection, and SIEM integration. For PCI DSS/NIST compliance.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
在以下情况下使用本技能:
Configures Wazuh, OSSEC, or AIDE for host-based intrusion detection, file integrity monitoring, and endpoint security compliance on Linux and Windows.
Configures host-based intrusion detection systems (HIDS) like Wazuh, OSSEC, and AIDE on Linux/Windows endpoints to monitor file integrity, system calls, and config changes for security and compliance.
Configures AIDE for Linux file integrity monitoring: generates config, initializes baselines, runs checks, detects changes, automates cron jobs, and generates reports. For endpoint security and compliance.
Share bugs, ideas, or general feedback.
在以下情况下使用本技能:
不适用于基于网络的 IDS(Suricata、Snort)或 EDR 部署。
Windows:
# 下载并安装 Wazuh 代理
Invoke-WebRequest -Uri "https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi" `
-OutFile "wazuh-agent.msi"
msiexec /i wazuh-agent.msi /q WAZUH_MANAGER="wazuh-manager.corp.com" `
WAZUH_REGISTRATION_SERVER="wazuh-manager.corp.com" WAZUH_AGENT_GROUP="windows-workstations"
net start WazuhSvc
Linux(Debian/Ubuntu):
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --dearmor -o /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \
> /etc/apt/sources.list.d/wazuh.list
apt-get update && apt-get install wazuh-agent -y
sed -i 's/MANAGER_IP/wazuh-manager.corp.com/' /var/ossec/etc/ossec.conf
systemctl daemon-reload && systemctl enable --now wazuh-agent
编辑代理配置(/var/ossec/etc/ossec.conf 或 C:\Program Files (x86)\ossec-agent\ossec.conf):
<syscheck>
<!-- 扫描频率:每 12 小时 -->
<frequency>43200</frequency>
<scan_on_start>yes</scan_on_start>
<alert_new_files>yes</alert_new_files>
<!-- Linux 关键目录 -->
<directories check_all="yes" realtime="yes">/etc</directories>
<directories check_all="yes" realtime="yes">/usr/bin</directories>
<directories check_all="yes" realtime="yes">/usr/sbin</directories>
<directories check_all="yes" realtime="yes">/bin</directories>
<directories check_all="yes" realtime="yes">/sbin</directories>
<directories check_all="yes">/boot</directories>
<!-- Windows 关键目录 -->
<directories check_all="yes" realtime="yes">C:\Windows\System32</directories>
<directories check_all="yes" realtime="yes">C:\Windows\SysWOW64</directories>
<directories check_all="yes" realtime="yes">%PROGRAMFILES%</directories>
<!-- Windows 注册表监控 -->
<windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>
<!-- 忽略频繁变化的文件 -->
<ignore>/etc/mtab</ignore>
<ignore>/etc/resolv.conf</ignore>
<ignore type="sregex">.log$</ignore>
</syscheck>
<rootcheck>
<disabled>no</disabled>
<frequency>43200</frequency>
<rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
<rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
<system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
<check_dev>yes</check_dev>
<check_files>yes</check_files>
<check_if>yes</check_if>
<check_pids>yes</check_pids>
<check_ports>yes</check_ports>
<check_sys>yes</check_sys>
<check_trojans>yes</check_trojans>
<check_unixaudit>yes</check_unixaudit>
</rootcheck>
<!-- 自定义规则:/var/ossec/etc/rules/local_rules.xml -->
<group name="local,syscheck,">
<!-- 对关键二进制文件修改发出告警 -->
<rule id="100001" level="12">
<if_sid>550</if_sid>
<match>/usr/bin/|/usr/sbin/|/bin/|/sbin/</match>
<description>关键系统二进制文件已被修改:$(file)</description>
<group>syscheck,pci_dss_11.5,</group>
</rule>
<!-- 对临时目录中出现的新可执行文件发出告警 -->
<rule id="100002" level="10">
<if_sid>554</if_sid>
<match>/tmp/|/var/tmp/</match>
<description>在临时目录中创建了新文件:$(file)</description>
<group>syscheck,malware,</group>
</rule>
<!-- 对 SSH 配置更改发出告警 -->
<rule id="100003" level="10">
<if_sid>550</if_sid>
<match>/etc/ssh/sshd_config</match>
<description>SSH 配置已被修改</description>
<group>syscheck,authentication,</group>
</rule>
</group>
<!-- 多次认证失败后自动封锁 IP -->
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>5712</rules_id>
<timeout>600</timeout>
</active-response>
<!-- 检测到暴力破解后禁用账号 -->
<active-response>
<disabled>no</disabled>
<command>disable-account</command>
<location>local</location>
<rules_id>100100</rules_id>
<timeout>3600</timeout>
</active-response>
# Wazuh 通过 Filebeat 接入 Splunk
# 编辑 /etc/filebeat/filebeat.yml:
filebeat.inputs:
- type: log
paths:
- /var/ossec/logs/alerts/alerts.json
json.keys_under_root: true
output.elasticsearch:
hosts: ["https://splunk-hec:8088"]
# Wazuh 直接集成 Elastic
# Wazuh 索引器直接接入 OpenSearch/Elasticsearch
# 仪表板:https://wazuh-dashboard:5601
| 术语 | 定义 |
|---|---|
| HIDS | 基于主机的入侵检测系统(Host-based Intrusion Detection System),监控单个端点的恶意活动 |
| FIM | 文件完整性监控(File Integrity Monitoring),通过比对加密哈希值检测文件的未授权变更 |
| Syscheck | Wazuh/OSSEC 模块,用于文件完整性监控和注册表监控 |
| Rootcheck | Wazuh/OSSEC 模块,用于 Rootkit 和恶意软件检测 |
| 主动响应 | 由 HIDS 告警触发的自动防御措施(封锁 IP、禁用账号) |
| CDB List | 常量数据库列表,用于 Wazuh 规则中的自定义查找 |