Wazuh: Open Source SIEM und XDR für DevOps und Security-Teams

[Wazuh-Architektur]
                                                    
[Agents] ─────┐                      ┌──── [Elastic Search]
              │                      │
[Agents] ────[Wazuh Server]────[Indexer]── [Kibana]
              │                      │
[Agents] ─────┘                      └──── [Dashboard]

[Wazuh-Ökosystem]
                                                    
[Agenten] ──────┐                      ┌── [Indexer]
                │                      │    │
[Endpoints] ──[Wazuh Manager]───[Integration]─┤
                │                      │    │
[Server] ───────┘                      └── [Dashboard]

[Datenfluss]
Sammeln → Analysieren → Indexieren → Visualisieren → Reagieren

[Agent-Funktionen]
├── [Datensammlung]
│   ├── System Logs
│   ├── Sicherheitsereignisse
│   └── Integritätsprüfungen
│
├── [Überwachung]
│   ├── Prozesse
│   ├── Netzwerk
│   └── Rootkit-Erkennung
│
└── [Response]
    ├── Lokale Aktionen
    ├── Blockierung
    └── Remediation

[Elastic Stack]
├── [Elasticsearch]
│   └── Datenspeicherung & Indizierung
│
├── [Kibana]
│   └── Visualisierung & Management
│
└── [Filebeat]
    └── Log-Transport

[Datenverarbeitung]
1. Agent ──→ 2. Manager ──→ 3. Analyse ──→ 4. Indexierung ──→ 5. Dashboard
     │            │              │             │                    │
   Sammeln     Empfangen      Regelwerk     Speichern          Visualisieren
     │            │              │             │                    │
   Events      Dekodieren     Korrelation   Suchen              Alerting

[Minimale Anforderungen]
├── [Wazuh Manager]
│   ├── CPU: 4 Cores
│   ├── RAM: 8 GB
│   └── Disk: 50 GB SSD
│
├── [Elastic Stack]
│   ├── CPU: 4 Cores
│   ├── RAM: 8 GB
│   └── Disk: 100 GB SSD
│
└── [Monitoring Kapazität]
    ├── Bis zu 100 Agents
    ├── ~5000 Events/Sekunde
    └── 30 Tage Retention

# System aktualisieren
sudo apt update && sudo apt upgrade -y

# Notwendige Pakete installieren
sudo apt install curl apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release gnupg2 -y

# Systembeschränkungen anpassen
cat > /etc/sysctl.d/99-wazuh.conf << EOF
vm.max_map_count=262144
fs.file-max=65535
EOF

# Änderungen aktivieren
sudo sysctl -p /etc/sysctl.d/99-wazuh.conf

# GPG-Key hinzufügen
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

# Repository hinzufügen
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

# Wazuh-Manager installieren
sudo apt update
sudo apt install wazuh-manager -y

[Elastic Stack Setup]
1. Elasticsearch ──→ 2. Filebeat ──→ 3. Kibana
   │                    │              │
   └── Datenspeicher   └── Transport   └── Interface

# Elasticsearch Installation
curl -s https://artifacts.elastic.co/GPG-KEY-elasticsearch | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/elasticsearch.gpg --import
echo "deb [signed-by=/usr/share/keyrings/elasticsearch.gpg] https://artifacts.elastic.co/packages/7.x/apt stable main" | tee /etc/apt/sources.list.d/elastic-7.x.list
sudo apt update && sudo apt install elasticsearch=7.17.9

# Elasticsearch Konfiguration
cat > /etc/elasticsearch/elasticsearch.yml << EOF
node.name: node-1
network.host: localhost
http.port: 9200
cluster.initial_master_nodes: ["node-1"]
EOF

# Kibana Installation
sudo apt install kibana=7.17.9

# Wazuh Plugin Installation
cd /usr/share/kibana
sudo -u kibana bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.4.0_7.17.9-1.zip

# Dienste aktivieren
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch wazuh-manager kibana
sudo systemctl start elasticsearch wazuh-manager kibana

# Status überprüfen
sudo systemctl status elasticsearch wazuh-manager kibana

[Wazuh Agent]
        │
        ├── [Collector]
        │   ├── System Logs
        │   ├── Security Events
        │   └── Custom Logs
        │
        ├── [Monitor]
        │   ├── File Integrity
        │   ├── Process Activity
        │   └── Network Traffic
        │
        └── [Responder]
            ├── Active Response
            ├── Security Policies
            └── Remediation

# Für Ubuntu/Debian Systeme
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list
apt update
apt install wazuh-agent

[Installations-Optionen]
├── [Paket-Manager]
│   ├── APT (Debian/Ubuntu)
│   ├── YUM (RHEL/CentOS)
│   └── WPK (Windows)
│
├── [Automatisierung]
│   ├── Ansible
│   ├── Puppet
│   └── Chef
│
└── [Container]
    ├── Docker
    ├── Kubernetes
    └── Custom Images

# Auf dem Wazuh-Server
sudo /var/ossec/bin/manage_agents -a -n "WebServer01" -i "192.168.1.100"

# Agent-Schlüssel extrahieren
sudo /var/ossec/bin/manage_agents -e <agent_id>

# Auf dem Agent
echo "<extracted_key>" | sudo /var/ossec/bin/manage_agents -i

[Registrierungsprozess]
Agent ──[Request]──> Manager
      <──[Verify]───
      ────[Auth]────>
      <───[Key]─────

# Gruppe erstellen
/var/ossec/bin/agent_groups -a -g webservers

# Agent einer Gruppe zuweisen
/var/ossec/bin/agent_groups -a -i 001 -g webservers

# Gruppenkonfiguration
cat > /var/ossec/etc/shared/webservers/agent.conf << EOF
<agent_config>
  <localfile>
    <location>/var/log/apache2/access.log</location>
    <log_format>apache</log_format>
  </localfile>
</agent_config>
EOF

# Ansible Playbook Beispiel
- name: Deploy Wazuh Agent
  hosts: all
  tasks:
    - name: Add Wazuh repo
      apt_repository:
        repo: "deb https://packages.wazuh.com/4.x/apt/ stable main"
        state: present

    - name: Install Wazuh Agent
      apt:
        name: wazuh-agent
        state: present
        update_cache: yes

    - name: Configure Agent
      template:
        src: ossec.conf.j2
        dest: /var/ossec/etc/ossec.conf

[Event Detection Flow]
Log Sources ──→ Collection ──→ Dekodierung ──→ Regelanalyse ──→ Alert
     │             │              │               │              │
  System        Agent         Parser          Correlation     Response
  Logs          Buffer        Rules           Engine         Actions

# Beispiel einer Regel für SSH-Brute-Force-Erkennung
<rule id="100001" level="10">
  <if_sid>5710</if_sid>
  <match>^Failed password</match>
  <frequency>8</frequency>
  <timeframe>120</timeframe>
  <description>Multiple failed login attempts</description>
</rule>

[FIM Architecture]
                    ┌── [Hash Calculation]
[Monitored Files] ──┼── [Permission Check] ──→ [Database] ──→ [Alert]
                    └── [Attribute Monitor]

# FIM-Konfiguration für kritische Systempfade
<syscheck>
  <directories check_all="yes" realtime="yes">/etc,/usr/bin,/usr/sbin</directories>
  <ignore>/etc/mtab</ignore>
  <ignore type="sregex">^/etc/.*\.swp$</ignore>
</syscheck>

[Vulnerability Workflow]
[Package Scan] ──→ [CVE Check] ──→ [Risk Assessment] ──→ [Report]
       │              │                │                   │
   Inventory      Database         Severity              Alerts
   Collection     Update           Scoring               & Actions

# Vulnerability Detector Konfiguration
<vulnerability-detector>
  <enabled>yes</enabled>
  <interval>1d</interval>
  <feed name="ubuntu-20">
    <enabled>yes</enabled>
    <update_interval>1h</update_interval>
  </feed>
</vulnerability-detector>

[Compliance Framework]
├── [Standards]
│   ├── PCI DSS
│   ├── GDPR
│   └── HIPAA
│
├── [Checks]
│   ├── Configuration
│   ├── Access Control
│   └── Audit Logs
│
└── [Reporting]
    ├── Violations
    ├── Metrics
    └── Documentation

[Active Response Chain]
[Event] ──→ [Rule Match] ──→ [Action Trigger] ──→ [Response]
   │            │                │                  │
Detection    Analysis         Decision          Execution
   │            │                │                  │
   └────────── Feedback Loop ───────────────────────┘

# Active Response Konfiguration
<command>
  <name>firewall-block</name>
  <executable>firewall-block.sh</executable>
  <expect>srcip</expect>
  <timeout_allowed>yes</timeout_allowed>
</command>

<active-response>
  <command>firewall-block</command>
  <location>local</location>
  <rules_id>100001</rules_id>
  <timeout>600</timeout>
</active-response>

[Log Collection Architecture]
[Quellen] ────→ [Sammlung] ────→ [Verarbeitung] ────→ [Speicherung]
   │               │                   │                    │
Systeme         Agenten            Parsing              Elastic
Services       Forwarder          Enrichment             Stack
Custom          Buffer            Correlation            Index

# Beispiel einer erweiterten Log-Collection-Konfiguration
<localfile>
  <location>/var/log/auth.log</location>
  <log_format>syslog</log_format>
  <frequency>10</frequency>
  <only-future-events>yes</only-future-events>
  <query>user failed|authentication failure</query>
</localfile>

[Alert-Workflow]
[Event] ──→ [Regelprüfung] ──→ [Klassifizierung] ──→ [Benachrichtigung]
   │             │                    │                      │
Quelle      Regelwerk            Severity              Channels
Context     Conditions           Priority              Actions
Metadata    Exceptions           Impact                Response

[Custom Rules Hierarchy]
[Basis-Regeln] ────→ [Erweiterte Regeln] ────→ [Korrelation]
       │                     │                        │
  Grundlegende         Angepasste               Regelketten
  Erkennung            Bedingungen              Multi-Event
  Pattern              Schwellwerte             Zeitfenster

<!-- Beispiel einer komplexen Custom Rule -->
<rule id="100100" level="12">
  <if_sid>5710</if_sid>
  <match>^Failed password</match>
  <regex>user: (\w+)</regex>
  <frequency>8</frequency>
  <timeframe>120</timeframe>
  <if_matched_group>admin|root</if_matched_group>
  <description>Brute force attack on privileged account</description>
  <mitre>
    <id>T1110</id>
    <tactic>Credential Access</tactic>
  </mitre>
</rule>

[API Architecture]
[Clients] ────→ [API Gateway] ────→ [Wazuh Manager]
    │               │                      │
Automation      Security              Ausführung
Scripts         RBAC                  Aktionen
Integration     SSL/TLS               Verwaltung

# Beispiel für API-Interaktion
# Token generieren
TOKEN=$(curl -u admin:admin -k -X GET "https://localhost:55000/security/user/authenticate" | jq -r '.data.token')

# Agenten-Status abfragen
curl -k -X GET "https://localhost:55000/agents" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json"

[Reporting Framework]
[Datenquellen] ────→ [Aggregation] ────→ [Analyse] ────→ [Präsentation]
       │                  │                  │                │
   Raw Data           Filtering          Trends           Reports
   Metrics            Grouping           Patterns         Dashboards
   Alerts             Summary            Insights         PDF/HTML

# Report-Konfiguration Beispiel
<report>
  <title>Security Compliance Report</title>
  <schedule type="weekly" day="1" time="23:59">
  <format>pdf</format>
  <sections>
    - compliance_pci
    - top_alerts
    - agent_status
  </sections>
  <mail_to>security@domain.com</mail_to>
</report>

[Policy Framework]
[Grundregeln] ────→ [Erweiterte Policies] ────→ [Automatisierung]
      │                      │                         │
 Basis-Schutz          Anpassungen               Durchsetzung
 Compliance            Ausnahmen                 Monitoring
 Standards             Spezialfälle              Response

# Beispiel einer umfassenden Security Policy
<policy>
  <name>Critical Server Policy</name>
  <rules>
    - system_hardening
    - access_control
    - network_protection
  </rules>
  <exceptions>
    - maintenance_window
    - authorized_changes
  </exceptions>
  <actions>
    - alert_critical
    - block_access
    - notify_admin
  </actions>
</policy>

[Alert Management Flow]
[Detection] ────→ [Klassifizierung] ────→ [Priorisierung] ────→ [Response]
     │                    │                      │                   │
 Ereignis            Kategorien             Wichtigkeit         Maßnahmen
 Kontext             Severity               Impact              Automation
 Quellen             Grouping               Dringlichkeit       Eskalation

[Performance Layers]
[System] ────→ [Agent] ────→ [Manager] ────→ [Storage]
    │            │            │               │
 Resources    Collection   Processing      Retention
 Tuning       Filtering    Analysis       Archiving
 Scaling      Buffering    Correlation    Cleanup

# Beispiel Performance-Optimierung
<ossec_config>
  <global>
    <memory_size>2048</memory_size>
    <queue_size>131072</queue_size>
    <events_per_second>1000</events_per_second>
  </global>
  
  <syscheck>
    <frequency>43200</frequency>
    <max_files_per_second>50</max_files_per_second>
  </syscheck>
</ossec_config>

[Incident Response Workflow]
[Erkennung] ────→ [Analyse] ────→ [Eindämmung] ────→ [Recovery]
     │              │               │                  │
 Detection      Forensik         Isolation          Restore
 Alerting       Bewertung       Blocking           Cleanup
 Triage         Correlation     Quarantine         Hardening

# Beispiel Incident Response Script
#!/bin/bash
case "$1" in
  'brute_force')
    # Blockiere IP
    iptables -A INPUT -s "$2" -j DROP
    # Dokumentiere Vorfall
    logger "Blocked IP $2 due to brute force attack"
    # Benachrichtige Team
    notify_security_team "Brute force attack from $2"
    ;;
  'malware')
    # Isoliere System
    isolate_system "$2"
    # Starte Malware-Scan
    run_emergency_scan "$2"
    # Sammle Forensik-Daten
    collect_forensics "$2"
    ;;
esac

[Compliance Framework]
[Standards] ────→ [Checks] ────→ [Auswertung] ────→ [Reporting]
     │             │               │                   │
  PCI DSS      Technical       Validation          Reports
  HIPAA        Security        Scoring            Dashboard
  GDPR         Config          Analysis           Alerts

# Compliance Check Konfiguration
<rootcheck>
  <check_unixaudit>yes</check_unixaudit>
  <check_files>yes</check_files>
  <check_trojans>yes</check_trojans>
  <check_dev>yes</check_dev>
  <check_sys>yes</check_sys>
  <check_pids>yes</check_pids>
  <check_ports>yes</check_ports>
  <check_if>yes</check_if>

  <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>
  <system_audit>/var/ossec/etc/shared/pci_dss_rcl.txt</system_audit>
</rootcheck>

[PCI DSS Framework]
[Requirements] ────→ [Controls] ────→ [Monitoring] ────→ [Reporting]
       │               │                │                    │
   12 Bereiche     Technische       Continuous           Audits
   Kontrollen      Maßnahmen        Validation          Evidence
   Policies        Checks           Alerting            Reports

# PCI DSS spezifische Konfiguration
<pci_dss>
  <requirement_10>
    <rule_id>80700</rule_id>
    <description>Log all access to cardholder data</description>
    <monitoring>
      - file_integrity
      - access_control
      - audit_logs
    </monitoring>
  </requirement_10>
</pci_dss>

[GDPR Implementation]
[Datenschutz] ────→ [Technische Maßnahmen] ────→ [Dokumentation]
       │                     │                          │
 Personendaten         Verschlüsselung             Nachweise
 Verarbeitung          Zugriffskontrollen          Berichte
 Rechtsgrundlagen      Monitoring                  Audits

# GDPR Monitoring Beispiel
<gdpr>
  <article_32>
    <security_measures>
      - encryption_at_rest
      - encryption_in_transit
      - access_logging
      - breach_detection
    </security_measures>
    <monitoring>
      - data_access
      - unauthorized_changes
      - security_events
    </monitoring>
  </article_32>
</gdpr>

[Performance Monitoring Layers]
[System Resources] ────→ [Service Health] ────→ [Application Metrics]
        │                      │                         │
    Hardware               Prozesse                  Wazuh-spezifisch
    Netzwerk              Dienste                   Regel-Performance
    Storage               Datenbank                 Event-Processing
        │                      │                         │
    [Baseline] ────→ [Trend Analysis] ────→ [Predictive Monitoring]

# Umfassendes Performance-Monitoring-Script
#!/bin/bash
# Systemressourcen analysieren
echo "=== System Resources ==="
# CPU-Analyse mit Details zu Wazuh-Prozessen
ps aux | grep -E "wazuh|ossec" | awk '{print $2, $3, $4, $11}'

# Memory-Nutzung mit Details
free -m
vmstat 1 5

# Disk I/O für Wazuh-Verzeichnisse
iostat -x 1 5 | grep -E "Device|sda"

# Netzwerk-Statistiken
netstat -anp | grep -E "wazuh|ossec"

[Debug-Hierarchie]
[Basic Debugging] ────→ [Advanced Analysis] ────→ [Expert Investigation]
        │                       │                          │
    Log-Analyse            Trace-Analyse              Core-Analyse
    Config-Check           Netzwerk-Debug             Performance-Profiling
    Service-Status         DB-Diagnostik              Custom Debugging
        │                       │                          │
    [Quick Fixes] ────→ [Root Cause] ────→ [Prevention Strategies]

# Erweitertes Debug-Script
#!/bin/bash

echo "=== Wazuh Debug Analysis ==="

# 1. Log-Level-Analyse
debug_level_check() {
    echo "Checking Debug Levels..."
    grep -r "debug" /var/ossec/etc/internal_options.conf
    grep -r "debug" /var/ossec/etc/local_internal_options.conf
}

# 2. Service-Gesundheit
service_health_check() {
    echo "Analyzing Service Health..."
    for service in wazuh-manager filebeat elasticsearch kibana
    do
        echo "=== $service Status ==="
        systemctl status $service --no-pager
        journalctl -u $service --no-pager | tail -n 50
    done
}

# 3. Konfigurations-Validierung
config_validation() {
    echo "Validating Configurations..."
    /var/ossec/bin/ossec-logtest -t
    /var/ossec/bin/ossec-analysisd -t
}

# Hauptausführung
debug_level_check
service_health_check
config_validation

[Backup Strategy]
[Configuration] ────→ [Data] ────→ [State] ────→ [Recovery]
        │              │            │              │
    ossec.conf     Alerts       Runtime        Restore
    Custom Rules    Events       Settings      Validation
    Decoders       Logs         States        Testing
        │              │            │              │
    [Version Control] ──→ [Incremental] ──→ [Point-in-Time Recovery]

# Umfassendes Backup-Script
#!/bin/bash

BACKUP_DIR="/backup/wazuh/$(date +%Y%m%d)"
CONFIG_DIR="/var/ossec/etc"
DATA_DIR="/var/ossec/data"

# 1. Backup-Verzeichnis erstellen
mkdir -p "$BACKUP_DIR"/{config,data,state}

# 2. Konfiguration sichern
backup_config() {
    echo "Backing up configurations..."
    cp -r "$CONFIG_DIR"/* "$BACKUP_DIR/config/"
    tar czf "$BACKUP_DIR/config.tar.gz" -C "$BACKUP_DIR" config/
}

# 3. Daten sichern
backup_data() {
    echo "Backing up data..."
    systemctl stop wazuh-manager
    cp -r "$DATA_DIR"/* "$BACKUP_DIR/data/"
    tar czf "$BACKUP_DIR/data.tar.gz" -C "$BACKUP_DIR" data/
    systemctl start wazuh-manager
}

# 4. Zustandssicherung
backup_state() {
    echo "Saving system state..."
    systemctl status wazuh-* > "$BACKUP_DIR/state/services.txt"
    netstat -tulpn > "$BACKUP_DIR/state/network.txt"
    ps aux | grep -E "wazuh|ossec" > "$BACKUP_DIR/state/processes.txt"
}

# Hauptausführung mit Fehlerbehandlung
{
    backup_config
    backup_data
    backup_state
} 2>"$BACKUP_DIR/backup.log"

[Update-Strategie]
[Planung] ────→ [Vorbereitung] ────→ [Durchführung] ────→ [Validierung]
     │               │                    │                    │
Assessment       Backup                Update              Testing
Zeitplan         Snapshot              Migration           Monitoring
Abhängigkeiten   Rollback-Plan         Konfiguration      Verifizierung
     │               │                    │                    │
     └────────── [Dokumentation] ────────────────────────────┘

# Umfassendes Update-Script mit Sicherheitsmaßnahmen
#!/bin/bash

# Variablen und Logging
UPDATE_LOG="/var/log/wazuh_update.log"
BACKUP_DIR="/backup/wazuh/pre_update_$(date +%Y%m%d)"
WAZUH_VERSION="4.4.0"

# Logging-Funktion
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$UPDATE_LOG"
}

# 1. Pre-Update Checks
pre_update_check() {
    log "Starting pre-update checks..."
    
    # System-Check
    if ! systemctl is-active --quiet wazuh-manager; then
        log "ERROR: Wazuh-Manager is not running"
        exit 1
    }
    
    # Speicherplatz-Check
    FREE_SPACE=$(df -m /var/ossec | awk 'NR==2 {print $4}')
    if [ "$FREE_SPACE" -lt 5000 ]; then
        log "ERROR: Insufficient disk space"
        exit 1
    }
    
    # Backup-Check
    if [ ! -d "$BACKUP_DIR" ]; then
        mkdir -p "$BACKUP_DIR"
    fi
}

# 2. Backup durchführen
perform_backup() {
    log "Creating pre-update backup..."
    
    # Konfiguration sichern
    tar czf "$BACKUP_DIR/etc.tar.gz" /var/ossec/etc/
    
    # Aktuelle Version dokumentieren
    /var/ossec/bin/wazuh-control info > "$BACKUP_DIR/version_info.txt"
    
    # Aktuelle Prozesse dokumentieren
    ps aux | grep -E "wazuh|ossec" > "$BACKUP_DIR/process_list.txt"
}

# 3. Update durchführen
perform_update() {
    log "Starting update process..."
    
    # Services stoppen
    systemctl stop wazuh-manager
    
    # Repository aktualisieren
    apt-get update
    
    # Update durchführen mit Fehlerbehandlung
    if ! apt-get install wazuh-manager="$WAZUH_VERSION"; then
        log "ERROR: Update failed"
        restore_from_backup
        exit 1
    fi
}

# 4. Post-Update Validierung
validate_update() {
    log "Validating update..."
    
    # Service-Start überprüfen
    systemctl start wazuh-manager
    sleep 10
    
    if ! systemctl is-active --quiet wazuh-manager; then
        log "ERROR: Service failed to start after update"
        restore_from_backup
        exit 1
    }
    
    # Version überprüfen
    NEW_VERSION=$(/var/ossec/bin/wazuh-control info | grep "wazuh-manager version" | cut -d " " -f4)
    if [ "$NEW_VERSION" != "$WAZUH_VERSION" ]; then
        log "ERROR: Version mismatch after update"
        restore_from_backup
        exit 1
    }
    
    # Regel-Check durchführen
    if ! /var/ossec/bin/ossec-logtest -t; then
        log "ERROR: Rule validation failed"
        restore_from_backup
        exit 1
    }
}

# 5. Rollback-Funktion
restore_from_backup() {
    log "Initiating rollback procedure..."
    
    systemctl stop wazuh-manager
    
    # Konfiguration wiederherstellen
    tar xzf "$BACKUP_DIR/etc.tar.gz" -C /
    
    # Service neu starten
    systemctl start wazuh-manager
    
    log "Rollback completed"
}

# Hauptausführung
{
    log "Starting Wazuh update process to version $WAZUH_VERSION"
    pre_update_check
    perform_backup
    perform_update
    validate_update
    log "Update completed successfully"
} || {
    log "Update failed - check logs for details"
    exit 1
}

[System Monitoring Matrix]
[Performance] ────→ [Logs] ────→ [Alerts] ────→ [Storage]
       │             │            │              │
   Ressourcen    Rotation     Validierung    Cleanup
   Metriken      Archiv       Qualität      Retention
   Trends        Analyse      Relevanz      Optimierung
       │             │            │              │
   [Monitoring] ─── [Analysis] ── [Action] ── [Management]

# Erweitertes System-Monitoring-Script
#!/bin/bash

LOG_DIR="/var/log/wazuh-monitoring"
RETENTION_DAYS=30

# Logging-Funktion mit Zeitstempel
log_message() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG_DIR/system_health.log"
}

# 1. Systemressourcen-Überwachung
monitor_resources() {
    log_message "=== System Resource Check ==="
    
    # CPU-Auslastung mit Details
    CPU_USAGE=$(top -bn1 | grep "Cpu(s)" | awk '{print $2}')
    CPU_WAZUH=$(ps aux | grep ossec | awk '{sum+=$3} END {print sum}')
    log_message "CPU Usage: Total=${CPU_USAGE}%, Wazuh=${CPU_WAZUH}%"
    
    # Detaillierte Memory-Analyse
    MEMORY_TOTAL=$(free -m | awk 'NR==2 {print $2}')
    MEMORY_USED=$(free -m | awk 'NR==2 {print $3}')
    MEMORY_WAZUH=$(ps aux | grep ossec | awk '{sum+=$4} END {print sum}')
    log_message "Memory: Total=${MEMORY_TOTAL}MB, Used=${MEMORY_USED}MB, Wazuh=${MEMORY_WAZUH}%"
    
    # Disk-Performance und I/O
    log_message "Disk I/O Stats:"
    iostat -x 1 5 | grep -v "^$" >> "$LOG_DIR/system_health.log"
}

# 2. Log-Management
manage_logs() {
    log_message "=== Log Management ==="
    
    # Log-Rotation
    find "$LOG_DIR" -type f -name "*.log" -mtime +$RETENTION_DAYS -exec rm {} \;
    
    # Log-Analyse
    for LOG_FILE in /var/ossec/logs/*.log; do
        SIZE=$(du -h "$LOG_FILE" | cut -f1)
        ENTRIES=$(wc -l < "$LOG_FILE")
        ERRORS=$(grep -c "error" "$LOG_FILE")
        WARNINGS=$(grep -c "warning" "$LOG_FILE")
        
        log_message "Log File: $LOG_FILE"
        log_message "- Size: $SIZE"
        log_message "- Entries: $ENTRIES"
        log_message "- Errors: $ERRORS"
        log_message "- Warnings: $WARNINGS"
    done
}

# 3. Alert-Qualitätsanalyse
analyze_alerts() {
    log_message "=== Alert Analysis ==="
    
    # Alert-Statistiken
    ALERTS_TODAY=$(grep -c "$(date +%Y/%m/%d)" /var/ossec/logs/alerts/alerts.log)
    FALSE_POSITIVES=$(grep -c "level 0" /var/ossec/logs/alerts/alerts.log)
    CRITICAL_ALERTS=$(grep -c "level [789]" /var/ossec/logs/alerts/alerts.log)
    
    log_message "Alert Statistics:"
    log_message "- Total Today: $ALERTS_TODAY"
    log_message "- False Positives: $FALSE_POSITIVES"
    log_message "- Critical Alerts: $CRITICAL_ALERTS"
    
    # Alert-Qualitätsmetrik berechnen
    QUALITY_SCORE=$(echo "scale=2; 100 - ($FALSE_POSITIVES / $ALERTS_TODAY * 100)" | bc)
    log_message "Alert Quality Score: ${QUALITY_SCORE}%"
}

# Hauptausführung
{
    mkdir -p "$LOG_DIR"
    monitor_resources
    manage_logs
    analyze_alerts
} || {
    log_message "ERROR: Monitoring script failed"
    exit 1
}

[Resource Management]
[System Resources] ────→ [Optimization] ────→ [Scaling] ────→ [Monitoring]
        │                     │                  │               │
    Hardware             Tuning              Cluster         Metrics
    Storage              Caching             Sharding        Alerts
    Network              Indexing            Balance         Trends
        │                     │                  │               │
        └───────── [Performance Analytics] ──────┘               │
                            │                                    │
                            └────── [Adjustment] ────────────────┘

# Umfassendes Ressourcen-Management-Script
#!/bin/bash

# Variablen
WAZUH_PATH="/var/ossec"
ES_PATH="/var/lib/elasticsearch"
ALERT_THRESHOLD=85

# Ressourcen-Monitoring-Funktion
monitor_resources() {
    # Disk-Space-Management
    DISK_USAGE=$(df -h "$WAZUH_PATH" | awk 'NR==2 {print $5}' | sed 's/%//')
    ES_DISK_USAGE=$(df -h "$ES_PATH" | awk 'NR==2 {print $5}' | sed 's/%//')
    
    if [ "$DISK_USAGE" -gt "$ALERT_THRESHOLD" ] || [ "$ES_DISK_USAGE" -gt "$ALERT_THRESHOLD" ]; then
        # Automatische Bereinigung alter Logs
        find "$WAZUH_PATH/logs/archives" -type f -mtime +30 -delete
        
        # Elasticsearch Optimierung
        curl -XPOST "localhost:9200/_forcemerge?only_expunge_deletes=true"
        curl -XPOST "localhost:9200/_cache/clear"
    fi
    
    # Index-Management
    for index in $(curl -s "localhost:9200/_cat/indices" | awk '{print $3}'); do
        DOCS_COUNT=$(curl -s "localhost:9200/$index/_count" | jq '.count')
        if [ "$DOCS_COUNT" -eq 0 ]; then
            curl -XDELETE "localhost:9200/$index"
        fi
    done
}

# Shard-Optimierung
optimize_shards() {
    # Cluster-Status prüfen
    CLUSTER_STATUS=$(curl -s "localhost:9200/_cluster/health" | jq -r '.status')
    
    if [ "$CLUSTER_STATUS" != "green" ]; then
        # Rebalancing durchführen
        curl -XPUT "localhost:9200/_cluster/settings" -H 'Content-Type: application/json' -d'
        {
            "transient": {
                "cluster.routing.allocation.disk.threshold_enabled": true,
                "cluster.routing.allocation.disk.watermark.low": "85%",
                "cluster.routing.allocation.disk.watermark.high": "90%",
                "cluster.routing.allocation.disk.watermark.flood_stage": "95%"
            }
        }'
    fi
}

# Performance-Optimierung
optimize_performance() {
    # Wazuh-Manager Optimierung
    cat > "$WAZUH_PATH/etc/local_internal_options.conf" << EOF
    wazuh_database.sync_agent_info_max_time=10m
    analysisd.event_threads=4
    remoted.recv_counter_flush=128
    remoted.comp_average_printout=0
EOF

    # Elasticsearch Performance-Tuning
    cat > "/etc/elasticsearch/jvm.options.d/heap.options" << EOF
    -Xms4g
    -Xmx4g
EOF
}

# Hauptausführung
{
    echo "Starting Resource Management at $(date)"
    monitor_resources
    optimize_shards
    optimize_performance
    echo "Resource Management completed at $(date)"
} >> /var/log/wazuh-resource-management.log 2>&1

[Network Optimization]
[Communication] ────→ [Traffic] ────→ [Security] ────→ [Performance]
        │               │              │                 │
    Protokolle      Bandwidth       Encryption        Latency
    Ports           QoS            Certificates       Throughput
    Routing         Compression    Authentication     Buffering
        │               │              │                 │
        └───────── [Monitoring] ───────┘                │
                        │                               │
                        └──── [Optimization] ───────────┘

# Umfangreiches Netzwerk-Optimierungs-Script
#!/bin/bash

# Variablen
WAZUH_CONF="/var/ossec/etc/ossec.conf"
NETWORK_LOG="/var/log/wazuh-network.log"
MAX_LATENCY=100  # in ms

# Logging-Funktion
log_network() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$NETWORK_LOG"
}

# 1. Netzwerk-Performance-Analyse
analyze_network() {
    log_network "=== Starting Network Analysis ==="
    
    # TCP Verbindungen überprüfen
    CONNECTIONS=$(netstat -ant | grep :1514 | wc -l)
    log_network "Active agent connections: $CONNECTIONS"
    
    # Latenz zu Agenten messen
    for agent in $(grep -oE '<client>[^<]+</client>' "$WAZUH_CONF" | sed 's/<[^>]*>//g'); do
        LATENCY=$(ping -c 3 "$agent" | tail -1 | awk '{print $4}' | cut -d '/' -f 2)
        if [ -n "$LATENCY" ] && [ "${LATENCY%.*}" -gt "$MAX_LATENCY" ]; then
            log_network "WARNING: High latency to agent $agent: ${LATENCY}ms"
        fi
    done
}

# 2. Netzwerk-Optimierung
optimize_network() {
    log_network "=== Applying Network Optimizations ==="
    
    # TCP Stack Optimierung
    cat > /etc/sysctl.d/99-wazuh-network.conf << EOF
# TCP Stack Optimierung
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 87380 16777216

# Verbindungs-Optimierung
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_max_tw_buckets = 1440000
net.core.somaxconn = 1024

# Buffer-Größen
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 87380
net.core.wmem_default = 87380
EOF

    # Änderungen aktivieren
    sysctl -p /etc/sysctl.d/99-wazuh-network.conf
}

# 3. Kommunikations-Optimierung
optimize_communication() {
    log_network "=== Optimizing Communication Settings ==="
    
    # Wazuh-Manager Kommunikationseinstellungen
    cat > "$WAZUH_CONF.tmp" << EOF
<ossec_config>
  <remote>
    <connection>secure</connection>
    <port>1514</port>
    <protocol>tcp</protocol>
    <queue_size>131072</queue_size>
  </remote>

  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>yes</alerts_log>
    <logall>no</logall>
    <memory_size>8192</memory_size>
    <process_pool_size>4</process_pool_size>
  </global>
</ossec_config>
EOF

    # Konfiguration validieren und anwenden
    if /var/ossec/bin/ossec-logtest -c "$WAZUH_CONF.tmp"; then
        mv "$WAZUH_CONF.tmp" "$WAZUH_CONF"
        systemctl restart wazuh-manager
    else
        log_network "ERROR: Invalid configuration"
        rm "$WAZUH_CONF.tmp"
    fi
}

# 4. Netzwerk-Monitoring
monitor_network() {
    log_network "=== Setting up Network Monitoring ==="
    
    # Traffic-Monitoring für Wazuh-Ports
    iptables -I INPUT -p tcp --dport 1514 -j ACCEPT
    iptables -I INPUT -p tcp --dport 1515 -j ACCEPT
    
    # Bandbreiten-Monitoring
    for interface in $(ip -o link show | awk -F': ' '{print $2}' | grep -v lo); do
        RX_BYTES=$(cat /sys/class/net/$interface/statistics/rx_bytes)
        TX_BYTES=$(cat /sys/class/net/$interface/statistics/tx_bytes)
        log_network "Interface $interface - RX: $RX_BYTES bytes, TX: $TX_BYTES bytes"
    done
}

# Hauptausführung
{
    analyze_network
    optimize_network
    optimize_communication
    monitor_network
    
    log_network "Network optimization completed successfully"
} || {
    log_network "ERROR: Network optimization failed"
    exit 1
}

[Angriffserkennung]
[Ereignisquellen] ────→ [Musteranalyse] ────→ [Reaktion]
      │                      │                    │
 Multi-Protokoll        Zeitfenster           Dynamische
 Korrelation           IP-Reputation          Schwellwerte
 Kontext-Analyse       Verhaltensprofil       Auto-Response
      │                      │                    │
      └────── [Adaptives Lernen] ───────────────┘

<!-- Kontextbasierte Brute-Force-Erkennung -->
<group name="brute_force">
  <!-- Basis-Erkennung mit IP-Reputation -->
  <rule id="100100" level="10">
    <if_sid>5710</if_sid>
    <match>^Failed password|Failed auth</match>
    <frequency>8</frequency>
    <timeframe>120</timeframe>
    <if_matched_ip>known_malicious_ips</if_matched_ip>
    <description>SSH authentication failures from suspicious IP.</description>
    <mitre>
      <id>T1110</id>
      <tactic>Credential Access</tactic>
    </mitre>
  </rule>

  <!-- Verhaltensbasierte Eskalation -->
  <rule id="100101" level="12">
    <if_matched_sid>100100</if_matched_sid>
    <same_source_ip />
    <frequency>2</frequency>
    <timeframe>3600</timeframe>
    <if_matched_group>authentication_success</if_matched_group>
    <description>Pattern suggests sophisticated brute-force attempt.</description>
  </rule>
</group>

[Malware Detection Framework]
[Datei-Monitoring] ───→ [Verhaltensanalyse] ───→ [Bedrohungserkennung]
         │                     │                         │
    Hash-Prüfung         Prozessverhalten          Klassifizierung
    Integritätschecks    Netzwerkaktivität         Risikoanalyse
    YARA-Regeln         Syscall-Monitoring         Quarantäne
         │                     │                         │
         └────── [Threat Intelligence] ─────────────────┘

<!-- Erweiterte Malware-Erkennung -->
<group name="malware_detection">
  <!-- Verdächtige Dateioperationen -->
  <rule id="100200" level="12">
    <if_group>syscheck</if_group>
    <match>WinExec|CreateRemoteThread|WriteProcessMemory</match>
    <regex>\.exe$|\.dll$|\.ps1$</regex>
    <description>Suspicious file operation detected</description>
    <mitre>
      <id>T1055</id>
      <tactic>Execution</tactic>
    </mitre>
  </rule>

  <!-- Anomales Prozessverhalten -->
  <rule id="100201" level="14">
    <if_sid>100200</if_sid>
    <if_matched_group>network_connection</if_matched_group>
    <timeframe>60</timeframe>
    <description>Process injection with network activity</description>
  </rule>
</group>

# Malware-Detection Script
#!/bin/bash

# Verdächtige Prozesse identifizieren
monitor_processes() {
    while true; do
        # Ungewöhnliche Prozess-Hierarchien
        ps auxf | grep -E "cmd\.exe.*powershell|bash.*nc" >> /var/log/suspicious_processes.log

        # CPU-Spikes überwachen
        top -b -n 1 | grep -E "crypto|miner" >> /var/log/cpu_anomalies.log

        # Netzwerkverbindungen analysieren
        netstat -tupan | grep -E ":(4444|8080|6666)" >> /var/log/network_anomalies.log

        sleep 60
    done
}

# YARA-Scan für bekannte Malware-Signaturen
yara_scan() {
    for dir in /bin /usr/bin /tmp; do
        yara /var/ossec/etc/rules/malware_rules.yar "$dir" >> /var/log/yara_detections.log
    done
}

# Hauptausführung
{
    monitor_processes &
    while true; do
        yara_scan
        sleep 3600
    done
} 2>&1 | /var/ossec/bin/ossec-csyslogd

[Compliance Framework]
[Standards] ───→ [Technische Kontrollen] ───→ [Auditierung]
      │                    │                       │
  PCI DSS             Konfiguration           Dokumentation
  HIPAA               Zugriffsrechte          Berichtswesen
  DSGVO               Verschlüsselung         Nachverfolgung
      │                    │                       │
      └────── [Automatisierte Prüfung] ──────────┘

<!-- Compliance-Regelwerk -->
<group name="compliance">
  <!-- PCI DSS Requirement 10.2 -->
  <rule id="100300" level="10">
    <if_group>authentication_success</if_group>
    <user>root|admin</user>
    <description>PCI DSS 10.2: Privileged user access logged</description>
    <group>pci_dss_10.2.2</group>
  </rule>

  <!-- DSGVO Artikel 32 -->
  <rule id="100301" level="12">
    <if_group>syscheck</if_group>
    <match>/var/www/html/user_data/</match>
    <description>GDPR Art. 32: Unauthorized access to personal data</description>
    <group>gdpr_32</group>
  </rule>
</group>

#!/bin/bash
# Compliance-Audit-Script

# Variablen
AUDIT_LOG="/var/log/compliance_audit.log"
CRITICAL_FILES="/etc/passwd /etc/shadow /etc/ssl/private"
COMPLIANCE_REPORT="/var/ossec/reports/compliance_$(date +%Y%m%d).txt"

# Logging-Funktion
log_audit() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$AUDIT_LOG"
}

# Berechtigungsprüfung
check_permissions() {
    log_audit "=== Berechtigungsprüfung ==="
    
    for file in $CRITICAL_FILES; do
        perms=$(stat -c "%a %u %g" "$file")
        log_audit "Datei: $file - Berechtigungen: $perms"
        
        # PCI DSS 7.1 Überprüfung
        if [[ $(stat -c "%a" "$file") -gt 600 ]]; then
            log_audit "WARNUNG: Zu offene Berechtigungen für $file"
        fi
    done
}

# Verschlüsselungsprüfung
check_encryption() {
    log_audit "=== Verschlüsselungsprüfung ==="
    
    # SSL/TLS Konfiguration
    if grep -q "SSLv3" /etc/nginx/nginx.conf; then
        log_audit "KRITISCH: Veraltetes SSL-Protokoll in Verwendung"
    fi
    
    # DSGVO-relevante Verschlüsselung
    if ! grep -q "encryption=yes" /etc/fstab; then
        log_audit "WARNUNG: Festplattenverschlüsselung nicht aktiviert"
    fi
}

# Audit-Report generieren
generate_report() {
    {
        echo "=== Compliance Audit Report ==="
        echo "Datum: $(date)"
        echo "=== PCI DSS Anforderungen ==="
        grep "pci_dss" "$AUDIT_LOG"
        echo "=== DSGVO Anforderungen ==="
        grep "gdpr" "$AUDIT_LOG"
    } > "$COMPLIANCE_REPORT"
}

# Hauptausführung
{
    log_audit "Start Compliance Audit"
    check_permissions
    check_encryption
    generate_report
    log_audit "Compliance Audit abgeschlossen"
} || {
    log_audit "FEHLER: Audit fehlgeschlagen"
    exit 1
}

[Custom Rules Framework]
[Ereignisquellen] ───→ [Regellogik] ───→ [Aktionen]
         │                  │               │
    Logs/Events         Bedingungen     Reaktionen
    Sensoren           Korrelation     Benachrichtigung
    Metriken           Aggregation     Automatisierung
         │                  │               │
         └──── [Regeloptimierung] ─────────┘

<!-- Fortgeschrittene Custom Rules -->
<group name="custom_detection">
  <!-- Multi-Stage Angriffserkennung -->
  <rule id="100400" level="3">
    <decoded_as>sshd</decoded_as>
    <match>authentication success</match>
    <description>SSH Login erfolgreich</description>
  </rule>

  <rule id="100401" level="8">
    <if_sid>100400</if_sid>
    <if_matched_group>software_change</if_matched_group>
    <timeframe>300</timeframe>
    <description>Verdächtige Aktivität nach SSH-Login</description>
    <mitre>
      <id>T1078</id>
      <tactic>Initial Access</tactic>
    </mitre>
  </rule>

  <!-- Anwendungsspezifische Erkennung -->
  <rule id="100402" level="12">
    <if_group>web</if_group>
    <match>SELECT.*UNION|INSERT.*INTO|UPDATE.*SET</match>
    <regex>\.php$|\.asp$</regex>
    <description>SQL Injection Versuch erkannt</description>
    <options>no_log</options>
    <group>attack,sql_injection</group>
  </rule>
</group>

#!/bin/bash
# Custom Rule Management Script

# Regelverzeichnis
RULES_DIR="/var/ossec/etc/rules"
BACKUP_DIR="/var/ossec/backup/rules"

# Regel-Template erstellen
create_rule_template() {
    local RULE_ID="$1"
    local DESCRIPTION="$2"
    
    cat << EOF > "$RULES_DIR/custom_${RULE_ID}.xml"
<!-- 
    Rule ID: ${RULE_ID}
    Description: ${DESCRIPTION}
    Created: $(date)
-->
<group name="custom_${RULE_ID}">
    <rule id="${RULE_ID}" level="0">
        <if_sid>530</if_sid>
        <description>${DESCRIPTION}</description>
        <mitre>
            <id>TXXXX</id>
            <tactic>Detection</tactic>
        </mitre>
    </rule>
</group>
EOF
}

# Regel testen
test_rule() {
    local RULE_FILE="$1"
    echo "Testing rule: $RULE_FILE"
    
    # Syntax-Check
    if ! /var/ossec/bin/ossec-analysisd -t -c "$RULE_FILE"; then
        echo "Syntax error in rule file"
        return 1
    fi
    
    # Test-Events generieren
    echo "Generating test events..."
    logger "TEST: Custom rule test event for $RULE_FILE"
    
    # Regel-Matching überprüfen
    tail -f /var/ossec/logs/alerts/alerts.log | grep -q "$RULE_FILE" &
    TAIL_PID=$!
    sleep 5
    kill $TAIL_PID
}

# Regel-Performance überwachen
monitor_rule_performance() {
    local RULE_ID="$1"
    
    echo "Monitoring rule performance for ID: $RULE_ID"
    {
        # Event-Zähler
        grep "Rule: $RULE_ID" /var/ossec/logs/alerts/alerts.log | wc -l
        
        # False Positive Rate
        grep "Level: 0" /var/ossec/logs/alerts/alerts.log | grep "Rule: $RULE_ID" | wc -l
        
        # Durchschnittliche Verarbeitungszeit
        grep "Rule: $RULE_ID" /var/ossec/logs/ossec.log | awk '{sum+=$NF} END {print sum/NR}'
    } > "/var/ossec/stats/rule_${RULE_ID}_performance.txt"
}

# Hauptfunktionen
case "$1" in
    "create")
        create_rule_template "$2" "$3"
        ;;
    "test")
        test_rule "$2"
        ;;
    "monitor")
        monitor_rule_performance "$2"
        ;;
    *)
        echo "Usage: $0 {create|test|monitor} [rule_id] [description]"
        exit 1
        ;;
esac