{"id":20722096,"url":"https://github.com/ketsapiwiq/siem-infra","last_synced_at":"2025-04-23T15:47:37.050Z","repository":{"id":37600166,"uuid":"274912839","full_name":"ketsapiwiq/siem-infra","owner":"ketsapiwiq","description":"Vulnerability detection, OSquery, fully-fledged Wazuh ELK stack with Linux and Windows Wazuh + osquery enrollment via Ansible.","archived":false,"fork":false,"pushed_at":"2022-06-14T12:43:58.000Z","size":1852,"stargazers_count":5,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-30T01:11:13.710Z","etag":null,"topics":["ansible","elasticsearch","kibana","osquery","security","siem","vulnerability-detection","wazuh"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ketsapiwiq.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-06-25T12:39:29.000Z","updated_at":"2024-05-20T21:32:37.000Z","dependencies_parsed_at":"2022-08-25T22:11:49.370Z","dependency_job_id":null,"html_url":"https://github.com/ketsapiwiq/siem-infra","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ketsapiwiq%2Fsiem-infra","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ketsapiwiq%2Fsiem-infra/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ketsapiwiq%2Fsiem-infra/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ketsapiwiq%2Fsiem-infra/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ketsapiwiq","download_url":"https://codeload.github.com/ketsapiwiq/siem-infra/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250464099,"owners_count":21434926,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","elasticsearch","kibana","osquery","security","siem","vulnerability-detection","wazuh"],"created_at":"2024-11-17T03:34:03.785Z","updated_at":"2025-04-23T15:47:37.026Z","avatar_url":"https://github.com/ketsapiwiq.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Wazuh-based SIEM with Linux and Windows osquery-enabled agents with Ansible + Vagrant\n\nFully-fledged Wazuh (OSSEC HIDS + Elastic stack) installation with Linux and Windows Wazuh agents and osquery, via Ansible and Vagrant.\n\n## Run\n\n### With Ansible, Vagrant and VirtualBox\n\n1. Install Vagrant\n2. Run `vagrant up`\n   \u003c!-- 1. Import the [Wazuh VM](https://documentation.wazuh.com/current/installation-guide/virtual-machine.html) --\u003e\n   \u003c!-- 2. Adapt the `wazuh-local.ini` inventory according to your network settings and desires --\u003e\n   \u003c!-- 3. Set some variables, e.g.: `export ANSIBLE_HOST_KEY_CHECKING=False;` --\u003e\n   \u003c!-- 4. Run: `ansible-playbook wazuh-vm-single-node.yml wazuh-manager.yml -i wazuh-local.ini` --\u003e\n\n\u003c!--\n\n#### Enroll the Linux agent\n\n1. `ansible-playbook wazuh-agent.yml -i wazuh-local.ini`\n\n#### Enroll the Windows agent\n\n1. Setup a WinRM-reachable Windows environment in the Ansible inventory `wazuh-local.ini`\n1. Run: `ansible-playbook wazuh-agent-win.yml -i wazuh-local.ini -k`\n   (on MacOS Cataline, do `export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES` before, see Bugs below) --\u003e\n\n### With Terraform (deprecated and not up-to-date)\n\n**_Careful: no firewall has been setup, your Terraform servers are listening on a public IP by default with NO KIBANA or ELASTIC AUTHENTICATION_**\n\n1. Set your `terraform.tfvars`\n2. Install Terraform plugin for your cloud provider\n3. `terraform apply`\n4. Install Ansible Terraform dynamic inventory binary at [adammck/terraform-inventory](https://github.com/adammck/terraform-inventory)\n5. Set some variable due to a plugin issue: `export TF_STATE=./;` (see https://github.com/adammck/terraform-inventory/issues/144)\n6. Run the Ansible playbooks\n\n### Known issues\n\n- `Get-Service OssecSvc` on Windows hosts: service is stopped after the playbook played.\n- Troubleshoot Windows osquery bugs\n\n## Workarounds\n\nOn MacOS Catalina, trying to use Ansible with WinRM, if you get:\n\n```\nobjc[11628]: +[NSNumber initialize] may have been in progress in another thread when fork() was called.\nobjc[11628]: +[NSNumber initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug.\nERROR! A worker was found in a dead state\n```\n\nYou need to set some variable: `export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES`\nSee https://github.com/ansible/ansible/issues/32499\n\n## External documentation\n\n- https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/index.html#vulnerability-detection\n- https://documentation.wazuh.com/current/user-manual/capabilities/osquery.html\n- https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/how-to-collect-wlogs.html\n\n## TODO\n\n### Known issues\n\n- Troubleshoot Windows osquery bugs\n\n### Features\n\n- Add Powershell command execution logging and alerting\n- Setup X-pack auth config + HTTPS/TLS certs everywhere\n- [Active response](https://documentation.wazuh.com/3.13/user-manual/capabilities/active-response/how-it-works.html#when-is-an-active-response-triggered)\n\n## Possible evolutions\n\n- add minotring of node modules security output recurring task (npm audit)\n- integrate other tools/sysinternals into ansible playbooks: https://docs.microsoft.com/en-us/sysinternals/downloads/rootkit-revealer\n  - with a script to suspend all processes and dump RAM and disk (sysinternals) as an action response\n- VirusTotal API / [Malice](https://github.com/maliceio/malice) / Cuckoo integration\n- Suricata integration\n- Multi-cluster / load-balanced Ansible playbook\n  - K8s/Helm ?\n\n### Low priority\n\n- WAF / CI/CD for application security?\n- more robust osquery configuration for Linux? https://github.com/palantir/osquery-configuration\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fketsapiwiq%2Fsiem-infra","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fketsapiwiq%2Fsiem-infra","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fketsapiwiq%2Fsiem-infra/lists"}