This repository contains docker configurations for a combination of Wazuh PoCs. Different types of attacks are emulated on a docker container to see how Wazuh detects them.
Currently, the following PoCs are available:
- SQL Injection attack detection
- Shellshock attack detection
- Malware detection using Yara
- IPv4 monitoring using Maltiverse
- Hostname monitoring using Maltiverse
- URL monitoring using Maltiverse
- File Hash monitoring using Maltiverse
- Clone this repository
git clone git@github.com:pptx704/threat-visibility-configurations.git- Install Docker and Docker Compose
sudo apt install docker.io docker-compose- Increase the
vm.max_map_countkernel setting
sudo sysctl -w vm.max_map_count=262144- Generate SSL certificates for the Wazuh server
docker-compose -f generate-indexer-certs.yml run --rm generator- Update the Maltiverse API key inside
wazuh-config/manager_conf/ossec.conffile - Change environment variables inside
docker-compose.ymlfile as needed - Start the Docker containers
docker-compose up -d- Prepare the Wazuh manager and the Wazuh agent for the
PoCs
source prepare.sh- Emulate the attacks
source emulate-attack.sh