Wazuh-Indexer Module

Quickly search your logs with Wazuh-Indexer module to spot IoCs.

Wazuh-Indexer

SOCFortress provided DFIR-IRIS module.
Contact SOCFortress »

Intro

Currently supports the Wazuh-Indexer and Elasticsearch 7.10.1

Use the Wazuh-Indexer module to quickly search your logs with Wazuh-Indexer module to spot IoCs. This module is designed to help SOC analysts quickly spot any other endpoints that have the same IoCs associated with their ingested events.

The module is built for the below IoC types:

• Ip Address
• Domain
• Sha256 Hash
• Filename

The module can be configured to search any Index and looks for IoCs in the following fields:

• dns_query
• dst_ip
• sha256
• data_win_eventdata_targetFilename

You can configure the module to search any index and any fields you like.

Configuration

Results

Install

Currently, the Wazuh-Indexer module can be ran as DFIR-IRIS Module.

Get started with DFIR-IRIS: Video Tutorial

The below steps assume you already have your own DFIR-IRIS application up and running.

1. Fetch the Wazuh-Indexer Module Repo

   git clone https://github.com/socfortress/iris-wazuhindexer-module
   cd iris-wazuhindexer-module
   

2. Install the module

   ./buildnpush2iris.sh -a
   

Configuration

Once installed, configure the module to include:

• Wazuh-Indexer Endpoint
• Wazuh-Indexer Username (Read permissions for your desired index required)
• Wazuh-Indexer Password
• Index naming pattern (e.g. wazuh-alerts*)
• Fields to search (e.g. dns_query, dst_ip, sha256, data_win_eventdata_targetFilename)

1. Navigate to Advanced -> Modules

Advanced -> Modules

2. Add a new module

Add a new module

3. Input the Module name: iris_wazuhindexer_module

Input Module

4. Configure the module

Configure Module

Running the Module

To run the module select Case -> IOC and select the dropdown menu.

Beta currently supports IoC of type: ip, domain, sha256, filename

IoC

Run Module

Refresh the webpage within your browser.

Auto refresh is coming soon

Issues?

If you are experiencing issues, please contact us at info@socfortress.co