Skip to content

Latest commit

 

History

History
38 lines (29 loc) · 1.43 KB

README.md

File metadata and controls

38 lines (29 loc) · 1.43 KB

WazuhMikrotik

  • Wazuh decoders for mikrotik
  • Script for monitoring Wireguard peers login/logout

Tested on RouterOS 7.12 and Wazuh 4.7.1

Steps

  • Configure Wazuh manager to receive Syslog messages: https://wazuh.com/blog/how-to-configure-rsyslog-client-to-send-events-to-wazuh/

  • Copy 1001-mikrotik_decoders.xml in /var/ossec/etc/decoders/1001-mikrotik_decoders.xml

    • If you use docker run:
    • docker cp /root/1001-mikrotik_decoders.xml single-node-wazuh.manager-1:/var/ossec/etc/decoders/1001-mikrotik_decoders.xml

  • Copy local_rules.xml in /var/ossec/etc/rules/local_rules.xml

    • If you use wazuh docker run:
    • docker cp /root/local_rules.xml single-node-wazuh.manager-1:/var/ossec/etc/rules/local_rules.xml

  • Restart Wazuh

    • If you use wazuh docker run:
    • docker restart single-node-wazuh.manager-1

  • Configure Mikrotik to send logs to syslog server (Wazuh)

  • Create script on mikrotik to monitoring wireguard peers activity and schedule it for running every 30sec

Author

👤 Giuseppe Trifilio

🤝 Contributing

  • Contributions, issues and feature requests are welcome!
    Feel free to check issues page.

Show your support

  • Give a ⭐️ if this project helped you!
  • BTC: bc1qga68pwf49sfhdd9nj96m8e2s65ypjegtx8lafj
  • BNB: 0x720b2b3e4436ec7064d54598BAd113e5293fF691