开源SOC实现（三）-OpenSource EDR

https://documentation.wazuh.com/current/getting-started/components/wazuh-server.html

https://documentation.wazuh.com/current/installation-guide/wazuh-server/step-by-step.html

rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUHecho -e '[wazuh]ngpgcheck=1ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUHnenabled=1nname=EL-$releasever - Wazuhnbaseurl=https://packages.wazuh.com/4.x/yum/nprotect=1' | tee /etc/yum.repos.d/wazuh.repo

yum -y install wazuh-manager

systemctl daemon-reloadsystemctl enable wazuh-managersystemctl start wazuh-manager

systemctl status wazuh-manager

ps auxf | grep wazuh

http://192.168.116.201:9000/gettingstarted

netstat -npltd

curl https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh

//install.sh
#!/usr/bin/env bashset -e
# Provided primarily to simplify testing for staging, etc.RELEASE_URL=${FLUENT_BIT_PACKAGES_URL:-https://packages.fluentbit.io}RELEASE_KEY=${FLUENT_BIT_PACKAGES_KEY:-https://packages.fluentbit.io/fluentbit.key}
echo "================================"echo " Fluent Bit Installation Script "echo "================================"echo "This script requires superuser access to install packages."echo "You will be prompted for your password by sudo."
# Determine package type to install: https://unix.stackexchange.com/a/6348# OS used by all - for Debs it must be Ubuntu or Debian# CODENAME only used for Debsif [ -f /etc/os-release ]; then    # Debian uses Dash which does not support source    # shellcheck source=/dev/null    . /etc/os-release    OS=$( echo "${ID}" | tr '[:upper:]' '[:lower:]')    CODENAME=$( echo "${VERSION_CODENAME}" | tr '[:upper:]' '[:lower:]')elif lsb_release &>/dev/null; then    OS=$(lsb_release -is | tr '[:upper:]' '[:lower:]')    CODENAME=$(lsb_release -cs)else    OS=$(uname -s)fi
# Clear any previous sudo permissionsudo -k
# Now set up repos and install dependent on OS, version, etc.# Will require sudocase ${OS} in    amzn|amazonlinux)        # We need variable expansion and non-expansion on the URL line to pick up the base URL.        # Therefore we combine things with sed to handle it.        sudo sh <<SCRIPTrpm --import $RELEASE_KEYcat << EOF > /etc/yum.repos.d/fluent-bit.repo[fluent-bit]name = Fluent Bitbaseurl = $RELEASE_URL/amazonlinux/VERSION_ARCH_SUBSTRgpgcheck=1repo_gpgcheck=1gpgkey=$RELEASE_KEYenabled=1EOFsed -i 's|VERSION_ARCH_SUBSTR|$releasever/$basearch/|g' /etc/yum.repos.d/fluent-bit.repocat /etc/yum.repos.d/fluent-bit.repoyum -y install fluent-bitSCRIPT    ;;    centos|centoslinux|rhel|redhatenterpriselinuxserver|fedora|rocky|almalinux)        sudo sh <<SCRIPTrpm --import $RELEASE_KEYcat << EOF > /etc/yum.repos.d/fluent-bit.repo[fluent-bit]name = Fluent Bitbaseurl = $RELEASE_URL/centos/VERSION_ARCH_SUBSTRgpgcheck=1repo_gpgcheck=1gpgkey=$RELEASE_KEYenabled=1EOFsed -i 's|VERSION_ARCH_SUBSTR|$releasever/$basearch/|g' /etc/yum.repos.d/fluent-bit.repocat /etc/yum.repos.d/fluent-bit.repoyum -y install fluent-bitSCRIPT    ;;    ubuntu|debian)        # Remember apt-key add is deprecated        # https://wiki.debian.org/DebianRepository/UseThirdParty#OpenPGP_Key_distribution        sudo sh <<SCRIPTexport DEBIAN_FRONTEND=noninteractivemkdir -p /usr/share/keyrings/curl $RELEASE_KEY | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpgcat > /etc/apt/sources.list.d/fluent-bit.list <<EOFdeb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] $RELEASE_URL/${OS}/${CODENAME} ${CODENAME} mainEOFcat /etc/apt/sources.list.d/fluent-bit.listapt-get -y updateapt-get -y install fluent-bitSCRIPT    ;;    *)        echo "${OS} not supported."        exit 1    ;;esac
echo ""echo "Installation completed. Happy Logging!"echo ""

vi /etc/fluent-bit/fluent-bit.conf

[SERVICE]    flush        5    daemon       Off    log_level    info    parsers_file parsers.conf    plugins_file plugins.conf    http_server  Off    http_listen  0.0.0.0    http_port    2020    storage.metrics on    storage.path /var/log/flb-storage/    storage.sync normal    storage.checksum off    storage.backlog.mem_limit 5M    Log_File /var/log/td-agent-bit.log[INPUT]    name  tail    path  /var/ossec/logs/alerts/alerts.json    tag wazuh    parser  json    Buffer_Max_Size 5MB    Buffer_Chunk_Size 400k    storage.type      filesystem    Mem_Buf_Limit     512MB[OUTPUT]    Name  tcp    Host  192.168.116.201    Port  5555    net.keepalive off    Match wazuh    Format  json_lines    json_date_key true

systemctl start fluent-bitsystemctl enable fluent-bit

tailf /var/log/td-agent-bit.log