Aryan Patel
Sep 3, 2024
•
14 Min
TABLE OF CONTENTS
Share
Installing DFIR IRIS involves several steps to ensure all components are correctly set up and configured. But before that let’s under one another main component of IRIS which simplify the configuration of DFIR-IRIS i.e Docker and with the help of 5 Docker services working of IRIS is made easy.
You have to configure Docker in your system before trying to configure DFIR-IRIS.
For installing Docker Engine on a new host machine for the first time, you’ll first have to set up the Docker repository. Then you can install Docker.
Step-1: Setting up Docker's apt repository.
sudo apt-get update sudo apt-get install ca-certificates curl sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc sudo chmod a+r /etc/apt/keyrings/docker.asc |
Step-2: Install the Docker packages.
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin |
Step-3: Running hello-world image to check docker.
sudo docker run hello-world |
Now here's a detailed step-by-step guide to install DFIR-IRIS:
Step-1 : Clone the iris-web repository.
git clone https://github.com/dfir-iris/iris-web.git cd iris-web |
Step-2 : Checkout to the last non-beta tagged version.
git checkout v2.4.11 |
Step-3: Copy the environment file.
cp .env.model .env |
Step-4: Docker compose build.
docker compose build |
Step-5: Start IRIS.
docker compose up |
All this steps were for installation, Once installed, DFIR-IRIS requires some configuration to tailor it to your specific needs:
You’ll see this login page.
Or you can also use this command to find this line.
docker compose logs app | grep 'admin' |
To set an admin password during the initial startup, you can specify the environment variable IRIS_ADM_PASSWORD in the .env file. Note that this variable will be ignored once the administrator account has been established.
After all these steps you will have a fully working DFIR IRIS.
All these steps should be done through an administrator account. So now, Assign your IRIS user to the customer for whom you're processing alerts. Go to Advanced > Access control, and choose the user you want to associate with the customer account. In the pop-up window, click on the Customers tab, then click Manage. Add the desired customer to the selected user, and hit Save.
Locate your customer ID by going to Advanced > Customers, and choose the customer you wish to integrate. Record the customer ID shown at the top of the page, as you will need it when setting up the Wazuh server. The customer ID in the image below is 1.
Retrieve the API key for the current DFIR-IRIS user by clicking on the username and choosing My settings. Now you will be able to see the API key.
Now copy this API key and keep it safe as you will need it while integrating the Wazuh server.
Now let’s see what configuration we have to do on the Wazuh server side.
Step-1: First you have to create a script in file location /var/ossec/integrations/custom-wazuh_iris.py where you have to write following content to forward alerts to DFIR-IRIS.
#!/var/ossec/framework/python/bin/python3 # custom-wazuh_iris.py # Custom Wazuh integration script to send alerts to DFIR-IRIS import sys import json import requests import logging from datetime import datetime # Configure logging logging.basicConfig(filename='/var/ossec/logs/integrations.log', level=logging.INFO, format='%(asctime)s %(levelname)s: %(message)s', datefmt='%Y-%m-%d %H:%M:%S') # Function to create a formatted string from alert details def format_alert_details(alert_json): rule = alert_json.get("rule", {}) agent = alert_json.get("agent", {})
# Extracting MITRE information from the nested 'rule' structure mitre = rule.get("mitre", {}) mitre_ids = ', '.join(mitre.get("id", ["N/A"])) mitre_tactics = ', '.join(mitre.get("tactic", ["N/A"])) mitre_techniques = ', '.join(mitre.get("technique", ["N/A"])) details = [ f"Rule ID: {rule.get('id', 'N/A')}", f"Rule Level: {rule.get('level', 'N/A')}", f"Rule Description: {rule.get('description', 'N/A')}", f"Agent ID: {agent.get('id', 'N/A')}", f"Agent Name: {agent.get('name', 'N/A')}", f"MITRE IDs: {mitre_ids}", f"MITRE Tactics: {mitre_tactics}", f"MITRE Techniques: {mitre_techniques}", f"Location: {alert_json.get('location', 'N/A')}", f"Full Log: {alert_json.get('full_log', 'N/A')}" ] return '\n'.join(details) def main(): # Read parameters when integration is run if len(sys.argv) < 4: logging.error("Insufficient arguments provided. Exiting.") sys.exit(1)
alert_file = sys.argv[1] api_key = sys.argv[2] hook_url = sys.argv[3] # Read the alert file try: with open(alert_file) as f: alert_json = json.load(f) except Exception as e: logging.error(f"Failed to read alert file: {e}") sys.exit(1) # Prepare alert details alert_details = format_alert_details(alert_json) # Convert Wazuh rule levels(0-15) -> IRIS severity(1-6) alert_level = alert_json.get("rule", {}).get("level", 0) if alert_level < 5: severity = 2 elif alert_level >= 5 and alert_level < 7: severity = 3 elif alert_level >= 7 and alert_level < 10: severity = 4 elif alert_level >= 10 and alert_level < 13: severity = 5 elif alert_level >= 13: severity = 6 else: severity = 1 # Generate request payload = json.dumps({ "alert_title": alert_json.get("rule", {}).get("description", "No Description"), "alert_description": alert_details, "alert_source": "Wazuh", "alert_source_ref": alert_json.get("id", "Unknown ID"), "alert_source_link": "https://<IP ADDRESS>/app/wz-home", # Replace with actual Wazuh dashboard IP address "alert_severity_id": severity, "alert_status_id": 2, # 'New' status "alert_source_event_time": alert_json.get("timestamp", "Unknown Timestamp"), "alert_note": "", "alert_tags": f"wazuh,{alert_json.get('agent', {}).get('name', 'N/A')}", "alert_customer_id": 1, # '1' for default 'IrisInitialClient' "alert_source_content": alert_json # raw log }) # Send request to IRIS try: response = requests.post(hook_url, data=payload, headers={"Authorization": "Bearer " + api_key, "content-type": "application/json"}, verify=False) if response.status_code in [200, 201, 202, 204]: logging.info(f"Sent alert to IRIS. Response status code: {response.status_code}") else: logging.error(f"Failed to send alert to IRIS. Response status code: {response.status_code}") except Exception as e: logging.error(f"Failed to send alert to IRIS: {e}") sys.exit(1) if __name__ == "__main__": main() |
This script will help to forward alerts to DFIR-IRIS, here in this script you have to make some changes like:
Step-2: Now you have to change the ownership and permissions of the /var/ossec/integrations/custom-wazuh_iris.py file.
chmod 750 /var/ossec/integrations/custom-wazuh_iris.py chown root:wazuh /var/ossec/integrations/custom-wazuh_iris.py |
Step-3: Add the following configuration to the /var/ossec/etc/ossec.conf file to send all alerts with a severity of 7 or higher to DFIR-IRIS:
<ossec_config> <!-- IRIS integration --> <integration> <name>custom-wazuh_iris.py</name> <hook_url>https://<IRIS_IP_ADDRESS>/alerts/add</hook_url> <level>7</level> <api_key><IRIS_API_KEY></api_key> <!-- Replace with your IRIS API key --> <alert_format>json</alert_format> </integration> </ossec_config> |
-You will have to make several changes like:
You can also adjust the integration to forward only alerts generated by specific rule IDs or groups to DFIR-IRIS.
Step-4: Restart the Wazuh manager to apply the changes.
systemctl restart wazuh-manager |
- With this your WAZUH DFIR-IRIS integration is completed.
SOC Analyst with expertise in incident monitoring, Configuration wazuh-server. Holds a B.Tech degree from C.K. Pithawala.
Share