how to test the integration

[NaufalIhsan2002]

Hello

i followed your script and i think everything is working fine and also wazuh already enabling the integration

but i don't understand how to test it, is it really the integration working properly ?.
can you please help me or explain to me how to test it?

thank youu so much

[misje]

It's easiest to test a file, so here is an example for that:

1. Since I don't know how your FIM/syscheck is configured in Wazuh, you'll have to figure out yourself which directories/files are monitored, and select a target for the test. The default settings depend on the operating system of your agent. For Linux, for instance, it looks like this (/var/ossec/etc/ossec.conf), but settings may be overridden through group settings configured in Wazuh master/worker:
   • /etc (with some exceptions)
   • /usr/bin
   • /usr/sbin
   • /bin
   • /sbin
   • /boot
2. Prepare a file that you want to detect. Get the SHA-256 hash of it. In Linux, use something like sha256sum to get its hash.
3. Create a File observable in OpenCTI, enter the SHA-256 hash and select the "create indicator" toggle.
4. Copy the file to a monitored directory on an agent, and wait for the alert to fire

If you are using a configuration other than the suggested in README.md, be sure to include syscheck(_file) alerts, either by group name or ID. The suggested defaults should work for your test.

[NaufalIhsan2002]

thank you so much for your explanation. now the alert for sha256sum hash already show up. but how can i test to get alert for domain name or ipv4/ipv6 ?

[misje]

For DNS queries, look in the README. You need to ensure that sysmon event 22 is decoded in Wazuh (depends on your version), and you need a custom rule that creates an even for DNS queries.

For any other network event, you just need to ensure that it is in the group "ids". If you have events with network traffic fields in other groups, feel free to suggest more groups to match against. I haven't gone through the rules source and found them all manually yet.

[NaufalIhsan2002]

im trying to get DNS Query dan Opencti intergration alert but i only got DNS Query alert

how can i get Opencti alert?

[misje]

Can you please share some details about your event? This ID is not part of the official Wazuh ruleset, so I don't know what it looks like. As mentioned earlier, if it is not part of the rule group "ids", you'll have to modify the source code of the integration. You also have to ensure that the integration is configured to act on this event ID or event group in the wazuh config (<group>sysmon_eid1_detections,sysmon_eid3_detections,sysmon_eid7_detections,sysmon_eid22_detections,syscheck_file,osquery_file,ids,sysmon_process-anomalies,audit_command</group> in the README example).

[NaufalIhsan2002]

im trying to use dnslookup command to trigger the integration alert, is that the right thing to test the integration?

[NaufalIhsan2002]

Can you help me please?