Getting Wazuh Connected to forward node

[lmb2100]

Running SO 2.3.190
Have Airgapped search node and manager (both in one VM)
have forward node connected to search manager and can see connected on grid on SOC.

I am setting up Wazuh and have the wazuh server on a forward node for that subnet. I have registered the agents using the sudo so-wazuh-agent-manage and have exported the keys and installed the correct version onto the devices and I can see the list of the registered agents , but it still says unable to connect to any server in the logs of the wazuh agent manager (the ip of the manager server is setup as the IP of the forward node). I am not sure what I am missing as this is my first time with wazuh. I do notice that when I do sudo /var/ossec/bin/manage-agents -l it only shows the 1 ID and none of the agents I have registered. is this different than doing it through sudo so-wazuh-agent-manage ? Thank you!

[cm-ops]

Did you also make the appropriate firewall allowances for the nodes to connect to the sensor?

[lmb2100]

I did the so-allow on the manager, but I am not sure what else needs to get allowed. I tested the 1514 port and it is being blocked somewhere. The host based firewall is turned off for testing and I do not know which rule would allow port the forward node.

[cm-ops]

Running so-allow will create the entry on the manager. To allow on the sensor, do the following on the manager node:
so-firewall includehost wazuh_agent $IP

Add this to the sensor's minion pillar file - /opt/so/saltstack/local/pillar/minions/

		firewall:
		  assigned_hostgroups:
		    chain:
		      DOCKER-USER:
		        hostgroups:
		          wazuh_agent:
		            portgroups:
		              - portgroups.wazuh_agent

Apply the firewall state on the sensor salt \*sensorname state.apply firewall
Restart the agent on the endpoint and check the logs.

[lmb2100]

Thank you! It still doesnt work even though I disabled the firewalld service. Wouldnt that let it through? I will re-enable it and try those rules. and that wazuh_agent $IP is that the ip of the wazuh agent or the sensor(forward Node)? Also the $ is included there? Also the *sensor name would be the forward node correct? Thank you!

[lmb2100]

I tried the commands and this is the sensor's minion pillar file and the salt *sensorname state.apply firewall command and output did I do it right? I just left out the top of the pillar file

mainint: 'ens3'
zeek_lbprocs: 1
suriprocs: 1
manager: 'securityonion1'
mtu: 1500
uniqueid: 1683833831
steno:
enabled: True
patch:
os:
source: 'manager'
schedule_name: 'manual'
enabled: True
splay: 300
firewall:
assigned_hostgroups:
chain:
DOCKER-USER:
hostgroups:
wazuh_agent:
portgroups:
- portgroups.wazuh_agent

salt \securityonion2_sensor state.apply firewall
securityonion2_sensor:
Data failed to compile:

Pillar failed to render with the following messages:

---

Rendering SLS 'minions.securityonion2_sensor' failed. Please see master log for details.

[cm-ops]

Check you yaml syntax on the firewall setting, make sure there are spaces, not tabs.

[lmb2100]

I made sure I got rid of tabs and it took the command and now it doesnt say no connection but do you know how I am supposed to check to see if I am getting the logs of the windows machine sent to security onion? I only see the logs of the forward node and the search node in the Security Onion Console. Am I supposed to be using fleet DM? Sorry very new to SO. Attached is the ossec logs for the agent. Thanks so much!

2023/05/31 19:48:33 rootcheck: INFO: Ending rootcheck scan.
2023/05/31 19:49:00 ossec-agent: INFO: Agent is restarting due to shared configuration changes.
2023/05/31 19:49:01 ossec-agent: INFO: Received exit signal.
2023/05/31 19:49:01 ossec-agent: INFO: Exiting...
2023/05/31 19:49:01 ossec-agent: INFO: (1314): Shutdown received. Deleting responses.
2023/05/31 19:49:01 ossec-agent: INFO: Using notify time: 10 and max time to reconnect: 60
2023/05/31 19:49:01 ossec-agent: INFO: (1410): Reading authentication keys file.
2023/05/31 19:49:01 ossec-agent: INFO: Started (pid: 4444).
2023/05/31 19:49:01 ossec-agent: INFO: Using AES as encryption method.
2023/05/31 19:49:01 rootcheck: INFO: Started (pid: 4444).
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\batfile'.
2023/05/31 19:49:01 ossec-agent: INFO: Trying to connect to server (10.131.3.35:1514/udp).
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\cmdfile'.
2023/05/31 19:49:01 ossec-agent: INFO: (4102): Connected to the server (10.131.3.35:1514/udp).
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\comfile'.
2023/05/31 19:49:01 ossec-agent: INFO: Windows version is 6.0 or newer. (Microsoft Windows 10 Pro [Ver: 10.0.16299] - Wazuh v3.13.1).
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\exefile'.
2023/05/31 19:49:01 sca: INFO: Module started.
2023/05/31 19:49:01 wazuh-modulesd:syscollector: INFO: Module started.
2023/05/31 19:49:01 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2023/05/31 19:49:01 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\piffile'.
2023/05/31 19:49:01 ossec-agent: INFO: (1951): Analyzing event log: 'Application'.
2023/05/31 19:49:01 sca: INFO: Loaded policy 'C:\Program Files (x86)\ossec-agent\ruleset\sca\sca_win_audit.yml'
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects'.
2023/05/31 19:49:01 ossec-agent: INFO: (1951): Analyzing event log: 'Security'.
2023/05/31 19:49:01 sca: INFO: Starting Security Configuration Assessment scan.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\Directory'.
2023/05/31 19:49:01 ossec-agent: INFO: (1951): Analyzing event log: 'System'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\Folder'.
2023/05/31 19:49:01 ossec-agent: INFO: (1950): Analyzing file: 'active-response\active-responses.log'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\Protocols'.
2023/05/31 19:49:01 sca: INFO: Starting evaluation of policy: 'C:\Program Files (x86)\ossec-agent\ruleset\sca\sca_win_audit.yml'
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Classes\Protocols [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: Started (pid: 4444).
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Policies'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Policies [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Security'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components'.
2023/05/31 19:49:01 ossec-agent: INFO: (6002): Monitoring registry entry: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components [x64]'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\programdata\microsoft\windows\start menu\programs\startup', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | realtime'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows\sysnative', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows\sysnative\drivers\etc', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows\sysnative\wbem', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows\sysnative\windowspowershell\v1.0', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows\system32', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows\system32\drivers\etc', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows\system32\wbem', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6003): Monitoring directory/file: 'c:\windows\system32\windowspowershell\v1.0', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | attributes | scheduled'.
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'file' entry 'c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini'
2023/05/31 19:49:01 ossec-agent: INFO: (6207): Ignore 'file' sregex '.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\Security\Policy\Secrets'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\Security\SAM\Domains\Account\Users'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\AppCs'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\DHCP'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent\Parameters\Cache'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx'
2023/05/31 19:49:01 ossec-agent: INFO: (6206): Ignore 'registry' entry 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ADOVMPPackage\Final'
2023/05/31 19:49:01 ossec-agent: INFO: (6207): Ignore 'registry' sregex '\Enum$'
2023/05/31 19:49:01 ossec-agent: INFO: Started (pid: 4444).
2023/05/31 19:49:01 ossec-agent: INFO: (6000): Starting daemon...
2023/05/31 19:49:01 rootcheck: INFO: Starting rootcheck scan.
2023/05/31 19:49:01 ossec-agent: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds
2023/05/31 19:49:01 ossec-agent: INFO: (6008): File integrity monitoring scan started.
2023/05/31 19:49:02 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2023/05/31 19:49:02 ossec-agent: INFO: (6009): File integrity monitoring scan ended.
2023/05/31 19:49:02 ossec-agent: INFO: (6012): Real-time file integrity monitoring started.
2023/05/31 19:49:04 sca: INFO: Evaluation finished for policy 'C:\Program Files (x86)\ossec-agent\ruleset\sca\sca_win_audit.yml'
2023/05/31 19:49:04 sca: INFO: Security Configuration Assessment scan finished. Duration: 0 seconds.
2023/05/31 19:49:05 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2023/05/31 19:49:06 rootcheck: INFO: Ending rootcheck scan.
2023/05/31 19:52:43 ossec-agent: ERROR: Could not get message for (X�ë�)

Ossec Log allowed firewall and changed back to udp.txt

[cm-ops]

Looks like it connected 2023/05/31 19:49:01 ossec-agent: INFO: (4102): Connected to the server (10.131.3.35:1514/udp). Are you not seeing any logs for the node in SOC?

[capitangiaco]

I've also add the wazuh_authd for the agent enrollment in the firewall of the sensor, but in the agent log I continue to see:

2023/06/15 16:18:28 wazuh-agent: ERROR: (1216): Unable to connect to '[192.168.231.182]:1514/tcp': 'A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.'.
2023/06/15 16:18:28 wazuh-agent: INFO: Requesting a key from server: 192.168.231.182
2023/06/15 16:18:49 wazuh-agent: ERROR: (1208): Unable to connect to enrollment service at '[192.168.231.182]:1515'

no problems if the agent point to the Security Onion Master!