Wazuh's active response capabilities enable a proactive defense strategy by automatically blocking malicious IP addresses upon detection of specific security events. This approach significantly reduces the window of opportunity for attackers to gain persistence or spread malware within a network, moving beyond a purely reactive stance.

How Active Response Works

The core of Wazuh's active response functionality relies on the interaction between the Wazuh agent and manager. When a Wazuh agent detects a suspicious activity, such as multiple failed login attempts indicative of a brute-force attack, it forwards this information to the Wazuh manager. The manager, configured with specific rules, can then trigger an active response.

For Linux systems, this response typically involves executing an iptables command. iptables acts as a local firewall, allowing administrators to define rules for network traffic. By default, a newly provisioned Linux server might allow connections to port 22 (SSH) from any IP address. Active response dynamically creates an iptables rule to block the identified malicious IP address, preventing further login attempts.

On Windows systems, a similar mechanism is employed using the route null command, which adds the offending IP address to a null route, effectively dropping traffic from that source.

Configuration and Scripting

Wazuh provides pre-built scripts for active responses, located in the /var/ossec/active-response/bin/ directory on both the manager and agents. The firewall_drop.sh script is commonly used for blocking IP addresses on Linux. These scripts are written in Bash and can be customized or extended to suit specific needs. Administrators can also develop their own scripts for unique response actions.

The configuration for active response is managed within the Wazuh manager's ossec.conf file, which can be accessed and edited directly or through the more user-friendly web interface.

Key Configuration Parameters:

• Whitelisting: Global whitelisting can be configured to exempt specific IP addresses or CIDR blocks from active response actions. This is crucial for ensuring legitimate users or services are not inadvertently blocked.
• Commands: This section defines the active response commands, linking a command name to its executable script (e.g., firewall_drop.sh).
• Active Response Tag: This is where the active response rules are defined.
  • Command Name: The name of the script to execute (e.g., firewall_drop).
  • Location: Specifies where the script should run:
    • local: Runs on the agent where the alert originated.
    • server: Runs on the Wazuh manager.
    • defined-agent: Runs on specific agent IDs. This offers granular control and is recommended for sensitive environments to prevent widespread disruption.
    • all: Runs on all agents. This option requires extreme caution.
  • Rules: Defines which alerts trigger the active response. This can be based on:
    • Level: Severity level of the alert (1-16).
    • Rule Groups: Alerts belonging to a specific group (e.g., authentication failures).
    • Rule ID: A specific alert rule ID.