Risk Assessment Module User & Installation Guide (v1.

00) 740690–FORTIKA

The Framework Programme for Research & Innovation

Innovation actions (IA)

Risk Assessment Module

User & Installation Guide
v1.00

Content developed by NEXTEL SA

The FORTIKA project has received funding from the European Union’s
Horizon 2020 Research and innovation programme under Grant Agreement n°740690

NEXTEL | 2019
June 2019 1 NEXTEL
 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

Table of Contents
_Toc13145352
FORTIKA Risk Assessment Module - User & Installation Guide ................................................... 3
1.1 Environment discovery ...................................................................................................... 3
1.2 Bundle installation .......................................................................................................... 4
1.3 Prerequisites MS Windows 10 .............................................................................................. 5
1.4 Risk agent installation. Wazuh agent installation. ......................................................................... 5
1.5 Risk agent configuration and registration .................................................................................. 6
1.5.1 Linux agent configuration ...................................................................................... 6
1.5.2 Windows agent configuration ................................................................................. 6
1.5.3 Linux agent registration ........................................................................................ 7
1.5.4 Windows agent registration ................................................................................... 7
1.6 Test and list agents connected ............................................................................................. 7
1.7 Risk assessment configuration.............................................................................................. 7
1.8 Configure MS Windows Audit .............................................................................................. 9
1.9 Configure MS Windows agent ............................................................................................ 10
1.10 Configure Integration with VirusTotal.................................................................................... 11
1.10.1 Register in VirusTotal ...................................................................................... 11
1.10.2 Configure server side....................................................................................... 12
1.10.3 Configure agent side ....................................................................................... 12
1.10.4 Checking alerts and risk output ......................................................................... 12
1.11 Visualization and evolution of the risks on real time .................................................................... 13

Content developed by NEXTEL SA

© Copyright FORTIKA Consortium 2019

The FORTIKA project has received funding from the European Union’s
Horizon 2020 Research and innovation programme under Grant Agreement n°740690

June 2019 2 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

FORTIKA Risk Assessment Module - User & Installation Guide

The FORTIKA risk assessment module, will provide operational information on real time of security
events evaluated considering the importance or ponderation of the information asset where this
event is detected. a risk value associated to an alert.

1.1 Environment discovery

Before deploying the solution on the SME or the operational environment, it is necessary to make a
discovery on the assets, where agents will be installed. IT inventory is necessary to know IP and
operating system to later install the agent.

The inventory of the systems under studio can be done using nmap, providing information on hosts
and operating system of a network address.

The following nmap command will do a network discovery scan with OS detction

nmap -O -PE [Link]/24

Also available with a graphical interface Zenmap, [Link] where the output of the
inventory of tarjects under monitoring will be displayed. Nmap is available for windows and linux.

Figure 1: Zenmap output for a network discovery scan with OS detection

With this step, the environment under studio will de determined with the operating system. It is also
important to start to think the importance of each of the assets discovered.

Risk detection bundle will be configured to assess different values that can be associated to each of
the systems discovered.

June 2019 3 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

1.2 Bundle installation

This section describes a manual instantiation of the risk bundle in the FORTIKA gateway.

It is necessary to provision the required configuration files, which will be allocated in the gateway,
for example in /home/nextel/risk_bundle_conf

Required configuration files need to be locally uploaded to the GW, before running the docker run
command. Default values for the configuration files can be found here on GitLab.
[Link]
ule/tree/master/volume
After copy the configuration files you should manually change the permissions for filebeat.

chown root:root /home/nextel/risk_bundle_conf/filebeat/[Link]

With filebeat it will be possible to export risk and alerts to an ELK (elasticsearch, logstah and
kibana), and enable visualization in a graphical interface.

docker run -t -d --network fortikaBridge -p 1514:1514/udp -p 1515:1515 -p 55000:55000 \

-v /home/nextel/risk_bundle_conf/wazuh/[Link]:/var/ossec/etc/[Link] \
-v /home/nextel/risk_bundle_conf/wazuh/0380-windows_decoders.xml:/var/ossec/ruleset/decoders/0380-windows_decoders.xml \
-v /home/nextel/risk_bundle_conf/wazuh/local_rules.xml:/var/ossec/etc/rules/local_rules.xml \
-v /home/pirate/risk-detection/volume/wazuh/usb-devices:/var/ossec/etc/lists/usb-devices \
-v /home/nextel/risk_bundle_conf/alerts-forwarder/[Link]:/usr/src/apps/alerts-forwarder/config/[Link] \
-v /home/nextel/risk_bundle_conf/filebeat/[Link]:/etc/filebeat/[Link] \
-v /home/nextel/risk_bundle_conf/logs:/usr/src/apps/logs \
--hostname risk-server \
--name risk [Link]/wp4-fortika-modules-components/bundle-registry-test/risk-assessment:latest

If docker run command ends without errors, you can access to the risk bundle and test the services
running.

docker exec -it risk bash

ps -ef

UID PID PPID C STIME TTY TIME CMD

root 1 0 0 10:40 pts/0 00:00:00 /bin/bash /home/pi/[Link]
root 40 1 0 10:40 ? 00:00:00 /var/ossec/bin/ossec-authd
ossec 50 1 1 10:40 ? 00:00:01 /var/ossec/bin/wazuh-db
root 68 1 0 10:40 ? 00:00:00 /var/ossec/bin/ossec-execd
ossec 77 1 5 10:40 ? 00:00:06 /var/ossec/bin/ossec-analysisd
root 85 1 35 10:40 ? 00:00:37 /var/ossec/bin/ossec-syscheckd
ossecr 95 1 0 10:40 ? 00:00:00 /var/ossec/bin/ossec-remoted
root 118 1 0 10:40 ? 00:00:00 /var/ossec/bin/ossec-logcollector
ossec 124 1 0 10:40 ? 00:00:00 /var/ossec/bin/ossec-monitord
root 131 1 0 10:40 ? 00:00:00 /var/ossec/bin/wazuh-modulesd
ossec 181 1 2 10:40 pts/0 00:00:02 node [Link]
root 182 1 2 10:40 pts/0 00:00:02 /etc/filebeat/filebeat -e -c /etc/filebeat/[Link]
root 183 1 2 10:40 pts/0 00:00:02 npm
root 184 1 0 10:40 pts/0 00:00:00 tail -f /dev/null
root 238 183 0 10:40 pts/0 00:00:00 sh -c nodemon [Link]
root 239 238 3 10:40 pts/0 00:00:03 node /usr/local/bin/nodemon [Link]
root 258 239 89 10:40 pts/0 00:01:23 /usr/local/bin/node [Link]
root 539 0 0 10:41 pts/1 00:00:00 bash
root 838 539 0 10:41 pts/1 00:00:00 ps -ef

June 2019 4 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

1.3 Prerequisites MS Windows 10

This guide has been tested for MS Windows 10. Configuration files and use cases described are tested
for Windows 10.

1.4 Risk agent installation. Wazuh agent installation.

The following diagram describes the solution which is based on agents and server deployment for
the risk detection module.

Figure 2: Generic deployment for risk detection module components

This section describes wazuh-agent installation, where the final operating system could be windows
or linux based.

Linux, Debian ubuntu installation

apt-get install wazuh-agent=3.8.2-1

Agent registration and configuration could be automated using variables. It is necessary to define at
least the variable WAZUH_MANAGER_IP. The agent will use this value to register and it will be the
assigned manager for forwarding events.

# WAZUH_MANAGER_IP="[Link]" apt-get install wazuh-agent=3.8.2-1

Further info:
[Link]
agent/wazuh_agent_linux_deb.html

Windows Installer chose also the concrete version for wazuh-agent=3.8.2-1

[Link]

June 2019 5 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

Further info:
[Link]
agent/wazuh_agent_windows.html

1.5 Risk agent configuration and registration

1.5.1 Linux agent configuration

If not previously configured. It is necessary to set up the WAZUH_MANAGER_IP. Agent configuration could
be done in the [Link] file.

/var/ossec/etc/[Link]

WAZUH_MANAGER_IP will be configured with the FORTIKA GW IP in the local network for the local clients.

<ossec_config>
<client>
<server>
<address>[Link]</address>
<port>1514</port>
<protocol>udp</protocol>
</server>

1.5.2 Windows agent configuration

Set WAZUH_MANAGER_IP with the graphical user interface. Wazuh windows agent uses a GUI for config-
uration, opening the log file or starting and stopping the service.

Figure 3: Windows agent configuration and management

June 2019 6 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

1.5.3 Linux agent registration

Check that configuration process is done WAZUH_MANAGER_IP previously configured. Then register the
agent and after that restart the service, from the CLI

/var/ossec/bin/agent-auth -m [Link]
/var/ossec/bin/ossec-control restart

1.5.4 Windows agent registration

Check that configuration process is done WAZUH_MANAGER_IP previously configured. Then register the
agent and after that restart the service, from the CLI, open cmd or PowerShell MS windows

PS C:\Program Files (x86)\ossec-agent> .\[Link]-m [Link]

Restart the service using the wazuh Windows GUI.

1.6 Test and list agents connected

Access risk server container

docker exec -it risk bash

Inside the risk-server container execute

root@risk-server:/var/ossec/bin# /var/ossec/bin/agent_control -lc

This command will list agents connected and its state Active or Disconnected.

Wazuh agent_control. List of available agents:

ID: 000, Name: risk-server (server), IP: [Link], Active/Local
ID: 001, Name: DESKTOP-DJ7F955, IP: [Link], Active
ID: 002, Name: traffic-gen-a, IP: [Link], Active
ID: 003, Name: traffic-gen-b, IP: [Link], Active

1.7 Risk assessment configuration

This section will set up the configuration for the risk assessment and forwarding risk results to DSS
bundle.

/home/nextel/risk_bundle_conf/alerts-forwarder/[Link]

June 2019 7 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

The risk server bundle will compute the risk by processing the alerts received from the risk agents
and computed against rules configured on the server side. The risk value produced will be the result
of the alert value with the value assigned to the asset where the alert has been detected, as follows:

Risk = Asset value * Alert value score on this asset

It is necessary to know the environment where we would deploy the agents. the asset value is
assigned from 1-5 to each of the assets depending on its criticality, 1 very low importance or weight
and 5 very important system. This value will be computed with the alert level to obtain the corre-
sponding risk level.

Once determined the network inventory using the environment discovery we will assign values to
the discovered assets that will be manually included in the alert-forwarder configuration file:

/home/nextel/risk_bundle_conf/alerts-forwarder/[Link]

{
...
"manager": {
"ip": "[Link]"
},
"risk": {
"assessment": {
"[Link]": 4,
"[Link]": 3,
"[Link]": 3
},
"lowest": "low",
"grades": [
{ "name": "low", "from": 0, "to": 49 },
{ "name": "moderate", "from": 50, "to": 66 },
{ "name": "high", "from": 67, "to": 75 }
]
}

Alert info and the computed risk level is forwarded to the FORTIKA Decision Support System DSS,
where it will implement mitigation actions and enforce or apply security policies based on the risk
information provided by the RDM.

This is configured in the alert forwarder configuration file:

/home/nextel/risk_bundle_conf/alerts-forwarder/[Link]

{
...
"dss": "[Link]
"log": "/usr/src/apps/logs/[Link]"
},
...
}

See more info on GitLab

[Link]
ule/tree/master
June 2019 8 NEXTEL
 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

1.8 Configure MS Windows Audit

For the detection of Windows 10 events it is necessary to activate in the Windows system audit
feature for Audit Policy.

 Audit account logon events

 Audit account management
 Audit logon even

[Link]
management

To do that, open Administrative Tools > Local Security Policy. A window like the one below will pop up.

We need to configure the “Audit account logon events” for “Success” and “Failure” events as shown below.

June 2019 9 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

The same for “Audit account management” and “Audit logon event”.

Once this change is applied, a new event will be generated every time a new account is generated
in the the MS Windows system.
As said in the prerequisites this has been tested for Windows 10, the generated event number will
be 4720, 4722, 4738, 4726. These events will be procesed by the local rules on the configuration
file.

/home/nextel/risk_bundle_conf/wazuh/ local_rules.xml

More information about auditing user account management events can be found here.
[Link]
management

1.9 Configure MS Windows agent

Include the following configuration for detection windows event in the agent using Windows CLI.
View/View Config

June 2019 10 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

Include this under log analysis policy in [Link]

<!-- Log analysis -->

<!-- Added by FORTIKA: Windows Defender App monitoring -->

<localfile>
<location>Microsoft-Windows-Windows Defender/Operational</location>
<log_format>eventchannel</log_format>
</localfile>

1.10 Configure Integration with VirusTotal

1.10.1 Register in VirusTotal

Sing up in VirusTotal web page [Link]
Register and get public API-key in settings section.

Go to the risk bundle manager and modify [Link]. Please note that this can be modified at
host level in the configuration file

/home/nextel/risk_bundle_conf/wazuh/[Link]

June 2019 11 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

1.10.2 Configure server side

Access risk server container

docker exec -it risk bash

Add in [Link] integration tag with your public API-Key.

<integration>
<name>virustotal</name>
<api_key>[Link]</api_key>
<group>syscheck</group>
<alert_format>json</alert_format>
</integration>

Enable integrator daemon and reload with these commands:

/var/ossec/bin/ossec-control enable integrator
/var/ossec/bin/ossec-control reload

Note: you should be kept in mind that the functionalities of VirusTotal public API-Key has limitations
such as: The request ratio to no more than four requests of per minute, and low priority access of
requests done for the VirusTotal engine.

In the agent:

1.10.3 Configure agent side

Monitor any folder with FIM (file integrity monitoring) adding in the <syscheck> tag on [Link]
in any agent:

<directories check_all="yes" realtime="yes" report_changes="yes">/path-

folder</directories>

Use this command to reload daemons:

/var/ossec/bin/ossec-control reload

1.10.4 Checking alerts and risk output

Alerts can be found on

/var/ossec/logs/alerts/[Link]

Risks can be found on

/usr/src/apps/logs/[Link]

June 2019 12 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

When check a virus file

Rule: 87105 (level 12) -> 'VirusTotal: Alert - /home/test/suspiciusfile - 17 en-
gines detected this file'
{"virustotal": {"permalink": "[Link]
[Link]/file/51732cd023793f45f1ca7737b7844e339b73523a45dc4d13e9c3dfa5dde9be7a/anal-
ysis/1512387296/", "sha1": "91e22909dba884c2e0b71f76ff825df90ea32d1a", "malicious":
1, "source": {"alert_id": "1519554946.71382", "sha1":
"91e22909dba884c2e0b71f76ff825df90ea32d1a", "file": "test/suspiciusfile", "md5":
"d74d8b51a4291c3bd80058aa540e4368"}, "positives": 17, "found": 1, "total": 59,
"scan_date": "2017-12-04 11:34:56"}, "integration": "virustotal"}

No alerts:
** Alert 1519555008.74088: - virustotal,
2018 Feb 25 11:36:48 (agentubuser) any->virustotal
Rule: 87103 (level 3) -> 'VirusTotal: Alert - No records in VirusTotal database'
{"virustotal": {"found": 0, "malicious": 0, "source": {"alert_id": "1519555007.73597",
"sha1": "e67490a19c868c602d099fbecf61e71ccf2235dc", "file": "/home/test/normalfile",
"md5": "386633098d8dfaaa7c315de168d47256"}}, "integration": "virustotal"}

Note: While it's monitoring, you can see another alert, if you has wrong key in configuration or you
pass the limit of request, in alerts you can see both messages:

Rule: 87102 (level 3) -> 'VirusTotal: Error: Check credentials'

Rule: 87101 (level 3) -> 'VirusTotal: Error: Public API request rate limit reached'

1.11 Visualization and evolution of the risks on real time

Filebeat module can export risk results to an external ELK (Elasticsearch, Logstash and Kibana) stack
just configuring the IP and port for Logstash on the configuration file.

/home/nextel/risk_bundle_conf/filebeat/ [Link]

filebeat:
prospectors:
- type: log
paths:
- "/usr/src/apps/logs/[Link]"
document_type: json
json.message_key: log
json.keys_under_root: true
json.overwrite_keys: true

output:
logstash:
# The Logstash hosts
hosts: ["[Link]:5000"]
# ssl:
# certificate_authorities: ["/etc/filebeat/[Link]"]

June 2019 13 NEXTEL

 Risk Assessment Module User & Installation Guide (v1.00) 740690–FORTIKA

To perform this integration a virtual machine with the ELK stack installed will be available and at a
disposal for implementation.

Kibana dashboard will show Top Agents connected and Agent risk evolution among others.

[1] .

June 2019 14 NEXTEL