Ruleset Synology NAS#90
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new Synology NAS integration for Wazuh by introducing custom decoders/rules plus accompanying documentation and sample logs to validate expected alerting behavior.
Changes:
- Introduces a Synology NAS decoder (
synology_nas) to parse DSM syslog events (Connection/Security/System). - Adds a ruleset to generate alerts for auth events, auto-blocks, updates, shutdown initiation, UPS disconnects, and storage issues.
- Adds a README and sample log corpus for
wazuh-logtest/dashboard validation.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.
| File | Description |
|---|---|
| integrations/synology_nas/decoders/nas_synology_decoders.xml | New decoder definitions for Synology DSM syslog messages. |
| integrations/synology_nas/rules/nas_synology_rules.xml | New rules mapping decoded Synology events to Wazuh alert levels/groups. |
| integrations/synology_nas/README.md | Setup + validation instructions for the integration. |
| integrations/synology_nas/sample_logs.txt | Example Synology log lines to test decoder/rule matching. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| <rule id="100401" level="5"> | ||
| <if_sid>100400</if_sid> | ||
| <match>failed to log in</match> | ||
| <description>Synology NAS: Login FAILURE for user '$(synology_user)' from $(srcip) via $(synology_app).</description> | ||
| <group>authentication_failed,</group> | ||
| </rule> |
| <rule id="100402" level="3"> | ||
| <if_sid>100400</if_sid> | ||
| <match>successfully passed the first authentication of 2FA</match> | ||
| <description>Synology NAS: User '$(synology_user)' passed first 2FA step from $(srcip).</description> | ||
| <group>authentication_success,</group> | ||
| </rule> |
| <rule id="100403" level="3"> | ||
| <if_sid>100400</if_sid> | ||
| <match>signed in to</match> | ||
| <description>Synology NAS: User '$(synology_user)' successfully logged into $(synology_app) from $(srcip).</description> | ||
| <group>authentication_success,</group> | ||
| </rule> |
| <rule id="100404" level="2"> | ||
| <if_sid>100400</if_sid> | ||
| <match>logged out</match> | ||
| <description>Synology NAS: User '$(synology_user)' logged out from $(synology_app).</description> | ||
| </rule> |
|
|
||
| 1. Navigate to **Server Management** --> **Ruleset Test**. | ||
| 2. Paste a raw log from `sample_logs.txt` (e.g., `Connection: User [admin] from [192.168.1.10] failed to log in via [DSM]`). | ||
| 3. Verify Phase 2 identifies the `synology-nas` decoder and Phase 3 triggers the expected alert. |
| #### Verify in Wazuh Dashboard | ||
|
|
||
| 1. Navigate to the **Discover** tab in the Wazuh Dashboard. | ||
| 2. Filter by `Field` `decoder.name`, `Operator` `is`, `Value` `synology-nas`. |
|
Hi @leonfullxr — I know this is still a draft, so this is early feedback to help it along:
Nits: base rule 100400 (level 3) fires on the benign "Test message from Synology Syslog Client" heartbeat — consider a dedicated low-noise/ignore rule; and 100409 combines drive-removed and volume-degraded into one rule, so its description always mentions both with one left empty. |
No description provided.