diff --git a/integrations/synology_nas/README.md b/integrations/synology_nas/README.md new file mode 100644 index 00000000..24ba4adb --- /dev/null +++ b/integrations/synology_nas/README.md @@ -0,0 +1,83 @@ +### Synology NAS - Wazuh Integration + +#### **Table of Contents** + + * [Introduction](#introduction) + * [Prerequisites](#prerequisites) + * [Initial Synology Configuration](#initial-synology-configuration) + * [Installing and Configuring the Integration](#installing-and-configuring-the-integration) + * [Integration Testing](#integration-testing) + +### Introduction + +This guide outlines the steps to integrate Synology NAS logs with Wazuh. This integration relies on parsing the `Connection`, `System`, and `Security` logs generated by Synology's DiskStation Manager (DSM) to track user authentication (SMB/CIFS, SSH, DSM UI), hardware health events, and automated security blocks. + +### Prerequisites + +Before starting, ensure the following: + + * A functioning Synology NAS device. + * A Wazuh Manager (or a designated Wazuh Agent) configured to receive Syslog traffic. + +### Initial Synology Configuration + +To forward Synology logs to Wazuh, you must configure the NAS to send its syslog entries. +1. Open DSM and launch the **Log Center** package. +2. Navigate to **Log Sending**. +3. Check the box to send logs to a syslog server, enter your Wazuh Manager/Agent IP address, select the protocol (UDP/TCP), and set the port (default 514). +4. Apply the settings. Ensure your Wazuh instance has a `` block active in `ossec.conf` to receive them. + +### Installing and Configuring the Integration + +#### Copy the Custom Decoders + +The custom decoders instruct Wazuh on how to parse the standard Synology bracketed log format. Copy the decoders file to the Wazuh Manager: + +```bash +cp integrations/synology_nas/decoders/nas_synology_decoders.xml /var/ossec/etc/decoders/ + +``` + +#### Copy the Custom Rules + +The custom rules map the decoded fields to specific alerts, such as alerting on 2FA failures, SSH blocks, or degraded volumes. Copy the rules file to the Wazuh Manager: + +```bash +cp integrations/synology_nas/rules/nas_synology_rules.xml /var/ossec/etc/rules/ + +``` + +#### Set File Permissions + +Ensure that the Wazuh user has the appropriate permissions: + +```bash +chown wazuh:wazuh /var/ossec/etc/decoders/nas_synology_decoders.xml +chown wazuh:wazuh /var/ossec/etc/rules/nas_synology_rules.xml +chmod 660 /var/ossec/etc/decoders/nas_synology_decoders.xml +chmod 660 /var/ossec/etc/rules/nas_synology_rules.xml + +``` + +#### Restart the Wazuh Manager (If using CLI) + +```bash +systemctl restart wazuh-manager + +``` + +### Integration Testing + +#### Test Using Wazuh-Logtest + +Verify the integration using the `wazuh-logtest` tool with the provided `sample_logs.txt`: + +1. Navigate to **Server Management** --> **Ruleset Test**. +2. Paste a raw log from `sample_logs.txt` (e.g., `Connection: User [admin] from [192.168.1.10] failed to log in via [DSM]`). +3. Verify Phase 2 identifies the `synology-nas` decoder and Phase 3 triggers the expected alert. + +#### Verify in Wazuh Dashboard + +1. Navigate to the **Discover** tab in the Wazuh Dashboard. +2. Filter by `Field` `decoder.name`, `Operator` `is`, `Value` `synology-nas`. +3. Monitor the ingested Synology events in real-time. diff --git a/integrations/synology_nas/decoders/nas_synology_decoders.xml b/integrations/synology_nas/decoders/nas_synology_decoders.xml new file mode 100644 index 00000000..10113603 --- /dev/null +++ b/integrations/synology_nas/decoders/nas_synology_decoders.xml @@ -0,0 +1,74 @@ + + + + ^Connection$|^Security$|^System$ + + + + synology_nas + ^User [(\S+)] from [(\d+.\d+.\d+.\d+)] failed to log in via [(\S+)] + user, srcip, synology_app + + + + synology_nas + ^User [(\S+)] from [(\d+.\d+.\d+.\d+)] signed in to [(\w+)] successfully via [(\w+)] + user, srcip, synology_app, synology_auth + + + + synology_nas + ^User [(\S+)] from [(\d+.\d+.\d+.\d+)] has successfully passed the first authentication of 2FA via [(\w+)] + user, srcip, synology_auth + + + + synology_nas + ^User [(\S+)] from [(\d+.\d+.\d+.\d+)] logged out from [(\w+)] + user, srcip, synology_app + + + + synology_nas + ^Host [(\d+.\d+.\d+.\d+)] was blocked via [(\w+)] + srcip, synology_app + + + + synology_nas + ^Test message from Synology Syslog Client from \((\d+.\d+.\d+.\d+)\) + srcip + + + + synology_nas + ^Drive [(\d+)] was (\w+) + synology_drive, synology_action + + + + synology_nas + ^Volume [(\d+)] was (\w+) [(\d+/\d+)] + synology_volume, synology_action, synology_status + + + + synology_nas + ^(\.+) + synology_message + diff --git a/integrations/synology_nas/rules/nas_synology_rules.xml b/integrations/synology_nas/rules/nas_synology_rules.xml new file mode 100644 index 00000000..3d293ee6 --- /dev/null +++ b/integrations/synology_nas/rules/nas_synology_rules.xml @@ -0,0 +1,71 @@ + + + + synology_nas + Synology NAS: General system event. + + + + 100400 + failed to log in + Synology NAS: Login FAILURE for user '$(synology_user)' from $(srcip) via $(synology_app). + authentication_failed, + + + + 100400 + successfully passed the first authentication of 2FA + Synology NAS: User '$(synology_user)' passed first 2FA step from $(srcip). + authentication_success, + + + + 100400 + signed in to + Synology NAS: User '$(synology_user)' successfully logged into $(synology_app) from $(srcip). + authentication_success, + + + + 100400 + logged out + Synology NAS: User '$(synology_user)' logged out from $(synology_app). + + + + 100400 + was blocked via + Synology NAS: SECURITY BLOCK - Host $(srcip) was automatically blocked via $(synology_app). + access_denied,attack, + + + + + 100400 + successfully installed DSM + Synology NAS: DSM firmware update was successfully installed. + system_update, + + + + 100400 + started counting down to shutdown + Synology NAS: CRITICAL - System shutdown initiated! + system_shutdown, + + + + 100400 + UPS was disconnected + Synology NAS: WARNING - Local UPS battery backup was disconnected. + hardware_fault, + + + + 100400 + was removed|was degraded + Synology NAS: CRITICAL STORAGE FAULT - Drive $(synology_drive) removed or Volume $(synology_volume) degraded. + hardware_fault,data_loss_risk, + + + diff --git a/integrations/synology_nas/sample_logs.txt b/integrations/synology_nas/sample_logs.txt new file mode 100644 index 00000000..60a02cbf --- /dev/null +++ b/integrations/synology_nas/sample_logs.txt @@ -0,0 +1,25 @@ +Jun 9 10:30:15 SERVER-01 Connection: User [admin_user] from [111.111.111.111] failed to log in via [DSM] due to authorization failure. +Jun 9 10:31:02 SERVER-01 Connection: User [root] from [123.123.123.123] failed to log in via [SSH] due to authorization failure. +Jun 9 11:15:30 SERVER-01 Connection: User [anonymous] from [123.123.123.123] failed to log in via [FTP] due to authorization failure. + +# -- Successful Authentications & 2FA -- +Jun 9 10:32:01 SERVER-01 Connection: User [admin_user] from [111.111.111.111] has successfully passed the first authentication of 2FA via [password]. +Jun 9 10:32:08 SERVER-01 Connection: User [admin_user] from [111.111.111.111] signed in to [DSM] successfully via [password]. +Jun 9 11:05:12 SERVER-01 Connection: User [standard_user] from [222.222.222.222] signed in to [CIFS] successfully via [password]. + +# -- Session Terminations -- +Jun 9 10:45:00 SERVER-01 Connection: User [admin_user] from [111.111.111.111] logged out from [DSM]. + +# -- Automated Security Responses -- +# Synology's "Auto Block" feature kicking in after too many failed SSH/DSM attempts +Jun 9 11:20:05 SERVER-01 Security: Host [123.123.123.123] was blocked via [SSH]. + +# -- System & Update Events -- +Jun 9 10:35:22 SERVER-01 System: Test message from Synology Syslog Client from (123.123.123.124). +Jun 9 12:00:01 SERVER-01 System: System successfully installed DSM 7.2-64570 Update 1. +Jun 9 12:05:15 SERVER-01 System: Server started counting down to shutdown. + +# -- Hardware & Storage Events (High Priority Alerts) -- +Jun 9 14:10:20 SERVER-01 System: Drive [3] was removed. +Jun 9 14:10:22 SERVER-01 System: Volume [1] was degraded [3/4], please repair it. +Jun 9 14:15:00 SERVER-01 System: Local UPS was disconnected.