From 10340c8ac00b5c97c3ac01cb5794065b1bcbf5f3 Mon Sep 17 00:00:00 2001 From: leonfullxr Date: Fri, 12 Jun 2026 16:25:40 +0200 Subject: [PATCH 1/2] Add Synology NAS integration with Wazuh, including decoders, rules, and sample logs --- integrations/synology_nas/README.md | 83 +++++++++++++++++++ .../decoders/nas_synology_decoders.xml | 74 +++++++++++++++++ .../synology_nas/rules/nas_synology_rules.xml | 71 ++++++++++++++++ integrations/synology_nas/sample_logs.txt | 25 ++++++ 4 files changed, 253 insertions(+) create mode 100644 integrations/synology_nas/README.md create mode 100644 integrations/synology_nas/decoders/nas_synology_decoders.xml create mode 100644 integrations/synology_nas/rules/nas_synology_rules.xml create mode 100644 integrations/synology_nas/sample_logs.txt diff --git a/integrations/synology_nas/README.md b/integrations/synology_nas/README.md new file mode 100644 index 00000000..25daeb48 --- /dev/null +++ b/integrations/synology_nas/README.md @@ -0,0 +1,83 @@ +### Synology NAS - Wazuh Integration + +#### **Table of Contents** + + * [Introduction](#introduction) + * [Prerequisites](#prerequisites) + * [Initial Synology Configuration](#initial-synology-configuration) + * [Installing and Configuring the Integration](#installing-and-configuring-the-integration) + * [Integration Testing](#integration-testing) + +### Introduction + +This guide outlines the steps to integrate Synology NAS logs with Wazuh. This integration relies on parsing the `Connection`, `System`, and `Security` logs generated by Synology's DiskStation Manager (DSM) to track user authentication (SMB/CIFS, SSH, DSM UI), hardware health events, and automated security blocks. + +### Prerequisites + +Before starting, ensure the following: + + * A functioning Synology NAS device. + * A Wazuh Manager (or a designated Wazuh Agent) configured to receive Syslog traffic. + +### Initial Synology Configuration + +To forward Synology logs to Wazuh, you must configure the NAS to send its syslog entries. +1. Open DSM and launch the **Log Center** package. +2. Navigate to **Log Sending**. +3. Check the box to send logs to a syslog server, enter your Wazuh Manager/Agent IP address, select the protocol (UDP/TCP), and set the port (default 514). +4. Apply the settings. Ensure your Wazuh instance has a `` block active in `ossec.conf` to receive them. + +### Installing and Configuring the Integration + +#### Copy the Custom Decoders + +The custom decoders instruct Wazuh on how to parse the standard Synology bracketed log format. Copy the decoders file to the Wazuh Manager: + +```bash +cp content/ruleset/synology_nas/decoders/nas_synology_decoders.xml /var/ossec/etc/decoders/ + +``` + +#### Copy the Custom Rules + +The custom rules map the decoded fields to specific alerts, such as alerting on 2FA failures, SSH blocks, or degraded volumes. Copy the rules file to the Wazuh Manager: + +```bash +cp content/ruleset/synology_nas/rules/nas_synology_rules.xml /var/ossec/etc/rules/ + +``` + +#### Set File Permissions + +Ensure that the Wazuh user has the appropriate permissions: + +```bash +chown wazuh:wazuh /var/ossec/etc/decoders/nas_synology_decoders.xml +chown wazuh:wazuh /var/ossec/etc/rules/nas_synology_rules.xml +chmod 660 /var/ossec/etc/decoders/nas_synology_decoders.xml +chmod 660 /var/ossec/etc/rules/nas_synology_rules.xml + +``` + +#### Restart the Wazuh Manager (If using CLI) + +```bash +systemctl restart wazuh-manager + +``` + +### Integration Testing + +#### Test Using Wazuh-Logtest + +Verify the integration using the `wazuh-logtest` tool with the provided `sample_logs.txt`: + +1. Navigate to **Server Management** --> **Ruleset Test**. +2. Paste a raw log from `sample_logs.txt` (e.g., `Connection: User [admin] from [192.168.1.10] failed to log in via [DSM]`). +3. Verify Phase 2 identifies the `synology-nas` decoder and Phase 3 triggers the expected alert. + +#### Verify in Wazuh Dashboard + +1. Navigate to the **Discover** tab in the Wazuh Dashboard. +2. Filter by `Field` `decoder.name`, `Operator` `is`, `Value` `synology-nas`. +3. Monitor the ingested Synology events in real-time. diff --git a/integrations/synology_nas/decoders/nas_synology_decoders.xml b/integrations/synology_nas/decoders/nas_synology_decoders.xml new file mode 100644 index 00000000..10113603 --- /dev/null +++ b/integrations/synology_nas/decoders/nas_synology_decoders.xml @@ -0,0 +1,74 @@ + + + + ^Connection$|^Security$|^System$ + + + + synology_nas + ^User [(\S+)] from [(\d+.\d+.\d+.\d+)] failed to log in via [(\S+)] + user, srcip, synology_app + + + + synology_nas + ^User [(\S+)] from [(\d+.\d+.\d+.\d+)] signed in to [(\w+)] successfully via [(\w+)] + user, srcip, synology_app, synology_auth + + + + synology_nas + ^User [(\S+)] from [(\d+.\d+.\d+.\d+)] has successfully passed the first authentication of 2FA via [(\w+)] + user, srcip, synology_auth + + + + synology_nas + ^User [(\S+)] from [(\d+.\d+.\d+.\d+)] logged out from [(\w+)] + user, srcip, synology_app + + + + synology_nas + ^Host [(\d+.\d+.\d+.\d+)] was blocked via [(\w+)] + srcip, synology_app + + + + synology_nas + ^Test message from Synology Syslog Client from \((\d+.\d+.\d+.\d+)\) + srcip + + + + synology_nas + ^Drive [(\d+)] was (\w+) + synology_drive, synology_action + + + + synology_nas + ^Volume [(\d+)] was (\w+) [(\d+/\d+)] + synology_volume, synology_action, synology_status + + + + synology_nas + ^(\.+) + synology_message + diff --git a/integrations/synology_nas/rules/nas_synology_rules.xml b/integrations/synology_nas/rules/nas_synology_rules.xml new file mode 100644 index 00000000..3d293ee6 --- /dev/null +++ b/integrations/synology_nas/rules/nas_synology_rules.xml @@ -0,0 +1,71 @@ + + + + synology_nas + Synology NAS: General system event. + + + + 100400 + failed to log in + Synology NAS: Login FAILURE for user '$(synology_user)' from $(srcip) via $(synology_app). + authentication_failed, + + + + 100400 + successfully passed the first authentication of 2FA + Synology NAS: User '$(synology_user)' passed first 2FA step from $(srcip). + authentication_success, + + + + 100400 + signed in to + Synology NAS: User '$(synology_user)' successfully logged into $(synology_app) from $(srcip). + authentication_success, + + + + 100400 + logged out + Synology NAS: User '$(synology_user)' logged out from $(synology_app). + + + + 100400 + was blocked via + Synology NAS: SECURITY BLOCK - Host $(srcip) was automatically blocked via $(synology_app). + access_denied,attack, + + + + + 100400 + successfully installed DSM + Synology NAS: DSM firmware update was successfully installed. + system_update, + + + + 100400 + started counting down to shutdown + Synology NAS: CRITICAL - System shutdown initiated! + system_shutdown, + + + + 100400 + UPS was disconnected + Synology NAS: WARNING - Local UPS battery backup was disconnected. + hardware_fault, + + + + 100400 + was removed|was degraded + Synology NAS: CRITICAL STORAGE FAULT - Drive $(synology_drive) removed or Volume $(synology_volume) degraded. + hardware_fault,data_loss_risk, + + + diff --git a/integrations/synology_nas/sample_logs.txt b/integrations/synology_nas/sample_logs.txt new file mode 100644 index 00000000..60a02cbf --- /dev/null +++ b/integrations/synology_nas/sample_logs.txt @@ -0,0 +1,25 @@ +Jun 9 10:30:15 SERVER-01 Connection: User [admin_user] from [111.111.111.111] failed to log in via [DSM] due to authorization failure. +Jun 9 10:31:02 SERVER-01 Connection: User [root] from [123.123.123.123] failed to log in via [SSH] due to authorization failure. +Jun 9 11:15:30 SERVER-01 Connection: User [anonymous] from [123.123.123.123] failed to log in via [FTP] due to authorization failure. + +# -- Successful Authentications & 2FA -- +Jun 9 10:32:01 SERVER-01 Connection: User [admin_user] from [111.111.111.111] has successfully passed the first authentication of 2FA via [password]. +Jun 9 10:32:08 SERVER-01 Connection: User [admin_user] from [111.111.111.111] signed in to [DSM] successfully via [password]. +Jun 9 11:05:12 SERVER-01 Connection: User [standard_user] from [222.222.222.222] signed in to [CIFS] successfully via [password]. + +# -- Session Terminations -- +Jun 9 10:45:00 SERVER-01 Connection: User [admin_user] from [111.111.111.111] logged out from [DSM]. + +# -- Automated Security Responses -- +# Synology's "Auto Block" feature kicking in after too many failed SSH/DSM attempts +Jun 9 11:20:05 SERVER-01 Security: Host [123.123.123.123] was blocked via [SSH]. + +# -- System & Update Events -- +Jun 9 10:35:22 SERVER-01 System: Test message from Synology Syslog Client from (123.123.123.124). +Jun 9 12:00:01 SERVER-01 System: System successfully installed DSM 7.2-64570 Update 1. +Jun 9 12:05:15 SERVER-01 System: Server started counting down to shutdown. + +# -- Hardware & Storage Events (High Priority Alerts) -- +Jun 9 14:10:20 SERVER-01 System: Drive [3] was removed. +Jun 9 14:10:22 SERVER-01 System: Volume [1] was degraded [3/4], please repair it. +Jun 9 14:15:00 SERVER-01 System: Local UPS was disconnected. From 3cd136ce6d724b3eb2663527a04ab5176ce815f4 Mon Sep 17 00:00:00 2001 From: leonfullxr Date: Fri, 12 Jun 2026 16:30:07 +0200 Subject: [PATCH 2/2] Updated README to include this repo structure --- integrations/synology_nas/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/integrations/synology_nas/README.md b/integrations/synology_nas/README.md index 25daeb48..24ba4adb 100644 --- a/integrations/synology_nas/README.md +++ b/integrations/synology_nas/README.md @@ -34,7 +34,7 @@ To forward Synology logs to Wazuh, you must configure the NAS to send its syslog The custom decoders instruct Wazuh on how to parse the standard Synology bracketed log format. Copy the decoders file to the Wazuh Manager: ```bash -cp content/ruleset/synology_nas/decoders/nas_synology_decoders.xml /var/ossec/etc/decoders/ +cp integrations/synology_nas/decoders/nas_synology_decoders.xml /var/ossec/etc/decoders/ ``` @@ -43,7 +43,7 @@ cp content/ruleset/synology_nas/decoders/nas_synology_decoders.xml /var/ossec/et The custom rules map the decoded fields to specific alerts, such as alerting on 2FA failures, SSH blocks, or degraded volumes. Copy the rules file to the Wazuh Manager: ```bash -cp content/ruleset/synology_nas/rules/nas_synology_rules.xml /var/ossec/etc/rules/ +cp integrations/synology_nas/rules/nas_synology_rules.xml /var/ossec/etc/rules/ ```