Ruleset Synology NAS

integrations/synology_nas/README.md

@@ -0,0 +1,83 @@
+### Synology NAS - Wazuh Integration
+
+#### **Table of Contents**
+
+  * [Introduction](#introduction)
+  * [Prerequisites](#prerequisites)
+  * [Initial Synology Configuration](#initial-synology-configuration)
+  * [Installing and Configuring the Integration](#installing-and-configuring-the-integration)
+  * [Integration Testing](#integration-testing)
+
+### Introduction
+
+This guide outlines the steps to integrate Synology NAS logs with Wazuh. This integration relies on parsing the `Connection`, `System`, and `Security` logs generated by Synology's DiskStation Manager (DSM) to track user authentication (SMB/CIFS, SSH, DSM UI), hardware health events, and automated security blocks.
+
+### Prerequisites
+
+Before starting, ensure the following:
+
+  * A functioning Synology NAS device.
+  * A Wazuh Manager (or a designated Wazuh Agent) configured to receive Syslog traffic.
+
+### Initial Synology Configuration
+
+To forward Synology logs to Wazuh, you must configure the NAS to send its syslog entries.
+1. Open DSM and launch the **Log Center** package.
+2. Navigate to **Log Sending**.
+3. Check the box to send logs to a syslog server, enter your Wazuh Manager/Agent IP address, select the protocol (UDP/TCP), and set the port (default 514).
+4. Apply the settings. Ensure your Wazuh instance has a `<remote>` block active in `ossec.conf` to receive them.
+
+### Installing and Configuring the Integration
+
+#### Copy the Custom Decoders
+
+The custom decoders instruct Wazuh on how to parse the standard Synology bracketed log format. Copy the decoders file to the Wazuh Manager:
+
+```bash
+cp integrations/synology_nas/decoders/nas_synology_decoders.xml /var/ossec/etc/decoders/
+
+```
+
+#### Copy the Custom Rules
+
+The custom rules map the decoded fields to specific alerts, such as alerting on 2FA failures, SSH blocks, or degraded volumes. Copy the rules file to the Wazuh Manager:
+
+```bash
+cp integrations/synology_nas/rules/nas_synology_rules.xml /var/ossec/etc/rules/
+
+```
+
+#### Set File Permissions
+
+Ensure that the Wazuh user has the appropriate permissions:
+
+```bash
+chown wazuh:wazuh /var/ossec/etc/decoders/nas_synology_decoders.xml
+chown wazuh:wazuh /var/ossec/etc/rules/nas_synology_rules.xml
+chmod 660 /var/ossec/etc/decoders/nas_synology_decoders.xml
+chmod 660 /var/ossec/etc/rules/nas_synology_rules.xml
+
+```
+
+#### Restart the Wazuh Manager (If using CLI)
+
+```bash
+systemctl restart wazuh-manager
+
+```
+
+### Integration Testing
+
+#### Test Using Wazuh-Logtest
+
+Verify the integration using the `wazuh-logtest` tool with the provided `sample_logs.txt`:
+
+1. Navigate to **Server Management** --> **Ruleset Test**.
+2. Paste a raw log from `sample_logs.txt` (e.g., `Connection: User [admin] from [192.168.1.10] failed to log in via [DSM]`).
+3. Verify Phase 2 identifies the `synology-nas` decoder and Phase 3 triggers the expected alert.
+
+#### Verify in Wazuh Dashboard
+
+1. Navigate to the **Discover** tab in the Wazuh Dashboard.
+2. Filter by `Field` `decoder.name`, `Operator` `is`, `Value` `synology-nas`.
+3. Monitor the ingested Synology events in real-time.

integrations/synology_nas/decoders/nas_synology_decoders.xml

@@ -0,0 +1,74 @@
+<!--
+Jun  9 10:30:15 SERVER-01 Connection: User [admin_user] from [111.111.111.111] failed to log in via [DSM] due to authorization failure.
+Jun  9 10:31:02 SERVER-01 Connection: User [root] from [123.123.123.123] failed to log in via [SSH] due to authorization failure.
+Jun  9 11:15:30 SERVER-01 Connection: User [anonymous] from [123.123.123.123] failed to log in via [FTP] due to authorization failure.
+Jun  9 10:32:01 SERVER-01 Connection: User [admin_user] from [111.111.111.111] has successfully passed the first authentication of 2FA via [password].
+Jun  9 10:32:08 SERVER-01 Connection: User [admin_user] from [111.111.111.111] signed in to [DSM] successfully via [password].
+Jun  9 11:05:12 SERVER-01 Connection: User [standard_user] from [222.222.222.222] signed in to [CIFS] successfully via [password].
+Jun  9 10:45:00 SERVER-01 Connection: User [admin_user] from [111.111.111.111] logged out from [DSM].
+Jun  9 11:20:05 SERVER-01 Security: Host [123.123.123.123] was blocked via [SSH].
+Jun  9 10:35:22 SERVER-01 System: Test message from Synology Syslog Client from (123.123.123.124).
+Jun  9 12:00:01 SERVER-01 System: System successfully installed DSM 7.2-64570 Update 1.
+Jun  9 12:05:15 SERVER-01 System: Server started counting down to shutdown.
+Jun  9 14:10:20 SERVER-01 System: Drive [3] was removed.
+Jun  9 14:10:22 SERVER-01 System: Volume [1] was degraded [3/4], please repair it.
+Jun  9 14:15:00 SERVER-01 System: Local UPS was disconnected.
+-->
+
+<decoder name="synology_nas">
+  <program_name>^Connection$|^Security$|^System$</program_name>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^User [(\S+)] from [(\d+.\d+.\d+.\d+)] failed to log in via [(\S+)]</regex>
+  <order>user, srcip, synology_app</order>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^User [(\S+)] from [(\d+.\d+.\d+.\d+)] signed in to [(\w+)] successfully via [(\w+)]</regex>
+  <order>user, srcip, synology_app, synology_auth</order>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^User [(\S+)] from [(\d+.\d+.\d+.\d+)] has successfully passed the first authentication of 2FA via [(\w+)]</regex>
+  <order>user, srcip, synology_auth</order>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^User [(\S+)] from [(\d+.\d+.\d+.\d+)] logged out from [(\w+)]</regex>
+  <order>user, srcip, synology_app</order>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^Host [(\d+.\d+.\d+.\d+)] was blocked via [(\w+)]</regex>
+  <order>srcip, synology_app</order>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^Test message from Synology Syslog Client from \((\d+.\d+.\d+.\d+)\)</regex>
+  <order>srcip</order>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^Drive [(\d+)] was (\w+)</regex>
+  <order>synology_drive, synology_action</order>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^Volume [(\d+)] was (\w+) [(\d+/\d+)]</regex>
+  <order>synology_volume, synology_action, synology_status</order>
+</decoder>
+
+<decoder name="synology_nas">
+  <parent>synology_nas</parent>
+  <regex>^(\.+)</regex>
+  <order>synology_message</order>
+</decoder>

integrations/synology_nas/rules/nas_synology_rules.xml

@@ -0,0 +1,71 @@
+<group name="synology_nas,">
+
+  <rule id="100400" level="3">
+    <decoded_as>synology_nas</decoded_as>
+    <description>Synology NAS: General system event.</description>
+  </rule>
+
+  <rule id="100401" level="5">
+    <if_sid>100400</if_sid>
+    <match>failed to log in</match>
+    <description>Synology NAS: Login FAILURE for user '$(synology_user)' from $(srcip) via $(synology_app).</description>
+    <group>authentication_failed,</group>
+  </rule>
+
+  <rule id="100402" level="3">
+    <if_sid>100400</if_sid>
+    <match>successfully passed the first authentication of 2FA</match>
+    <description>Synology NAS: User '$(synology_user)' passed first 2FA step from $(srcip).</description>
+    <group>authentication_success,</group>
+  </rule>
+
+  <rule id="100403" level="3">
+    <if_sid>100400</if_sid>
+    <match>signed in to</match>
+    <description>Synology NAS: User '$(synology_user)' successfully logged into $(synology_app) from $(srcip).</description>
+    <group>authentication_success,</group>
+  </rule>
+
+  <rule id="100404" level="2">
+    <if_sid>100400</if_sid>
+    <match>logged out</match>
+    <description>Synology NAS: User '$(synology_user)' logged out from $(synology_app).</description>
+  </rule>
+
+  <rule id="100405" level="7">
+    <if_sid>100400</if_sid>
+    <match>was blocked via</match>
+    <description>Synology NAS: SECURITY BLOCK - Host $(srcip) was automatically blocked via $(synology_app).</description>
+    <group>access_denied,attack,</group>
+  </rule>
+
+
+  <rule id="100406" level="3">
+    <if_sid>100400</if_sid>
+    <match>successfully installed DSM</match>
+    <description>Synology NAS: DSM firmware update was successfully installed.</description>
+    <group>system_update,</group>
+  </rule>
+
+  <rule id="100407" level="10">
+    <if_sid>100400</if_sid>
+    <match>started counting down to shutdown</match>
+    <description>Synology NAS: CRITICAL - System shutdown initiated!</description>
+    <group>system_shutdown,</group>
+  </rule>
+
+  <rule id="100408" level="8">
+    <if_sid>100400</if_sid>
+    <match>UPS was disconnected</match>
+    <description>Synology NAS: WARNING - Local UPS battery backup was disconnected.</description>
+    <group>hardware_fault,</group>
+  </rule>
+
+  <rule id="100409" level="10">
+    <if_sid>100400</if_sid>
+    <match>was removed|was degraded</match>
+    <description>Synology NAS: CRITICAL STORAGE FAULT - Drive $(synology_drive) removed or Volume $(synology_volume) degraded.</description>
+    <group>hardware_fault,data_loss_risk,</group>
+  </rule>
+
+</group>

integrations/synology_nas/sample_logs.txt

@@ -0,0 +1,25 @@
+Jun  9 10:30:15 SERVER-01 Connection: User [admin_user] from [111.111.111.111] failed to log in via [DSM] due to authorization failure.
+Jun  9 10:31:02 SERVER-01 Connection: User [root] from [123.123.123.123] failed to log in via [SSH] due to authorization failure.
+Jun  9 11:15:30 SERVER-01 Connection: User [anonymous] from [123.123.123.123] failed to log in via [FTP] due to authorization failure.
+
+# -- Successful Authentications & 2FA --
+Jun  9 10:32:01 SERVER-01 Connection: User [admin_user] from [111.111.111.111] has successfully passed the first authentication of 2FA via [password].
+Jun  9 10:32:08 SERVER-01 Connection: User [admin_user] from [111.111.111.111] signed in to [DSM] successfully via [password].
+Jun  9 11:05:12 SERVER-01 Connection: User [standard_user] from [222.222.222.222] signed in to [CIFS] successfully via [password].
+
+# -- Session Terminations --
+Jun  9 10:45:00 SERVER-01 Connection: User [admin_user] from [111.111.111.111] logged out from [DSM].
+
+# -- Automated Security Responses --
+# Synology's "Auto Block" feature kicking in after too many failed SSH/DSM attempts
+Jun  9 11:20:05 SERVER-01 Security: Host [123.123.123.123] was blocked via [SSH].
+
+# -- System & Update Events --
+Jun  9 10:35:22 SERVER-01 System: Test message from Synology Syslog Client from (123.123.123.124).
+Jun  9 12:00:01 SERVER-01 System: System successfully installed DSM 7.2-64570 Update 1.
+Jun  9 12:05:15 SERVER-01 System: Server started counting down to shutdown.
+
+# -- Hardware & Storage Events (High Priority Alerts) --
+Jun  9 14:10:20 SERVER-01 System: Drive [3] was removed.
+Jun  9 14:10:22 SERVER-01 System: Volume [1] was degraded [3/4], please repair it.
+Jun  9 14:15:00 SERVER-01 System: Local UPS was disconnected.