Guilgo Blog

# docker-compose.yml
services:
  wazuh-manager-lite:
    image: wazuh/wazuh-manager:4.9.2
    container_name: wazuh-lite
    ports:
      - "1514:1514/tcp"   # Comunicación agentes
      - "1515:1515/tcp"   # Registro agentes
      - "55000:55000/tcp" # API
    volumes:
      - ./etc:/var/ossec/etc
      - ./data:/var/ossec/data
    networks:
      - mi-red
    restart: unless-stopped

networks:
  mi-red:
    external: true

# Iniciar Wazuh Manager
docker-compose up -d

# Verificar estado
docker exec wazuh-lite /var/ossec/bin/wazuh-control status

# docker-compose-adguard.yml
services:
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
      - "443:443/tcp"
    volumes:
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf
    restart: unless-stopped

docker exec wazuh-lite mkdir -p /var/ossec/etc/shared/windows

<!-- /var/ossec/etc/shared/windows/agent.conf -->
<agent_config os="windows">

  <!-- Event Channels a monitorizar -->
  <localfile>
    <location>Security</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <localfile>
    <location>System</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <localfile>
    <location>Application</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <localfile>
    <location>Microsoft-Windows-PowerShell/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <localfile>
    <location>Microsoft-Windows-Windows Defender/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>

  <!-- File Integrity Monitoring -->
  <syscheck>
    <disabled>no</disabled>
    <frequency>43200</frequency>
    <directories realtime="yes">%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup</directories>
    <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry>
  </syscheck>

  <!-- System Inventory -->
  <wodle name="syscollector">
    <disabled>no</disabled>
    <interval>12h</interval>
    <hardware>yes</hardware>
    <os>yes</os>
    <packages>yes</packages>
    <processes>yes</processes>
  </wodle>

</agent_config>

#!/bin/bash
# /home/user/adguard-to-wazuh.sh
# Cron: */5 * * * * /home/user/adguard-to-wazuh.sh

CONTAINER="adguardhome"
QUERYLOG="/opt/adguardhome/work/data/querylog.json"
WAZUH_LOG="/path/to/wazuh/data/logs/adguard-dns.json"

# IPs de los niños
KIDS_IPS="10.5.5.124 10.5.5.112"

# Extraer últimas 100 líneas y filtrar
docker exec $CONTAINER tail -100 $QUERYLOG 2>/dev/null | while read line; do
    for IP in $KIDS_IPS; do
        if echo "$line" | grep -q "\"IP\":\"$IP\""; then
            DOMAIN=$(echo "$line" | sed -n 's/.*"QH":"\([^"]*\)".*/\1/p')
            TIME=$(echo "$line" | sed -n 's/.*"T":"\([^"]*\)".*/\1/p')
            BLOCKED=$(echo "$line" | grep -c "IsFiltered\":true")
            
            # Determinar nombre del niño
            case "$IP" in
                "10.5.5.124") NAME="Hijo1" ;;
                "10.5.5.112") NAME="Hijo2" ;;
                *) NAME="Unknown" ;;
            esac
            
            if [ -n "$DOMAIN" ]; then
                IS_BLOCKED="false"
                [ $BLOCKED -gt 0 ] && IS_BLOCKED="true"
                echo "{\"timestamp\":\"$TIME\",\"source\":\"adguard\",\"client_ip\":\"$IP\",\"client_name\":\"$NAME\",\"is_kid\":true,\"domain\":\"$DOMAIN\",\"is_blocked\":$IS_BLOCKED}" >> $WAZUH_LOG
            fi
        fi
    done
done

# Mantener log pequeño
tail -2000 $WAZUH_LOG > ${WAZUH_LOG}.tmp 2>/dev/null && mv ${WAZUH_LOG}.tmp $WAZUH_LOG

<localfile>
  <log_format>json</log_format>
  <location>/var/ossec/logs/adguard-dns.json</location>
</localfile>

<!-- /var/ossec/etc/rules/control-parental.xml -->
<!-- IDs: 110001 - 110099 -->

<group name="control_parental,">

  <!-- Regla base - Reporte recibido -->
  <rule id="110001" level="3">
    <decoded_as>json</decoded_as>
    <field name="ReportType">ControlParental</field>
    <description>Control Parental: Reporte de $(Host)</description>
    <group>control_parental,</group>
  </rule>

  <!-- Uso excesivo > 4 horas -->
  <rule id="110010" level="7">
    <if_sid>110001</if_sid>
    <field name="ScreenTime.UptimeHours" type="pcre2">^[4-7]\.</field>
    <description>Uso excesivo $(Host) $(ScreenTime.UptimeHours)h</description>
    <group>control_parental,screen_time,</group>
  </rule>

  <!-- Uso muy excesivo > 8 horas -->
  <rule id="110011" level="10">
    <if_sid>110001</if_sid>
    <field name="ScreenTime.UptimeHours" type="pcre2">^[8-9]\.|^[1-9][0-9]</field>
    <description>ALERTA: Uso muy excesivo $(Host)</description>
    <group>control_parental,high,</group>
  </rule>

  <!-- Juegos detectados -->
  <rule id="110020" level="5">
    <if_sid>110001</if_sid>
    <field name="ActiveProcesses" type="pcre2">(?i)fortnite|minecraft|roblox|steam</field>
    <description>Juego detectado $(Host)</description>
    <group>control_parental,gaming,</group>
  </rule>

  <!-- Redes sociales -->
  <rule id="110030" level="6">
    <if_sid>110001</if_sid>
    <field name="ActiveProcesses" type="pcre2">(?i)discord|tiktok|snapchat</field>
    <description>Red social $(Host)</description>
    <group>control_parental,social,</group>
  </rule>

  <!-- VPN/Proxy/TOR detectado -->
  <rule id="110040" level="10">
    <if_sid>110001</if_sid>
    <field name="ActiveProcesses" type="pcre2">(?i)vpn|tor|proxy</field>
    <description>ALERTA: VPN/Proxy $(Host)</description>
    <group>control_parental,evasion,high,</group>
  </rule>

  <!-- Windows Defender deshabilitado -->
  <rule id="110050" level="12">
    <if_sid>110001</if_sid>
    <field name="DefenderStatus.RealTimeProtectionEnabled">False</field>
    <description>CRITICO: Defender OFF $(Host)</description>
    <group>control_parental,security,critical,</group>
  </rule>

  <!-- Hayabusa alertas críticas -->
  <rule id="110060" level="12">
    <if_sid>110001</if_sid>
    <field name="Hayabusa.CriticalAlerts" type="pcre2">^[1-9]</field>
    <description>CRITICO: Hayabusa alertas $(Host)</description>
    <group>control_parental,hayabusa,critical,</group>
  </rule>

  <!-- Uso nocturno -->
  <rule id="110080" level="8">
    <if_sid>110001</if_sid>
    <time>11:00 pm - 6:00 am</time>
    <description>ALERTA: $(Host) activo noche</description>
    <group>control_parental,night,</group>
  </rule>

</group>

<!-- /var/ossec/etc/rules/adguard-rules.xml -->
<!-- IDs: 111001 - 111099 -->

<group name="adguard,dns,">

  <!-- Query DNS base -->
  <rule id="111001" level="0">
    <decoded_as>json</decoded_as>
    <field name="source">adguard</field>
    <description>AdGuard DNS: Query de $(client_ip)</description>
    <group>adguard,dns,</group>
  </rule>

  <!-- Query de los niños -->
  <rule id="111010" level="3">
    <if_sid>111001</if_sid>
    <field name="is_kid">true</field>
    <description>DNS: $(client_name) consulto $(domain)</description>
    <group>adguard,kids,</group>
  </rule>

  <!-- BLOQUEADO - Contenido adulto -->
  <rule id="111020" level="10">
    <if_sid>111001</if_sid>
    <field name="category">adult</field>
    <field name="is_blocked">true</field>
    <description>BLOQUEADO ADULTO: $(client_name) - $(domain)</description>
    <group>adguard,blocked,adult,high,</group>
  </rule>

  <!-- BLOQUEADO - VPN/Proxy -->
  <rule id="111021" level="10">
    <if_sid>111001</if_sid>
    <field name="category">vpn_proxy</field>
    <field name="is_blocked">true</field>
    <description>BLOQUEADO VPN: $(client_name) - $(domain)</description>
    <group>adguard,blocked,vpn,evasion,high,</group>
  </rule>

  <!-- BLOQUEADO - Piratería -->
  <rule id="111022" level="8">
    <if_sid>111001</if_sid>
    <field name="category">piracy</field>
    <field name="is_blocked">true</field>
    <description>BLOQUEADO PIRATERIA: $(client_name) - $(domain)</description>
    <group>adguard,blocked,piracy,</group>
  </rule>

  <!-- Cualquier bloqueo de niños -->
  <rule id="111040" level="6">
    <if_sid>111010</if_sid>
    <field name="is_blocked">true</field>
    <description>DNS BLOQUEADO: $(client_name) - $(domain)</description>
    <group>adguard,kids,blocked,</group>
  </rule>

  <!-- Muchos bloqueos (intento persistente) -->
  <rule id="111050" level="10" frequency="10" timeframe="300">
    <if_matched_sid>111040</if_matched_sid>
    <same_field>client_ip</same_field>
    <description>ALERTA: $(client_name) muchos bloqueos DNS</description>
    <group>adguard,kids,persistent,high,</group>
  </rule>

</group>

#!/usr/bin/env python3
# /var/ossec/integrations/custom-telegram.py

import sys
import json
import requests

BOT_TOKEN = "TU_BOT_TOKEN"
CHAT_ID = "TU_CHAT_ID"

EMOJIS = {
    "adult": "🔞", "vpn_proxy": "🔒", "evasion": "🔒", "piracy": "🏴‍☠️",
    "gaming": "🎮", "social": "💬", "security": "🛡️", "night": "🌙",
    "screen_time": "⏰", "hayabusa": "🔍", "critical": "🚨", "high": "⚠️"
}

def main():
    if len(sys.argv) < 2:
        sys.exit(1)
    
    try:
        with open(sys.argv[1]) as f:
            alert = json.load(f)
    except:
        sys.exit(1)
    
    rule = alert.get("rule", {})
    data = alert.get("data", {})
    agent = alert.get("agent", {})
    
    level = rule.get("level", 0)
    if level < 7:
        sys.exit(0)
    
    rule_id = rule.get("id", "N/A")
    rule_desc = rule.get("description", "")
    groups = rule.get("groups", [])
    timestamp = alert.get("timestamp", "")[:19].replace("T", " ")
    
    subject = data.get("client_name") or data.get("Host") or agent.get("name", "Sistema")
    domain = data.get("domain", "")
    is_blocked = data.get("is_blocked")
    
    emoji = "📢"
    for g in groups:
        if g in EMOJIS:
            emoji = EMOJIS[g]
            break
    
    lines = [f"{emoji} *CONTROL PARENTAL*", "", f"👤 *Quién:* {subject}", f"📋 *Alerta:* {rule_desc}"]
    
    if domain:
        lines.append(f"🌐 *Dominio:* `{domain}`")
    if is_blocked is True:
        lines.append("📊 *Estado:* ✅ BLOQUEADO")
    elif is_blocked is False:
        lines.append("📊 *Estado:* ⚡ Permitido")
    
    lines.extend([f"⏰ *Hora:* {timestamp}", f"🔢 *Rule:* {rule_id} (Level {level})"])
    
    msg = "\n".join(lines)
    
    try:
        requests.post(f"https://api.telegram.org/bot{BOT_TOKEN}/sendMessage",
            json={"chat_id": CHAT_ID, "text": msg, "parse_mode": "Markdown"},
            timeout=10)
    except:
        pass

if __name__ == "__main__":
    main()

<integration>
  <name>custom-telegram.py</name>
  <level>7</level>
  <group>control_parental|adguard|hayabusa</group>
  <alert_format>json</alert_format>
</integration>

docker exec wazuh-lite pip3 install requests
docker exec wazuh-lite chmod 750 /var/ossec/integrations/custom-telegram.py
docker exec wazuh-lite chown root:wazuh /var/ossec/integrations/custom-telegram.py

@echo off
:: Instalador Wazuh Agent para Control Parental
:: Ejecutar como Administrador

echo.
echo ========================================
echo   WAZUH AGENT - CONTROL PARENTAL
echo   Manager: 10.5.5.3
echo ========================================
echo.

net session >nul 2>&1
if %errorLevel% neq 0 (
    echo [ERROR] Ejecutar como Administrador!
    pause
    exit /b 1
)

echo [*] Descargando Wazuh Agent 4.9.2...
powershell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.2-1.msi' -OutFile '%TEMP%\wazuh-agent.msi'"

echo [*] Instalando...
msiexec.exe /i "%TEMP%\wazuh-agent.msi" /q WAZUH_MANAGER="10.5.5.3" WAZUH_REGISTRATION_SERVER="10.5.5.3" WAZUH_AGENT_NAME="%COMPUTERNAME%" WAZUH_AGENT_GROUP="windows"

echo [*] Esperando instalacion...
timeout /t 10 /nobreak >nul

echo [*] Iniciando servicio...
NET START WazuhSvc

echo.
echo ========================================
echo   INSTALACION COMPLETADA
echo ========================================
pause

# Control Parental - Script de monitoreo
# Ejecutar cada 30 minutos via Task Scheduler

$fecha = Get-Date -Format "yyyyMMdd_HHmm"
$hostname = $env:COMPUTERNAME
$usuario = $env:USERNAME
$baseRemoto = "\\SERVIDOR\logs\$hostname"
$baseLocal = "C:\ProgramData\ControlParental"

New-Item -ItemType Directory -Force -Path $baseLocal -ErrorAction SilentlyContinue | Out-Null
New-Item -ItemType Directory -Force -Path $baseRemoto -ErrorAction SilentlyContinue | Out-Null

Write-Host "=== CONTROL PARENTAL ===" -ForegroundColor Yellow

# Software instalado
$apps = @()
$regPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
foreach ($p in $regPaths) {
    $items = Get-ItemProperty $p -ErrorAction SilentlyContinue
    foreach ($item in $items) {
        if ($item.DisplayName) {
            $apps += [PSCustomObject]@{
                Name = $item.DisplayName
                Version = $item.DisplayVersion
            }
        }
    }
}
$apps = $apps | Sort-Object Name -Unique | Select-Object -First 100

# Procesos activos
$procesos = Get-Process -ErrorAction SilentlyContinue | 
    Where-Object { $_.ProcessName -notmatch "^(svchost|csrss|dwm|System)" } | 
    Select-Object ProcessName, Id, @{N='Memory_MB';E={[math]::Round($_.WorkingSet64/1MB,2)}} | 
    Sort-Object Memory_MB -Descending | Select-Object -First 30

# Conexiones de red
$conexiones = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
    Where-Object { $_.RemoteAddress -notmatch "^(127\.|::1)" } | 
    Select-Object RemoteAddress, RemotePort, @{N='Process';E={(Get-Process -Id $_.OwningProcess -EA SilentlyContinue).ProcessName}}

# Tiempo de uso
$bootTime = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
$uptime = (Get-Date) - $bootTime
$screenTime = [PSCustomObject]@{
    BootTime = $bootTime.ToString("yyyy-MM-dd HH:mm:ss")
    UptimeHours = [math]::Round($uptime.TotalHours, 2)
}

# USB
$usb = Get-PnpDevice -Class USB -Status OK -EA SilentlyContinue | 
    Where-Object { $_.FriendlyName } | Select-Object FriendlyName

# Defender
$defender = Get-MpComputerStatus -EA SilentlyContinue | 
    Select-Object AntivirusEnabled, RealTimeProtectionEnabled

# Crear payload
$payload = [PSCustomObject]@{
    Host = $hostname
    User = $usuario
    Timestamp = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ss")
    ReportType = "ControlParental"
    ScreenTime = $screenTime
    ActiveProcesses = @($procesos)
    NetworkConnections = @($conexiones)
    InstalledApps = @($apps)
    USBDevices = @($usb)
    DefenderStatus = $defender
}

# Guardar y enviar
$jsonFile = "$baseLocal\control_$fecha.json"
$payload | ConvertTo-Json -Depth 10 | Out-File -Encoding UTF8 $jsonFile
Copy-Item $jsonFile "$baseRemoto\" -Force -ErrorAction SilentlyContinue

# Copiar a Wazuh
$wazuhPath = "C:\Program Files (x86)\ossec-agent\active-response\control-parental.json"
if (Test-Path "C:\Program Files (x86)\ossec-agent") {
    $payload | ConvertTo-Json -Depth 10 -Compress | Out-File -Encoding UTF8 $wazuhPath -Force
}

Write-Host "Completado - Tiempo uso: $($screenTime.UptimeHours)h"

Register-ScheduledTask -TaskName "ControlParental" `
  -Action (New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -WindowStyle Hidden -File C:\script\Control-Parental-Simple.ps1") `
  -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 30) -RepetitionDuration (New-TimeSpan -Days 9999)) `
  -Principal (New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest) `
  -Force

# Crear directorio
New-Item -ItemType Directory -Force -Path "C:\Tools\Hayabusa"

# Descargar
$url = "https://github.com/Yamato-Security/hayabusa/releases/download/v3.0.0/hayabusa-3.0.0-win-x64.zip"
Invoke-WebRequest -Uri $url -OutFile "$env:TEMP\hayabusa.zip"

# Extraer
Expand-Archive -Path "$env:TEMP\hayabusa.zip" -DestinationPath "C:\Tools\Hayabusa" -Force

# Actualizar reglas Sigma
cd C:\Tools\Hayabusa
.\hayabusa.exe update-rules

# Scan completo
.\hayabusa.exe csv-timeline -d C:\Windows\System32\winevt\Logs -o timeline.csv

# Solo alertas críticas
.\hayabusa.exe csv-timeline -d . -m critical -o critical-alerts.csv

# Alertas high y critical
.\hayabusa.exe csv-timeline -d . -m high -o high-alerts.csv

# Ver agentes conectados
docker exec wazuh-lite /var/ossec/bin/agent_control -l

# Estado del manager
docker exec wazuh-lite /var/ossec/bin/wazuh-control status

# Reiniciar manager
docker exec wazuh-lite /var/ossec/bin/wazuh-control restart

# Ver alertas recientes
docker exec wazuh-lite tail -50 /var/ossec/logs/alerts/alerts.log

# Ver logs del manager
docker exec wazuh-lite tail -100 /var/ossec/logs/ossec.log

curl -s -X POST "https://api.telegram.org/botTU_TOKEN/sendMessage" \
  -d "chat_id=TU_CHAT_ID" \
  -d "text=Test de Control Parental"

# Estado del agente
Get-Service WazuhSvc

# Logs del agente
Get-Content "C:\Program Files (x86)\ossec-agent\ossec.log" -Tail 50

# Reiniciar agente
Restart-Service WazuhSvc