branchnetconsulting / wazuh-tools Goto Github PK

If I run the script as posted, this is the output:

Processing /var/ossec/ruleset/rules/0020-syslog_rules.xml

I'm not seeing the actual rule displayed. I found if I changed the grep line from this:
grep -Pzo "^.<rule id="$ID" .(.|\n)*?" $F -h

to this:
grep -Pzo "<rule id="$ID" .(.|\n)?" $F -h

I get the following output:
Processing /var/ossec/ruleset/rules/0020-syslog_rules.xml

<program_name>^kernel</program_name>
Pre-match rule for kernel messages.

I'm running on Ubuntu 20.04 - I also was able to run the modified line on EC2 Linux and it worked there as well. I'm by no means a Linux or regex expert but for some reason, the ^.* at the start of the grep line caused the output to be suppressed.

Do you have any thoughts?

Hi Kevin,

Thanks for sharing these scripts as they are very useful.
I am working on integrating the Sigma rules into the wazuh rule set. I am using the import sigwah script to do this.

But after I ran the script and restarted the cluster, the manager could not restart and gave me a configuration error:

2020/07/21 17:47:39 ossec-analysisd: ERROR: Invalid configuration. 'group' is no                                                                                 t a valid element.
2020/07/21 17:47:39 ossec-analysisd: CRITICAL: (1220): Error loading the rules:                                                                                  'etc/rules/sigwah.xml'.
ossec-analysisd: Configuration error. Exiting

I checked the sigwah.xml file and the syntax and formatting seems to be good.

Could you please tell me how to resolve this issue or do something differently.

Thanks
Aakash