Wazuh and AbuseIPDB - Integrating Wazuh and AbuseIPDB API

Рет қаралды 9,577

2 жыл бұрын

Join me as we integrate Wazuh and AbuseIPDB. Detect when known malicious IPs are attempting to log into your servers via the AbuseIPDB API! Let's deploy a Host Intrusion Detection System and SIEM with free open source tools. Join me as we explore and learn together.
Blog Post: / enriching-login-attemp...
Security Operations Center as a Service: www.socfortress.co/
Buy Me A Coffee: www.buymeacoffee.com/opensecure
Win a $50 Gift Card: www.youtube.com/watch?v=mFzu6...
Your Own Server: bit.ly/3Eug9Wf
Discord Channel: / discord
Check us out: www.opensecure.co/
Interact with our demo: www.socfortress.co/demo_acces...
Hire us: www.opensecure.co/contact-us

Пікірлер: 15

@leek4994 2 жыл бұрын

Excellent video! I enjoy the detail and you walking through examples.

@taylorwalton_socfortress 2 жыл бұрын

Thanks for watching

@oscarmarte4850 2 жыл бұрын

I like everything you do with wazuh integration. Videos very well explained and detailed the steps, it is appreciated. Cheer up!!

@usmanjut4709 Жыл бұрын

Appreciate your efforts regarding WAZUH. I am getting this error in integrations.log file: "Wed Aug 17 11:43:35 UTC 2022 Wrong arguments" Can you let me know about it?

@vqL3nt1n 2 жыл бұрын

Is it possible to scan and analyze for rdp connexion too ? Thanks

@PC_solver Жыл бұрын

congratulations for 5k subscribers. I followed your all steps but there is no logs in integration.log

@eliasantoniadis8556 Жыл бұрын

same for me

@arielitomorales Жыл бұрын

same for me too

@Huelilik Жыл бұрын

does this method still work? i tried on 2 different vm, debian 11 vm and ubuntu 20 vm but the ossec configuration file keeps crashing when restarting wazuh manager. error in the Api configuration line, these few days I haven't found a way out for this. wazuh I'm using version 4.4.3

@Huelilik Жыл бұрын

everything is working fine at the moment, it turns out that some command line got deleted :(

@pierreyoboue5473 Жыл бұрын

hi, what there is in the var/../secure? because i don't have the file, can you help me please

@pierreyoboue5473 Жыл бұрын

And in the documentation it's customerA.py but in your video it is customerA... so what do i will take

@supriyapotdar7253 11 ай бұрын

How to integrate wazuh with haltdose

@tndgray 2 жыл бұрын

Another great video! However, is anyone getting this error? integrations]# ./custom-abuseipdb.py File "/var/ossec/integrations/custom-abuseipdb.py", line 30 debug(apikey) IndentationError: unexpected indent

@taylorwalton_socfortress 2 жыл бұрын

It is probably an issue when you copy and paste from Medium. I put the script on github, try copying it here: raw.githubusercontent.com/OpenSecureCo/Demos/main/custom-abuseipdb.py