{"id":5734,"date":"2022-01-09T01:38:36","date_gmt":"2022-01-09T09:38:36","guid":{"rendered":"https:\/\/www.xh86.me\/?p=5734"},"modified":"2022-01-09T02:11:20","modified_gmt":"2022-01-09T10:11:20","slug":"%e3%80%90%e5%b9%b2%e8%b4%a7%e3%80%91%e5%bc%80%e6%ba%90%e5%ae%89%e5%85%a8%e5%b9%b3%e5%8f%b0wazuh%e7%9a%84%e9%83%a8%e7%bd%b2%e4%b8%8e%e4%bd%93%e9%aa%8c","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=5734","title":{"rendered":"\u5f00\u6e90\u5b89\u5168\u5e73\u53f0Wazuh\u7684\u90e8\u7f72\u4e0e\u4f53\u9a8c"},"content":{"rendered":"
\n

<\/div><\/p>\n

\n

\n

1. Wazuh\u7b80\u4ecb<\/span><\/h2>\n

Wazuh \u662f\u4e00\u4e2a\u514d\u8d39\u3001\u5f00\u6e90\u548c\u4f01\u4e1a\u7ea7\u7684\u5b89\u5168\u76d1\u63a7\u89e3\u51b3\u65b9\u6848\uff0c\u7528\u4e8e\u5a01\u80c1\u68c0\u6d4b\u3001\u5b8c\u6574\u6027\u76d1\u63a7\u3001\u4e8b\u4ef6\u54cd\u5e94\u548c\u5408\u89c4\u6027\u3002<\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

github\u5730\u5740\uff1a<\/p>\n

https:\/\/github.com\/wazuh\r\n<\/code><\/pre>\n
Wazuh\u7531\u90e8\u7f72\u5230\u53d7\u76d1\u89c6\u7cfb\u7edf\u7684\u7aef\u70b9\u5b89\u5168\u4ee3\u7406\u548c\u7ba1\u7406\u670d\u52a1\u5668\u7ec4\u6210\uff0c\u7ba1\u7406\u670d\u52a1\u5668\u6536\u96c6\u548c\u5206\u6790\u4ee3\u7406\u6536\u96c6\u7684\u6570\u636e\u3002\u6b64\u5916\uff0cWazuh\u5df2\u4e0eElastic Stack\u5b8c\u5168\u96c6\u6210\uff0c\u63d0\u4f9b\u4e86\u641c\u7d22\u5f15\u64ce\u548c\u6570\u636e\u53ef\u89c6\u5316\u5de5\u5177\uff0c\u4f7f\u7528\u6237\u53ef\u4ee5\u6d4f\u89c8\u5176\u5b89\u5168\u8b66\u62a5\u3002<\/p>\n
Wazuh\u63d0\u4f9b\u7684\u529f\u80fd\u5305\u62ec\u65e5\u5fd7\u6570\u636e\u5206\u6790\uff0c\u5165\u4fb5\u548c\u6076\u610f\u8f6f\u4ef6\u68c0\u6d4b\uff0c\u6587\u4ef6\u5b8c\u6574\u6027\u76d1\u89c6\uff0c\u914d\u7f6e\u8bc4\u4f30\uff0c\u6f0f\u6d1e\u68c0\u6d4b\u4ee5\u53ca\u5bf9\u6cd5\u89c4\u9075\u4ece\u6027\u7684\u652f\u6301\u3002<\/p>\n
2. Wazuh\u5e73\u53f0\u7684\u7ec4\u4ef6\u548c\u4f53\u7cfb\u7ed3\u6784<\/span><\/h2>\n
Wazuh\u5e73\u53f0\u4e3b\u8981\u5305\u62ec\u4e09\u4e2a\u4e3b\u8981\u7ec4\u4ef6\uff0c\u5206\u522b\u662fWazuh\u4ee3\u7406\uff0cWazuh\u670d\u52a1\u5668\u548cElastic Stack\u3002<\/p>\n
    \n
  • \n
    Wazuh\u4ee3\u7406\uff1a\u5b83\u5b89\u88c5\u5728\u7aef\u70b9\u4e0a\uff0c\u4f8b\u5982\u7b14\u8bb0\u672c\u7535\u8111\uff0c\u53f0\u5f0f\u673a\uff0c\u670d\u52a1\u5668\uff0c\u4e91\u5b9e\u4f8b\u6216\u865a\u62df\u673a\u3002\u5b83\u63d0\u4f9b\u4e86\u9884\u9632\uff0c\u68c0\u6d4b\u548c\u54cd\u5e94\u529f\u80fd\u3002\u5b83\u786e\u5b9e\u652f\u6301Windows\uff0cLinux\uff0cmacOS\uff0cHP-UX\uff0cSolaris\u548cAIX\u5e73\u53f0\u3002<\/section>\n<\/li>\n
  • \n
    Wazuh\u670d\u52a1\u5668\uff1a\u5b83\u5206\u6790\u4ece\u4ee3\u7406\u6536\u5230\u7684\u6570\u636e\uff0c\u901a\u8fc7\u89e3\u7801\u5668\u548c\u89c4\u5219\u5bf9\u5176\u8fdb\u884c\u5904\u7406\uff0c\u5e76\u4f7f\u7528\u5a01\u80c1\u60c5\u62a5\u6765\u67e5\u627e\u4f17\u6240\u5468\u77e5\u7684\u5371\u5bb3\u6307\u6807\uff08IOC\uff09\u3002\u4e00\u53f0\u670d\u52a1\u5668\u53ef\u4ee5\u5206\u6790\u6765\u81ea\u6210\u767e\u4e0a\u5343\u4e2a\u4ee3\u7406\u7684\u6570\u636e\uff0c\u5e76\u5728\u8bbe\u7f6e\u4e3a\u96c6\u7fa4\u65f6\u6c34\u5e73\u6269\u5c55\u3002\u8be5\u670d\u52a1\u5668\u8fd8\u7528\u4e8e\u7ba1\u7406\u4ee3\u7406\uff0c\u5728\u5fc5\u8981\u65f6\u8fdb\u884c\u8fdc\u7a0b\u914d\u7f6e\u548c\u5347\u7ea7\u3002<\/section>\n<\/li>\n
  • \n
    Elastic Stack\uff1a\u5b83\u7d22\u5f15\u548c\u5b58\u50a8Wazuh\u670d\u52a1\u5668\u751f\u6210\u7684\u8b66\u62a5\u3002\u6b64\u5916\uff0cWazuh\u548cKibana\u4e4b\u95f4\u7684\u96c6\u6210\u4e3a\u6570\u636e\u7684\u53ef\u89c6\u5316\u548c\u5206\u6790\u63d0\u4f9b\u4e86\u5f3a\u5927\u7684\u7528\u6237\u754c\u9762\u3002\u8be5\u754c\u9762\u8fd8\u53ef\u7528\u4e8e\u7ba1\u7406Wazuh\u914d\u7f6e\u5e76\u76d1\u89c6\u5176\u72b6\u6001\u3002<\/section>\n
    <\/div><\/section>\n
    (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/section>\n<\/li>\n<\/ul>\n
    Wazuh\u67b6\u6784\u56fe\u5982\u4e0b<\/span><\/h2>\n
    1\u3001\u6574\u4f53\u7684\u67b6\u6784\u56fe<\/h3>\n
    <\/div><\/p>\n
    (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
    2\u3001Agent\u7aef\u7684\u7ec4\u4ef6\u67b6\u6784<\/h3>\n
    <\/div><\/p>\n
    (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
    3\u3001Server\u7aef\u7684\u67b6\u6784<\/h3>\n
    <\/div><\/p>\n
    (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
    \u5173\u4e8e\u5b89\u88c5<\/span><\/h2>\n
    \u53ef\u4ee5\u53c2\u7167\u5b98\u65b9\u624b\u518c\u4e00\u6b65\u4e00\u6b65\u7684\u8fdb\u884c\u5b89\u88c5<\/p>\n
    https:\/\/documentation.wazuh.com\/current\/installation-guide\/open-distro\/all-in-one-deployment\/all_in_one.html\r\n<\/code><\/pre>\n
    \u9700\u8981\u5355\u72ec\u4e00\u4e2a\u4e2a\u7684\u5b89\u88c5\u5982\u4e0b\u7ec4\u4ef6<\/p>\n
      \n
    • \n
      Wazuh manager<\/p>\n<\/li>\n
    • \n
      Elasticsearch<\/p>\n<\/li>\n
    • \n
      Filebeat<\/p>\n<\/li>\n
    • \n
      Kibana<\/p>\n<\/li>\n<\/ul>\n
      \u8fd9\u91cc\u4e3a\u4e86\u65b9\u4fbf\u6211\u76f4\u63a5\u4e0b\u8f7d wazuh4.1.5\u7248\u672c\u7684ova\u865a\u62df\u673a\u6a21\u677f\u955c\u50cf<\/p>\n
      \u5177\u4f53\u5730\u5740<\/p>\n
      https:\/\/packages.wazuh.com\/4.x\/vm\/wazuh-4.1.5_1.13.2.ova\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u4e0b\u9762\u4ecb\u7ecdWazuh\u5f00\u6e90\u5b89\u5168\u5e73\u53f0\u90e8\u7f72\u4e0e\u4f53\u9a8c<\/h1>\n
      1\u3001\u5bfc\u5165ova\u865a\u62df\u673a<\/span><\/h2>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      2\u3001root\u7528\u6237\u767b\u5f55\u5230\u865a\u62df\u673a\u540e\u53f0\u8bbe\u7f6eIP<\/span><\/h2>\n
      root\u9ed8\u8ba4\u5bc6\u7801\u4e3awazuh<\/p>\n
      \u4fee\u6539\u7684IP\u64cd\u4f5c\u5c31\u4e0d\u8be6\u7ec6\u4ecb\u7ecd\u4e86<\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u8865\u5145\uff1a\u5efa\u8bae\u53ca\u65f6\u4fee\u6539\u670d\u52a1\u5668\u7684\u65f6\u533a\u8bbe\u7f6e<\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      3\u3001\u767b\u5f55wazuh web\u754c\u9762<\/span><\/h2>\n
      \u521d\u59cb\u5bc6\u7801admin\/admin<\/p>\n
      \u4e3b\u754c\u9762\u5982\u4e0b\uff08kibana)<\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      4\u3001\u90e8\u7f72wazuh Agent\u5e76\u6ce8\u518c<\/span><\/h2>\n
      \u9009\u62e9\u5bf9\u5e94\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c\uff0c\u8bbe\u7f6e\u597dwazuh Server\u7684IP\u5730\u5740\uff0c\u5e76\u6307\u5b9aAgent\u7ec4(\u8fd9\u91cc\u6211\u4f7f\u7528\u9ed8\u8ba4\u7ec4default)<\/p>\n
      \u7136\u540e\u62f7\u8d1d\u547d\u4ee4\u5728\u5ba2\u6237\u7aef\u670d\u52a1\u5668(CentOS7.9 192.168.31.127)\u4e0a\u8fdb\u884c\u5b89\u88c5<\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      sudo\u00a0WAZUH_MANAGER='192.168.31.46'<\/span>\u00a0WAZUH_AGENT_GROUP='default'<\/span>\u00a0yum\u00a0install\u00a0https:\/\/packages.wazuh.com\/4.x\/yum\/wazuh-agent-4.1.5-1.x86_64.rpm\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u542f\u52a8Agent\u5e76\u8bbe\u7f6e\u5f00\u673a\u81ea\u52a8\u542f\u52a8<\/p>\n
      systemctl\u00a0start\u00a0wazuh-agent\r\nsystemctl\u00a0status\u00a0wazuh-agent\r\nsystemctl\u00a0enable<\/span>\u00a0wazuh-agent\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      5\u3001agent\u5728\u7ebf\u60c5\u51b5\u786e\u8ba4<\/span><\/h2>\n
      \u8fd9\u65f6web\u754c\u9762\u4e0a\u770b\u5230agent\u5728\u7ebf<\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u4e5f\u53ef\u4ee5\u540e\u53f0\u67e5\u770bAgent\u5728\u7ebf\u60c5\u51b5<\/p>\n
      \/var\/ossec\/bin\/agent_control\u00a0-l\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      6\u3001\u4e3b\u754c\u9762\u9ed8\u8ba4\u529f\u80fd<\/span><\/h2>\n
      Security events\u00a0<\/section>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      SCA\uff08CIS\u57fa\u7ebf\u6d4b\u8bd5\uff09\u00a0<\/section>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      7\u3001 Integrity monitoring\u6587\u4ef6\u5b8c\u6574\u6027\u529f\u80fd\u6d4b\u8bd5<\/span><\/h2>\n
      wazuh-manager\u670d\u52a1\u7aef<\/strong><\/section>\n
      vim\u00a0\/var\/ossec\/etc\/ossec.conf\r\n\u4fee\u6539\u6210\u5982\u4e0b\u914d\u7f6e\r\n<syscheck>\r\n\u00a0\u00a0\u00a0\u00a0<disabled>no<\/disabled><\/span><\/code><\/pre>\n
      <!–\u00a0Frequency\u00a0that\u00a0syscheck\u00a0is\u00a0executed\u00a0default\u00a0every\u00a012\u00a0hours\u00a0–>
      \n<frequency>600<\/frequency>
      \n\u5e76\u91cd\u542f\u670d\u52a1
      \nsystemctl\u00a0restart\u00a0wazuh-manager.service<\/span><\/p>\n
      <\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      wazuh-agent\u5ba2\u6237\u7aef\u00a0<\/strong><\/section>\n
      \u4f8b\u5982\u5728\/usr\/bin\/\u76ee\u5f55\u4e0b\u521b\u5efa\u4e00\u4e2all\u6587\u4ef6<\/section>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u5f3a\u5236\u7cfb\u7edf\u68c0\u67e5<\/p>\n
      \/var\/ossec\/bin\/ossec-syscheckd\u00a0-f\r\n<\/code><\/pre>\n
      \u8fd9\u65f6\u53ef\u4ee5\u5728Integrity monitoring\u770b\u5230\u8fd9\u6761\u8bb0\u5f55<\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      8\u3001Vulnerabilities\u6f0f\u6d1e\u8106\u5f31\u6027\u529f\u80fd\u6d4b\u8bd5<\/span><\/h2>\n
        \n
      • \n
        wazuh-manager\u670d\u52a1\u7aef<\/section>\n<\/li>\n<\/ul>\n
        vim\u00a0\/var\/ossec\/etc\/ossec.conf\r\n\u914d\u7f6e\u6587\u4ef6\u4e2d\u5f00\u542f\u8106\u5f31\u6027\u68c0\u6d4b\r\n\u4f8b\u5982redhat\u00a0vulnerabilities\u00a0\u7684enabled\u8bbe\u7f6e\u6210yes<\/span>\r\n<\/code><\/pre>\n
        <\/div><\/p>\n
        (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \n
        • \n
          wazuh-agent\u5ba2\u6237\u7aef<\/section>\n<\/li>\n<\/ul>\n
          vim\u00a0\/var\/ossec\/etc\/ossec.conf\u00a0\r\nsyscollector\u00a0\u5f00\u542f\u7cfb\u7edf\u641c\u96c6\u5f00\u5173\r\n<\/code><\/pre>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \u8fd9\u91cc\u7531\u4e8e\u7f51\u7edc\u539f\u56e0\u51fa\u73b0\u5982\u4e0b\u62a5\u9519<\/p>\n
          wazuh-modulesd:vulnerability-detector:\u00a0WARNING:\u00a0(5500):\u00a0The\u00a0'Red\u00a0Hat\u00a0Enterprise\u00a0Linux\u00a07'<\/span>\u00a0database\u00a0could\u00a0not\u00a0be\u00a0fetched.\r\n<\/code><\/pre>\n
          \u62c9\u53d6\u4e0d\u5230RHEL7\u7684\u6f0f\u6d1e\u8106\u5f31\u6027\u6570\u636e<\/p>\n
          \u53ef\u4ee5\u91c7\u7528\u79bb\u7ebf\u66f4\u65b0\u7684\u65b9\u5f0f\u89e3\u51b3\uff0c\u53c2\u8003\u4e0b\u9762\u94fe\u63a5\u6587\u7ae0\u89e3\u51b3<\/p>\n
          https:\/\/documentation.wazuh.com\/current\/user-manual\/capabilities\/vulnerability-detection\/offline_update.html\r\n<\/code><\/pre>\n
          \u8fd9\u91cc\u6211\u76f4\u63a5\u4e0b\u8f7d\u5230\u672c\u5730<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \u5728\u914d\u7f6e\u6587\u4ef6\u4e2d\u6307\u5b9a\r\n\u00a0<os\u00a0path=\"\/opt\/rhel-7-including-unpatched.oval.xml.bz2\"<\/span>>7<\/os><\/code><\/pre>\n
          \u8fd9\u65f6\u518d\u91cd\u542f\u670d\u52a1\u7aef
          \nsystemctl\u00a0restart\u00a0wazuh-manager.service<\/p>\n
          <\/code><\/pre>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \u5c31\u53ef\u4ee5\u770b\u5230\u6570\u636e\u4e86<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          9\u3001virustotal\u96c6\u6210-\u75c5\u6bd2\u68c0\u6d4b\u529f\u80fd\u6d4b\u8bd5<\/span><\/h2>\n
          1)\u3001\u8fd9\u91cc\u5148virustotal\u5b98\u7f51\u6ce8\u518c\u8d26\u53f7\u83b7\u53d6API KEY<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          2)\u3001wazuh-manager\u670d\u52a1\u7aef<\/p>\n
          \u914d\u7f6e\u6587\u4ef6\u6700\u4e0b\u65b9\u52a0\u5165\u5982\u4e0b\u4e00\u6bb5<\/p>\n
          vim\u00a0\/var\/ossec\/etc\/ossec.conf\r\n<ossec_config>\u00a0\u00a0\r\n\u00a0\u00a0<integration>\r\n\u00a0\u00a0\u00a0\u00a0<name>virustotal<\/name>\r\n\u00a0\u00a0\u00a0\u00a0<api_key>XXXXXX<\/api_key>\u00a0<!--\u00a0Replace\u00a0with\u00a0your\u00a0VirusTotal\u00a0API\u00a0key\u00a0-->\r\n\u00a0\u00a0\u00a0\u00a0<group>syscheck<\/group>\r\n\u00a0\u00a0\u00a0\u00a0<alert_format>json<\/alert_format>\r\n\u00a0<\/integration>\r\n<\/ossec_config><\/code><\/pre>\n
          systemctl\u00a0restart\u00a0wazuh-manager.service<\/p>\n
          <\/code><\/pre>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          3\uff09\u3001wazuh-agent\u670d\u52a1\u7aef<\/p>\n
          vim\u00a0\/var\/ossec\/etc\/ossec.conf\u00a0\r\n\u6dfb\u52a0\u8981\u5b9e\u65f6\u68c0\u6d4b\u7684\u76ee\u5f55\uff0c\u4f8b\u5982\/opt\u76ee\u5f55<\/code><\/pre>\n
          \u91cd\u542fagent
          \nsystemctl\u00a0restart\u00a0wazuh-agent<\/p>\n
          <\/code><\/pre>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \u5e76\u4e0a\u4f20\u4e00\u4e2a\u6728\u9a6c\u75c5\u6bd2\u6d4b\u8bd5<\/p>\n
          \u4f8b\u5982\u8fd9\u91cc\u5728opt\/software\u76ee\u5f55\u4e0b\u4e0a\u4f20shell.sh\u4e00\u4e2a\u6316\u77ff\u75c5\u6bd2\u7684\u811a\u672c<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          4)\u3001web\u754c\u9762\u8bbe\u7f6e\u5f00\u542fVirusTotal<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \u8fd9\u65f6\u5c31\u53ef\u4ee5\u770b\u5230\u6548\u679c\u4e86<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          API\u8c03\u7528\u60c5\u51b5<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          10\u3001MITRE ATT&CK \u6d4b\u8bd5SSH\u7834\u89e3<\/span><\/h2>\n
          \u4f7f\u6709kali\u673a\u5668\u6d4b\u8bd5SSH\u66b4\u529b\u7834\u89e3<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \u5728ATT&CK\u9875\u9762\u4e2d\u53ef\u4ee5\u770b\u5230Brute Force\u7684\u65e5\u5fd7\u53ca\u6570\u636e<\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \u603b\u7ed3\uff1a<\/span><\/h2>\n
          Wazuh\u7684\u529f\u80fd\u8f83\u591a\uff0c\u53ef\u4ee5\u53c2\u8003\u5b98\u65b9\u6587\u6863\u8fdb\u884c\u914d\u7f6e\u4e0e\u9a8c\u8bc1<\/p>\n
          https:\/\/documentation.wazuh.com\/current\/index.html\r\n<\/code><\/pre>\n
          <\/div><\/p>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
          1. Wazuh\u7b80\u4ecb Wazuh \u662f\u4e00\u4e2a\u514d\u8d39\u3001\u5f00\u6e90\u548c\u4f01\u4e1a\u7ea7\u7684\u5b89\u5168\u76d1\u63a7\u89e3\u51b3\u65b9\u6848\uff0c\u7528\u4e8e\u5a01\u80c1\u68c0\u6d4b\u3001\u5b8c\u6574\u6027\u76d1\u63a7\u3001\u4e8b\u4ef6\u54cd […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-5734","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/5734","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5734"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/5734\/revisions"}],"predecessor-version":[{"id":5800,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/5734\/revisions\/5800"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}