Logging Ubiquiti EdgeRouter firewall events to Wazuh

Problem

Logging EdgeRouter firewall events to Wazuh needs custom decoder and rules.

Solution

In /var/ossec/etc/rules/edgerouter-fw_rules.xml: 

<group name="local,edgerouter,">

<rule id="900100" level="3">

    <decoded_as>edgerouter-fw-tcp</decoded_as>

    <description>EdgeRouter TCP packet: $(srcip):$(srcport) → $(dstip):$(dstport) via $(in_iface)</description>

    <group>edgerouter,tcp,firewall,</group>

</rule>

<rule id="900110" level="3">

    <decoded_as>edgerouter-fw-udp</decoded_as>

    <description>EdgeRouter UDP packet: $(srcip):$(srcport) → $(dstip):$(dstport) via $(in_iface), payload $(payload_len) bytes</description>

    <group>edgerouter,udp,firewall,</group>

</rule>

<rule id="900120" level="3">

    <decoded_as>edgerouter-fw-icmp</decoded_as>

    <description>EdgeRouter ICMP packet: $(srcip) → $(dstip), type $(icmp_type) code $(icmp_code)</description>

    <group>edgerouter,icmp,firewall,</group>

</rule>

<rule id="900200" level="5">

    <if_sid>900100</if_sid>

    <match>SYN</match>

    <description>TCP SYN from $(srcip):$(srcport) to $(dstip):$(dstport) blocked by $(chain)</description>

    <group>edgerouter,tcp,syn,</group>

</rule>

<rule id="900210" level="10" frequency="10" timeframe="60">

    <if_matched_sid>900200</if_matched_sid>

    <same_source_ip />

    <description>Possible TCP SYN scan: $(srcip) sent repeated SYN packets to multiple ports</description>

    <group>edgerouter,tcp,scan,</group>

</rule>

<rule id="900300" level="4">

    <if_sid>900110</if_sid>

    <description>UDP traffic: $(srcip):$(srcport) → $(dstip):$(dstport)</description>

    <group>edgerouter,udp,event,</group>

</rule>

<rule id="900310" level="10" frequency="20" timeframe="30">

    <if_matched_sid>900300</if_matched_sid>

    <same_source_ip />

    <description>Possible UDP flood: $(srcip) sent $(frequency) packets in $(timeframe)s</description>

    <group>edgerouter,udp,flood,</group>

</rule>

<rule id="900400" level="4">

    <if_sid>900120</if_sid>

    <match>TYPE=8</match>

    <description>ICMP Echo Request (ping) from $(srcip) to $(dstip), seq $(icmp_seq)</description>

    <group>edgerouter,icmp,echo,</group>

</rule>

<rule id="900410" level="10" frequency="20" timeframe="30">

    <if_matched_sid>900400</if_matched_sid>

    <same_source_ip />

    <description>Possible ICMP flood: $(srcip) sent $(frequency) echo requests in $(timeframe)s</description>

    <group>edgerouter,icmp,flood,</group>

</rule>

<rule id="900500" level="3">

    <match>WAN_LOCAL</match>

    <description>EdgeRouter WAN_LOCAL rule matched: $(srcip) → $(dstip) on $(proto)</description>

    <group>edgerouter,wan_local,</group>

</rule>

<rule id="900600" level="5">

    <match>WAN_LOCAL-default-D</match>

    <description>Inbound traffic blocked by WAN_LOCAL: $(srcip):$(srcport) → $(dstip):$(dstport) proto $(proto)</description>

    <group>edgerouter,blocked,wan_local,</group>

</rule>

<rule id="900700" level="8">

    <if_sid>900200</if_sid>

    <match>WAN_LOCAL-default-D</match>

    <description>Blocked TCP SYN: $(srcip):$(srcport) → $(dstip):$(dstport) flags $(flags)</description>

    <group>edgerouter,tcp,blocked,scan,</group>

</rule>

<rule id="900710" level="8" frequency="15" timeframe="60">

    <if_matched_group>blocked</if_matched_group>

    <same_source_ip />

    <description>Repeated blocked traffic from $(srcip): $(frequency) events in $(timeframe)s</description>

    <group>edgerouter,blocked,scan,</group>

</rule>

</group>

In /var/ossec/etc/decoders/edgerouter-fw.xml. Make sure there are no line breaks inside <regex> node:

<decoder name="edgerouter-fw-tcp">

    <parent>kernel</parent>

    <regex type="pcre2">\[([^\]]+)\]IN=(\S*)\s+OUT=(\S*)\s+MAC=([0-9A-Fa-f:]+)\s+SRC=([0-9.]+)\s+DST=([0-9.]+)\s+LEN=(\d+)\s+TOS=(\S+)\s+PREC=(\S+)\s+TTL=(\d+)\s+ID=(\d+)(?:\s+DF)?\s+PROTO=TCP\s+SPT=(\d+)\s+DPT=(\d+)\s+WINDOW=(\d+)\s+RES=(\S+)\s+(\S+)\s+URGP=(\d+)</regex>

    <order>chain,in_iface,out_iface,mac,srcip,dstip,len,tos,prec,ttl,id,srcport,dstport,window,res,flags,urgp</order>

</decoder>

<decoder name="edgerouter-fw-udp">

    <parent>kernel</parent>

    <regex type="pcre2">\[([^\]]+)\]IN=(\S*)\s+OUT=(\S*)\s+MAC=([0-9A-Fa-f:]+)\s+SRC=([0-9.]+)\s+DST=([0-9.]+)\s+LEN=(\d+)\s+TOS=(\S+)\s+PREC=(\S+)\s+TTL=(\d+)\s+ID=(\d+)\s+PROTO=UDP\s+SPT=(\d+)\s+DPT=(\d+)\s+LEN=(\d+)</regex>

    <order>chain,in_iface,out_iface,mac,srcip,dstip,len,tos,prec,ttl,id,srcport,dstport,payload_len</order>

</decoder>

<decoder name="edgerouter-fw-icmp">

    <parent>kernel</parent>

    <regex type="pcre2">\[([^\]]+)\]IN=(\S*)\s+OUT=(\S*)\s+MAC=([0-9A-Fa-f:]+)\s+SRC=([0-9.]+)\s+DST=([0-9.]+)\s+LEN=(\d+)\s+TOS=(\S+)\s+PREC=(\S+)\s+TTL=(\d+)\s+ID=(\d+)(?:\s+DF)?\s+PROTO=ICMP\s+TYPE=(\d+)\s+CODE=(\d+)\s+ID=(\d+)\s+SEQ=(\d+)</regex>

    <order>chain,in_iface,out_iface,mac,srcip,dstip,len,tos,prec,ttl,id,icmp_type,icmp_code,icmp_id,icmp_seq</order>

</decoder>

UISP on Azure

Below are the bare minimum steps to install Ubiquiti Internet Service Provider (UISP) on a Docker container on Azure Ubuntu VM. After adding my ER-X-SFP v 3.0.0-rc9 to UISP , I can now see it on the UISP console.

1. Create new VM: Debian 12 "Bookworm" - x64 Gen 2
   
   
   
   
2. For VM Size, use B1ms
3. Have portsl 22, 80, 443 open in Network settings
4. Connect to VM using SSH
1. Username and pwd are the ones you typed in when creating the VM
5. Run `curl -fsSL https://uisp.ui.com/install > /tmp/uisp_inst.sh && sudo bash /tmp/uisp_inst.sh --ws-port 8456` to install Docker and UISP
1. Note that I defined custom WS port as I want to limit that only to be accessed from my home IP address
6. Connect to UISP using browser
7. In UISP Settings, I changed the “Ping Address” to ping.ubnt.com as suggested at https://community.ubnt.com/t5/UNMS-Ubiquiti-Network-Management/ICMP-blocked-to-UNMS-in-Azure/m-p/2007979#M219