SOC 24/7 cu Wazuh SIEM + Suricata IDS

Un SOC matur nu inseamna 10 ecrane si 20 analisti. Pentru SMB / mid-market, un SOC functional 24/7 se construieste cu stack open-source si automatizare.

Stack-ul implementat

Wazuh SIEM — agregare loguri, corelare evenimente, detectie anomalii cu rules + ML
Suricata IDS/IPS — inspectare trafic in timp real, Emerging Threats + custom rules
Snort 3 — secondary IDS cross-validation
CrowdSec — community threat intelligence, blocaj automat
Grafana + Loki — dashboards centralizate, log aggregation
TheHive + Cortex — incident case management
Alerting — Telegram, email, PagerDuty cu on-call rotation

Ce inseamna "24/7" real

Nu oameni treji 24h. Inseamna: detectie 24/7 (automata), triaj 24/7 (severitate, runbook automat), response uman <15 min pentru P1/P2 via on-call rotation. P3/P4 - next-business-day.

Procesul de incident

Detectie → corelare Wazuh → ticket TheHive → notificare on-call → triaj 5 min → escalare/rezolvare/inchidere. Tot procesul documentat in runbook-uri specifice per tip incident.

Diferenta de MSSP comercial

Cost predictibil (fara surprize per-eveniment), transparenta completa (vezi ce vede analistul tau), zero black-box (rules vizibile si ajustabile), portabilitate (poti lua stack-ul oricand).

Ce livram

SOC functional 24/7 cu run-books pentru top 20 scenarii, dashboard custom, training echipa, integrare cu sistemele existente.

Exemplu: instalare Wazuh + Suricata

Pornirea rapida a stack-ului de detectie:

# Wazuh all-in-one (server + indexer + dashboard)
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
sudo bash wazuh-install.sh -a

# Suricata IDS + ruleset Emerging Threats
sudo apt -y install suricata
sudo suricata-update
sudo systemctl enable --now suricata
sudo tail -f /var/log/suricata/eve.json    # alertele in timp real

Inrolarea unui agent Wazuh

Adaugi un server/statie in Wazuh:

# pe manager: inregistrezi agentul
/var/ossec/bin/manage_agents -a -n web01 -i 10.0.0.11
# pe agent: instalezi + pointezi la manager
curl -sO https://packages.wazuh.com/4.x/wazuh-agent.deb
WAZUH_MANAGER='10.0.0.5' dpkg -i wazuh-agent.deb
systemctl enable --now wazuh-agent

Regula Suricata personalizata

Adaugi o regula proprie si actualizezi seturile:

# /etc/suricata/rules/local.rules
alert http any any -> any any (msg:"Posibil webshell"; content:"cmd="; http_uri; sid:1000001; rev:1;)
suricata-update              # actualizeaza ET Open + local
suricata -T -c /etc/suricata/suricata.yaml   # test config
systemctl restart suricata

Wazuh active response (blocare automata)

Wazuh blocheaza automat un IP la brute-force:

# /var/ossec/etc/ossec.conf (manager)

  firewall-drop
  local
  5710,5712   
  600

/var/ossec/bin/wazuh-control restart

Suricata inline IPS (nfqueue)

Treci Suricata din IDS in IPS care chiar pica pachetele:

# trimiti traficul catre Suricata prin nfqueue
nft add rule inet filter forward queue num 0
# suricata in mod IPS pe coada 0
suricata -q 0 -c /etc/suricata/suricata.yaml
# reguli 'drop' (nu doar 'alert') pt amenintarile confirmate
sed -i 's/^alert/drop/' /etc/suricata/rules/local.rules