GDPR IV, Controller and processor

Ubuntu endpoint

1. Switch to the root user:

   $ sudo su
   

2. Create the directory personal_data in the /root directory:

   # mkdir /root/personal_data
   

3. Create the file subject_data.txt in the /root/personal_data directory and include some content:

   # touch /root/personal_data/subject_data.txt
   # echo "User01= user03_ID" >> /root/personal_data/subject_data.txt
   

4. Install auditd so that the Linux Auditing System provides information about who made changes in a monitored directory:

   # apt-get install auditd
   

   For Audit 3.1.1 and later, install the audispd af_unix plugin and restart the Audit service.

   # apt-get install audispd-plugins
   # service auditd restart
   

5. Add the highlighted configuration to the <syscheck> block of the Wazuh agent configuration file /var/ossec/etc/ossec.conf:

   <syscheck>
     <directories check_all="yes" whodata="yes">/root/personal_data</directories>
     <whodata>
       <provider>audit</provider>
     </whodata>
   </syscheck>
   

6. Restart the Wazuh agent to apply the changes:

   # systemctl restart wazuh-agent
   

7. Change the owner of subject_data.txt from root to a regular user:

   # chown <YOUR_REGULAR_USER>:<YOUR_REGULAR_USER> /root/personal_data/subject_data.txt
   

The following image shows the change made to the file.

Wazuh dashboard

1. Click the menu icon, then navigate to Security analytics > Overview.

2. Select Actions > Edit at the top-right section.

3. Under Settings, toggle on Index unclassified events and Index discarded events.

4. Click Save.

   

5. View these events on the dashboard by navigating to Explore > Discover.

6. Change the Index patterns to wazuh-events-v5-unclassified*.

   

7. Change the Index patterns accordingly to view other events of interest.

   

Configure the SMTP sender

The SMTP sender defines the mail server that sends the notifications.

1. Click the menu icon, then navigate to Explore > Notifications.

2. Click Email senders > Create SMTP sender.

3. Type a unique name in Sender name.

4. Type the address that sends the notifications in Email address.

5. Type the hostname or IP address of your SMTP server in Host.

6. Type the port of your SMTP server in Port. The default value is 465.

7. Select an Encryption method.

8. Click Create.

   

   Note

   SSL/TLS and STARTTLS require you to add the sender account credentials to the Wazuh indexer keystore.

The Encryption method field offers three options:

Configure the recipient group

The recipient group defines who receives the email notifications.

1. Click the menu icon, then navigate to Explore > Notifications.

2. Click Email recipient groups > Create recipient group.

3. Type a name for the group in Name.

4. Describe the purpose of the group in Description. This field is optional.

5. Type one or more email addresses in Emails. For this use case, add the address of your data protection officer.

6. Click Create.

   

   Note

   You can also add recipient addresses directly to the channel. A recipient group is useful when you send notifications to the same addresses from more than one channel.

Configure the email channel

The email channel binds the sender and the recipients. The alerting monitor sends its notifications to this channel.

1. Click the menu icon, then navigate to Explore > Notifications.

2. Click Channels > Create channel.

3. Type a name for the channel in Name.

4. Describe the purpose of the channel in Description. This field is optional.

5. Select Email in Channel type. You cannot change the channel type after you create the channel.

6. Select SMTP sender in Sender type.

7. Select the sender you created in SMTP sender.

8. Select the recipient group you created in Default recipients. You can also type an email address directly.

9. Click Send test message to confirm the configuration. A success message confirms that the channel works.

10. Click Create.

    

The Sender type field offers two options:

Create the alerting monitor

The alerting monitor watches your findings for failed authentication attempts. When the monitor detects a match, it triggers the action that sends the email.

1. Click the menu icon, then navigate to Explore > Alerting.

2. Switch to the Monitors tab and click Create monitor.

3. Type a name for the monitor in Monitor name.

4. Select Per document monitor in Monitor type.

5. Select Visual editor in Monitor defining method.

6. Set Frequency to By interval and set Run every to 1 minute under Schedule.

7. Under Select data, select wazuh-findings-v5-system-activity in Index.

8. Under Query, in Query name, type a name.

9. Set the query condition. In Field, select event.action. In the operator list, select is. In the value field, type authentication-failure.

   Note

   You can also match the finding by its rule identifier. In Field, select wazuh.rule.sigma_id and type the rule identifier. The event.action field is more stable, because it does not change when the rule identifier changes.

10. Click Add trigger under Triggers.

11. Type a name in Trigger name.

12. Select a level in Severity level. Level 1 is the highest.

13. Under Trigger conditions, in Specify queries or tags, select the name of the query.

14. Click Add notification under Actions.

15. Type a name in Action name.

16. Select the email channel you created in Channel.

17. Type a subject such as “Wazuh alert - failed authentication” in Message subject.

18. In Message, type the notification body. You can embed variables with Mustache templates.

    A failed authentication attempt was detected on a monitored endpoint.
    Trigger: {{ctx.trigger.name}}
    Severity: {{ctx.trigger.severity}}
    Monitor: {{ctx.monitor.name}}
    Detected between {{ctx.periodStart}} and {{ctx.periodEnd}} UTC.
    Review the finding in the Wazuh dashboard for the source IP, user, and host details.
    

19. Select Per alert in Perform action.

20. Click Send test message to confirm the action. A test email arrives at the recipient address.

21. Click Create.

    

The Monitor type field offers these options:

The Perform action field controls how often Wazuh sends the notification:

Verify the configuration

Verify that Wazuh sends the email when a failed authentication occurs.

1. On a monitored endpoint, attempt a Secure Shell (SSH) login with an invalid username:

   # ssh <INVALID_USER>@<ENDPOINT_IP>
   

2. The login fails because the user does not exist.

3. Wait for one monitor interval.

4. Wazuh detects the finding, the trigger fires, and the action sends an email to the recipient group.

The data protection officer receives an email similar to the following:

The email identifies the trigger, the severity, the monitor, and the detection window. To view more details, such as the source IP address, the recipient opens the finding on the Wazuh dashboard.

Ubuntu endpoint

1. Create the directory /customers:

   # mkdir /customers
   

2. Create the directory personal_data in the /customers directory:

   # mkdir /customers/personal_data
   

3. Add the highlighted configuration to the <syscheck> block of the agent configuration file /var/ossec/etc/ossec.conf:

   <syscheck>
     <directories realtime="yes" check_all="yes" report_changes="yes">/customers/</directories>
   </syscheck>
   

4. Restart the Wazuh agent to apply the changes:

   # systemctl restart wazuh-agent
   

5. Create the file regular_data.txt in the /customers directory and add some content:

   # touch /customers/regular_data.txt
   # echo "this is regular data" >> /customers/regular_data.txt
   

A medium severity finding on the Wazuh dashboard shows that a file was modified in the monitored directory.

Wazuh dashboard

Create a custom rule to increase the severity of file modification in the directory /customers/personal_data from medium to critical.

Ubuntu endpoint

Create the file sensitive_data.txt in the /customers/personal_data directory and add some content:

# touch /customers/personal_data/sensitive_data.txt
# echo "User01= user03_ID" >> /customers/personal_data/sensitive_data.txt

A critical finding shows that a sensitive file was modified in the monitored directory.