wazuh / wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
https://wazuh.com/
Other
9.44k stars 1.49k forks source link

Allow syscheck reports size for 2gb+ files #17415

Closed mjcr99 closed 1 week ago

mjcr99 commented 12 months ago
Related issue
https://github.com/wazuh/wazuh/issues/17184

Description

This PR solves a problem in syscheck that caused data corruption in the reported size for 2gb+ files. Due to data type conflicts, the data flow suffered truncations and non-desired modifications in the FIM size variable, resulting in corrupted alerts and incorrect file monitoring.

Configuration options

No special configuration is needed, but to clearly see the change, enabling realtime monitoring is usefull.

Logs/Alerts example

Example alerts creating, moficating and deleting a 5,8+ gb test file.

File creation ``` ** Alert 1685988994.1033190: - ossec,syscheck,syscheck_entry_added,syscheck_file,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,tsc_PI1.4,tsc_PI1.5,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, 2023 Jun 05 18:16:34 (agent3-ubu22) any->syscheck Rule: 554 (level 5) -> 'File added to the system.' File '/home/vagrant/test/tt' added Mode: realtime Attributes: - Size: 6294967300 - Permissions: rw-r--r-- - Date: Tue Jun 6 10:01:35 2023 - Inode: 1574467 - User: root (0) - Group: root (0) - MD5: d41d8cd98f00b204e9800998ecf8427e - SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ```
File size modification ``` ** Alert 1685989009.1033890: - ossec,syscheck,syscheck_entry_modified,syscheck_file,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,tsc_PI1.4,tsc_PI1.5,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, 2023 Jun 05 18:16:49 (agent3-ubu22) any->syscheck Rule: 550 (level 7) -> 'Integrity checksum changed.' File '/home/vagrant/test/tt' modified Mode: realtime Changed attributes: size,mtime Size changed from '6294967300' to '6294967400' Old modification time was: '1686045695', now it is '1686045710' Attributes: - Size: 6294967400 - Permissions: rw-r--r-- - Date: Tue Jun 6 10:01:50 2023 - Inode: 1574467 - User: root (0) - Group: root (0) - MD5: d41d8cd98f00b204e9800998ecf8427e - SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ```
File deletion ``` ** Alert 1685989100.1034740: - ossec,syscheck,syscheck_entry_deleted,syscheck_file,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,tsc_PI1.4,tsc_PI1.5,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, 2023 Jun 05 18:18:20 (agent3-ubu22) any->syscheck Rule: 553 (level 7) -> 'File deleted.' File '/home/vagrant/test/tt' deleted Mode: realtime Attributes: - Size: 6294967400 - Permissions: rw-r--r-- - Date: Tue Jun 6 10:01:50 2023 - Inode: 1574467 - User: root (0) - Group: root (0) - MD5: d41d8cd98f00b204e9800998ecf8427e - SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709 - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ```

Tests

mjcr99 commented 1 week ago

Failing test analysis:

Additionally