{"id":390,"date":"2016-01-20T17:59:06","date_gmt":"2016-01-20T17:59:06","guid":{"rendered":"https:\/\/defragged.org\/ossec\/?p=390"},"modified":"2020-07-03T18:19:24","modified_gmt":"2020-07-03T18:19:24","slug":"ossec-integrates-slack-and-pagerduty","status":"publish","type":"post","link":"https:\/\/defragged.org\/ossec\/2016\/01\/ossec-integrates-slack-and-pagerduty\/","title":{"rendered":"OSSEC Integrates Slack and PagerDuty"},"content":{"rendered":"\n

One of the new features that we open sourced and pushed to OSSEC is an \u201cintegrator\u201d daemon that we have been using internally to connect OSSEC to external APIs and alerting tools. The first two APIs we officially added were for Slack and PagerDuty.<\/p>\n\n\n\n

To get started, you have to download OSSEC from our fork, either from the development branch<\/a> or from the our stable<\/a> branch:<\/p>\n\n\n\n\n\n\n\n

After you install (or update) OSSEC, you need to enable the integrator<\/em> daemon with the following command:<\/p>\n\n\n\n

# \/var\/ossec\/bin\/ossec-control enable integrator<\/pre>\n\n\n\n
If the right version of OSSEC is installed, no errors will be generated and you are ready to configure it.<\/p>\n\n\n\n
Integrating with Slack<\/h5>\n\n\n\n
Slack is taking the world by storm and many companies are using it for internal communication. Most people are always connected to it, making it more practical to use for real-time alerts than to depend solely on email.<\/p>\n\n\n\n
Additionally, Slack integration is very easy to configure. First, you have to go to Slack and enable a new integration under Settings > Custom Integrations > Incoming Webhooks<\/strong>.<\/p>\n\n\n\n
\"Screen<\/figure>\n\n\n\n
You then choose a channel and a new hook will be created in the format of:
https:\/\/hooks.slack.com\/services\/RANDOMSTRING\/RANDOMSTRING<\/code>.<\/p>\n\n\n\n
Save that URL and add it in with the following to your ossec.conf<\/strong> file:<\/p>\n\n\n\n
<integration>\n<name>slack<\/name>\n<level>10<\/level>\n<hook_url>https:\/\/hooks.slack.com\/services\/RANDOM\/RANDOM<\/hook_url>\n<\/integration><\/pre>\n\n\n\n
Once you restart OSSEC, it will force all alerts with level above 10 to go to the OSSEC room you chose before, just like this:<\/p>\n\n\n\n
\"ossec-slack-integration\"<\/a><\/figure><\/div>\n\n\n\n
You can also specify per alert category or rule id, by using the <group> or <rule_id> entries. So if you only want to receive all authentication<\/em> related alerts via slack, you can add the following to your config:<\/p>\n\n\n\n
<integration>\n<name>slack<\/name>\n<group>authentication<\/group>\n<hook_url>https:\/\/hooks.slack.com\/services\/RANDOM\/RANDOM<\/hook_url>\n<\/integration><\/pre>\n\n\n\n
Restart OSSEC and you are done.<\/p>\n\n\n\n
Integrating with PagerDuty<\/h5>\n\n\n\n
PagerDuty is one of the best products out there to manage and notify network and security administrators (DevOps\/SecOps) about issues that deserve immediate attention.<\/p>\n\n\n\n
It is a powerful tool and one that can now be integrated with OSSEC. Be careful not to overdo it with this one. Only push to PagerDuty events that really matter.<\/p>\n\n\n\n
For example, we have some rules that are categorized as \u201cimmediate_response_required<\/strong>\u201d as they tend to be related to service availability; either a service went down or the system is running out of memory. An example would be the Nginx rule 31321 and the Syslog rule 1007:<\/p>\n\n\n\n
<rule id=\"31321\" level=\"5\" ignore=\"60\">\n<if_sid>31303<\/if_sid>\n<match>(99: Cannot assign requested address<\/match>\n<description>Nginx connection error - Out of sockets available.<\/description>\n<group>immediate_response_required,service_availability,<\/group>\n<\/rule>\n\n<rule id=\"1007\" level=\"7\">\n<match>file system full|No space left on device<\/match>\n<description>File system full.<\/description>\n<group>immediate_response_requird,low_diskspace,<\/group>\n<\/rule><\/pre>\n\n\n\n
As you can see, this triggers an alert if Nginx is unable to assign an address (likely down) or if a log file is generating an warning about no space left. These are generally pretty serious as they affect the availability of the server. So they can be a good one to push straight to Pagerduty for immediate attention.<\/p>\n\n\n\n
To do that, you first need to get your API key from the Pagerduty site. Go to Configuration > Services<\/strong> and view the service you have your escalations integrated with. There, you will see the API key to use, like this:<\/p>\n\n\n\n
Integration Type Generic API View PagerDuty API documentation\nIntegration Key RANDONKEY<\/pre>\n\n\n\n
Save the integration key and copy to the ossec.conf:<\/p>\n\n\n\n
<integration>\n<name>pagerduty<\/name>\n<group>immediate_response<\/group>\n<api_key>RANDOMKEY<\/api_key>\n<\/integration><\/pre>\n\n\n\n
In this example we tied OSSEC to the immediate_response<\/strong> group, so any serious availability issue will be pushed straight to the Pagerduty escalation. Similar to the Slack integration, you can tie it to alert levels (using <level>) or to specific alert ids (using <rule_id>).<\/p>\n\n\n\n
Adding More Integrations<\/h5>\n\n\n\n
That\u2019s it for now, however, adding new integrations to OSSEC is very easy and we plan to add more very soon. Hipchat is the next one on our list.<\/p>\n\n\n\n
Are\u00a0there any other integrations you want to see? Let us know and we will make it happen.<\/p>\n\n\n\n
Need Help with OSSEC?<\/h2>\n\n\n\n
We leverage OSSEC<\/a> extensively across all our products to help monitor and protect our servers. If you are not familiar with OSSEC, it is an open source Intrusion Detection System (HIDS); with a powerful correlation and analysis engine that integrates log analysis, file integrity monitoring, rootkit detection, real-time alerting, and active response.<\/p>\n\n\n\n
It provides complete coverage if you are looking for an endpoint (server) security solution. <\/p>\n\n\n\n