#!/usr/bin/env python3 """ Crée le dashboard "Securite - Alertes Web et Firewall" dans OpenSearch Dashboards (Wazuh). Usage: python3 create-dashboard.py Le script se connecte depuis l'intérieur du container wazuh_dashboard via: docker exec wazuh_dashboard python3 /tmp/create-dashboard.py Ou directement si OpenSearch Dashboards est accessible sur localhost:5601. """ import json import urllib.request import urllib.error import ssl import base64 import subprocess import sys import os # ── Configuration ───────────────────────────────────────────────────────────── DASHBOARD_HOST = "https://localhost:5601" DASHBOARD_USER = "kibanaserver" DASHBOARD_PASS = os.environ.get("DASHBOARD_PASSWORD", "E9Jpr6586kQ3wYrCS2!") INDEX_PATTERN = "wazuh-alerts-*" # ── Queries de filtre ───────────────────────────────────────────────────────── Q_WEB = "rule.groups: web OR rule.groups: attack OR rule.groups: modsecurity OR rule.groups: api_brute_force" Q_FW = "rule.id: 651" Q_ALL = Q_WEB + " OR " + Q_FW # ── Client HTTP ─────────────────────────────────────────────────────────────── ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE _auth = base64.b64encode(f"{DASHBOARD_USER}:{DASHBOARD_PASS}".encode()).decode() _headers = { "Content-Type": "application/json", "osd-xsrf": "true", "Authorization": f"Basic {_auth}", } def api(method, path, body=None): data = json.dumps(body).encode() if body else None req = urllib.request.Request(DASHBOARD_HOST + path, data=data, headers=_headers, method=method) try: with urllib.request.urlopen(req, context=ctx, timeout=15) as r: return json.loads(r.read()) except urllib.error.HTTPError as e: return {"error": e.code, "msg": e.read().decode()[:300]} def search_src(query): return json.dumps({ "index": INDEX_PATTERN, "filter": [], "query": {"language": "kuery", "query": query}, }) # ── Définition des visualisations ───────────────────────────────────────────── VISUALIZATIONS = [ { "id": "sec-web-count", "title": "[Securite] Alertes Web - Total", "type": "metric", "query": Q_WEB, "visState": { "type": "metric", "params": { "metric": { "percentageMode": False, "useRanges": False, "colorSchema": "Green to Red", "metricColorMode": "Labels", "colorsRange": [{"from": 0, "to": 10}, {"from": 10, "to": 100}, {"from": 100, "to": 9999}], "labels": {"show": True}, "invertColors": False, "style": {"bgFill": "#000", "bgColor": False, "labelColor": False, "subText": "alertes web", "fontSize": 60}, } }, "aggs": [{"id": "1", "enabled": True, "type": "count", "schema": "metric", "params": {}}], }, }, { "id": "sec-cs-count", "title": "[Securite] Firewall - Total Bans", "type": "metric", "query": Q_FW, "visState": { "type": "metric", "params": { "metric": { "percentageMode": False, "useRanges": False, "colorSchema": "Green to Red", "metricColorMode": "Labels", "colorsRange": [{"from": 0, "to": 5}, {"from": 5, "to": 50}, {"from": 50, "to": 9999}], "labels": {"show": True}, "invertColors": False, "style": {"bgFill": "#000", "bgColor": False, "labelColor": False, "subText": "bans firewall", "fontSize": 60}, } }, "aggs": [{"id": "1", "enabled": True, "type": "count", "schema": "metric", "params": {}}], }, }, { "id": "sec-web-timeline", "title": "[Securite] Alertes Web - Timeline", "type": "histogram", "query": Q_WEB, "visState": { "type": "histogram", "params": { "type": "histogram", "grid": {"categoryLines": False}, "categoryAxes": [{"id": "CategoryAxis-1", "type": "category", "position": "bottom", "show": True, "style": {}, "scale": {"type": "linear"}, "labels": {"show": True, "truncate": 100}, "title": {}}], "valueAxes": [{"id": "ValueAxis-1", "name": "LeftAxis-1", "type": "value", "position": "left", "show": True, "style": {}, "scale": {"type": "linear", "mode": "normal"}, "labels": {"show": True, "rotate": 0, "filter": False, "truncate": 100}, "title": {"text": "Alertes"}}], "seriesParams": [{"show": True, "type": "histogram", "mode": "stacked", "data": {"label": "Alertes", "id": "1"}, "valueAxis": "ValueAxis-1", "drawLinesBetweenPoints": True, "showCircles": True}], "addTooltip": True, "addLegend": True, "legendPosition": "right", "times": [], "addTimeMarker": False, }, "aggs": [ {"id": "1", "enabled": True, "type": "count", "schema": "metric", "params": {}}, {"id": "2", "enabled": True, "type": "date_histogram", "schema": "segment", "params": {"field": "@timestamp", "interval": "auto", "customInterval": "2h", "min_doc_count": 1, "extended_bounds": {}}}, ], }, }, { "id": "sec-top-ips", "title": "[Securite] Top IPs Attaquantes", "type": "horizontal_bar", "query": Q_ALL, "visState": { "type": "horizontal_bar", "params": { "type": "horizontal_bar", "grid": {"categoryLines": False}, "categoryAxes": [{"id": "CategoryAxis-1", "type": "category", "position": "left", "show": True, "style": {}, "scale": {"type": "linear"}, "labels": {"show": True, "rotate": 0, "filter": True, "truncate": 200}, "title": {}}], "valueAxes": [{"id": "ValueAxis-1", "name": "LeftAxis-1", "type": "value", "position": "bottom", "show": True, "style": {}, "scale": {"type": "linear", "mode": "normal"}, "labels": {"show": True, "rotate": 75, "filter": False, "truncate": 100}, "title": {"text": "Alertes"}}], "seriesParams": [{"show": True, "type": "horizontal_bar", "mode": "stacked", "data": {"label": "Alertes", "id": "1"}, "valueAxis": "ValueAxis-1", "drawLinesBetweenPoints": True, "showCircles": True}], "addTooltip": True, "addLegend": True, "legendPosition": "right", "times": [], "addTimeMarker": False, }, "aggs": [ {"id": "1", "enabled": True, "type": "count", "schema": "metric", "params": {}}, {"id": "2", "enabled": True, "type": "terms", "schema": "segment", "params": {"field": "data.srcip", "size": 15, "order": "desc", "orderBy": "1", "otherBucket": False, "missingBucket": False}}, ], }, }, { "id": "sec-top-rules", "title": "[Securite] Top Regles Declenchees", "type": "pie", "query": Q_WEB, "visState": { "type": "pie", "params": {"type": "pie", "addTooltip": True, "addLegend": True, "legendPosition": "right", "isDonut": True, "labels": {"show": False, "values": True, "last_level": True, "truncate": 100}}, "aggs": [ {"id": "1", "enabled": True, "type": "count", "schema": "metric", "params": {}}, {"id": "2", "enabled": True, "type": "terms", "schema": "segment", "params": {"field": "rule.description", "size": 10, "order": "desc", "orderBy": "1", "otherBucket": True, "otherBucketLabel": "Autres", "missingBucket": False}}, ], }, }, { "id": "sec-cs-bans-table", "title": "[Securite] Firewall - IPs Bannies", "type": "table", "query": Q_FW, "visState": { "type": "table", "params": {"perPage": 20, "showPartialRows": False, "showMetricsAtAllLevels": False, "sort": {"columnIndex": None, "direction": None}, "showTotal": False, "totalFunc": "sum"}, "aggs": [ {"id": "1", "enabled": True, "type": "count", "schema": "metric", "params": {}}, {"id": "2", "enabled": True, "type": "terms", "schema": "bucket", "params": {"field": "data.srcip", "size": 30, "order": "desc", "orderBy": "1", "otherBucket": False, "missingBucket": False}}, {"id": "3", "enabled": True, "type": "terms", "schema": "bucket", "params": {"field": "rule.description", "size": 5, "order": "desc", "orderBy": "1", "otherBucket": False, "missingBucket": False}}, ], }, "uiStateJSON": json.dumps({"vis": {"params": {"sort": {"columnIndex": 0, "direction": "desc"}}}}), }, { "id": "sec-severity", "title": "[Securite] Distribution Severite", "type": "pie", "query": Q_WEB, "visState": { "type": "pie", "params": {"type": "pie", "addTooltip": True, "addLegend": True, "legendPosition": "right", "isDonut": False, "labels": {"show": True, "values": True, "last_level": True, "truncate": 100}}, "aggs": [ {"id": "1", "enabled": True, "type": "count", "schema": "metric", "params": {}}, {"id": "2", "enabled": True, "type": "terms", "schema": "segment", "params": {"field": "rule.level", "size": 15, "order": "desc", "orderBy": "1", "otherBucket": False}}, ], }, }, ] # ── Layout dashboard (grid 48 colonnes) ─────────────────────────────────────── PANELS = [ {"panelIndex": "1", "gridData": {"x": 0, "y": 0, "w": 24, "h": 6, "i": "1"}, "version": "2.19.5", "type": "visualization", "id": "sec-web-count", "embeddableConfig": {}}, {"panelIndex": "2", "gridData": {"x": 24, "y": 0, "w": 24, "h": 6, "i": "2"}, "version": "2.19.5", "type": "visualization", "id": "sec-cs-count", "embeddableConfig": {}}, {"panelIndex": "3", "gridData": {"x": 0, "y": 6, "w": 48, "h": 12, "i": "3"}, "version": "2.19.5", "type": "visualization", "id": "sec-web-timeline", "embeddableConfig": {}}, {"panelIndex": "4", "gridData": {"x": 0, "y": 18, "w": 28, "h": 14, "i": "4"}, "version": "2.19.5", "type": "visualization", "id": "sec-top-ips", "embeddableConfig": {}}, {"panelIndex": "5", "gridData": {"x": 28, "y": 18, "w": 20, "h": 14, "i": "5"}, "version": "2.19.5", "type": "visualization", "id": "sec-top-rules", "embeddableConfig": {}}, {"panelIndex": "6", "gridData": {"x": 0, "y": 32, "w": 48, "h": 12, "i": "6"}, "version": "2.19.5", "type": "visualization", "id": "sec-cs-bans-table", "embeddableConfig": {}}, {"panelIndex": "7", "gridData": {"x": 0, "y": 44, "w": 24, "h": 10, "i": "7"}, "version": "2.19.5", "type": "visualization", "id": "sec-severity", "embeddableConfig": {}}, ] # ── Main ────────────────────────────────────────────────────────────────────── def main(): print("=== Création du dashboard Securite - Alertes Web et Firewall ===\n") # Visualisations for viz in VISUALIZATIONS: vis_state = dict(viz["visState"]) vis_state["title"] = viz["title"] body = { "attributes": { "title": viz["title"], "visState": json.dumps(vis_state), "uiStateJSON": viz.get("uiStateJSON", "{}"), "description": "", "kibanaSavedObjectMeta": {"searchSourceJSON": search_src(viz["query"])}, } } r = api("POST", f"/api/saved_objects/visualization/{viz['id']}?overwrite=true", body) if "id" in r: print(f" ✅ {viz['title']}") else: print(f" ❌ {viz['title']}: {r}") sys.exit(1) # Dashboard dashboard_body = { "attributes": { "title": "Securite - Alertes Web et Firewall", "description": "Alertes OWASP ModSecurity brute-force API et bans Firewall", "panelsJSON": json.dumps(PANELS), "optionsJSON": json.dumps({"useMargins": True, "hidePanelTitles": False}), "timeRestore": False, "kibanaSavedObjectMeta": { "searchSourceJSON": json.dumps({"query": {"language": "kuery", "query": ""}, "filter": []}) }, } } r = api("POST", "/api/saved_objects/dashboard/sec-web-crowdsec-dashboard?overwrite=true", dashboard_body) if "id" in r: print(f"\n ✅ Dashboard: {r['id']}") print(f"\n URL: https:///#/app/dashboards#/view/{r['id']}") else: print(f"\n ❌ Dashboard: {r}") sys.exit(1) print("\n=== Terminé ===") if __name__ == "__main__": main()