Integrate OSSEC with Splunk for centralized security monitoring and log analysis

#!/usr/bin/env bash
set -euo pipefail

# OSSEC-Splunk Integration Installation Script
# Production-ready script for installing and configuring OSSEC with Splunk integration

# Color definitions
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m' # No Color

# Global variables
readonly OSSEC_VERSION="3.7.0"
readonly OSSEC_USER="ossec"
readonly OSSEC_GROUP="ossec"
readonly OSSEC_DIR="/var/ossec"
readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Logging function
log() {
    echo -e "${GREEN}[$(date +'%Y-%m-%d %H:%M:%S')]${NC} $1" >&2
}

error() {
    echo -e "${RED}[ERROR]${NC} $1" >&2
}

warn() {
    echo -e "${YELLOW}[WARNING]${NC} $1" >&2
}

# Cleanup function for error handling
cleanup() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        error "Installation failed. Cleaning up..."
        systemctl stop ossec 2>/dev/null || true
        rm -rf /opt/ossec-hids-${OSSEC_VERSION} 2>/dev/null || true
        rm -f /opt/${OSSEC_VERSION}.tar.gz 2>/dev/null || true
    fi
    exit $exit_code
}

trap cleanup ERR

usage() {
    cat << EOF
Usage: $0 [OPTIONS]
Install and configure OSSEC with Splunk integration

OPTIONS:
    -e EMAIL     Email address for notifications (default: admin@localhost)
    -s SMTP      SMTP server (default: localhost)
    -h           Show this help message

Examples:
    $0 -e admin@company.com -s mail.company.com
    $0 -h
EOF
}

# Parse command line arguments
EMAIL="admin@localhost"
SMTP_SERVER="localhost"

while getopts "e:s:h" opt; do
    case $opt in
        e) EMAIL="$OPTARG" ;;
        s) SMTP_SERVER="$OPTARG" ;;
        h) usage; exit 0 ;;
        \?) error "Invalid option: -$OPTARG"; usage; exit 1 ;;
    esac
done

# Check if running as root
if [ "$EUID" -ne 0 ]; then
    error "This script must be run as root"
    exit 1
fi

# Detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update && apt upgrade -y"
                BUILD_DEPS="build-essential gcc make wget curl zlib1g-dev libpcre2-dev libevent-dev libssl-dev"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf update -y"
                BUILD_DEPS="gcc make wget curl zlib-devel pcre2-devel libevent-devel openssl-devel"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum update -y"
                BUILD_DEPS="gcc make wget curl zlib-devel pcre2-devel libevent-devel openssl-devel"
                ;;
            *)
                error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi
}

# Update system packages
update_system() {
    log "[1/8] Updating system packages..."
    $PKG_UPDATE
    log "System packages updated successfully"
}

# Install dependencies
install_dependencies() {
    log "[2/8] Installing OSSEC dependencies..."
    $PKG_INSTALL $BUILD_DEPS
    log "Dependencies installed successfully"
}

# Download and extract OSSEC
download_ossec() {
    log "[3/8] Downloading OSSEC ${OSSEC_VERSION}..."
    cd /opt
    wget -O ${OSSEC_VERSION}.tar.gz "https://github.com/ossec/ossec-hids/archive/${OSSEC_VERSION}.tar.gz"
    tar -xzf ${OSSEC_VERSION}.tar.gz
    chown -R root:root ossec-hids-${OSSEC_VERSION}
    log "OSSEC downloaded and extracted successfully"
}

# Install OSSEC with automated responses
install_ossec() {
    log "[4/8] Installing OSSEC..."
    cd /opt/ossec-hids-${OSSEC_VERSION}
    
    # Create automated install configuration
    cat > preloaded-vars.conf << EOF
USER_LANGUAGE="en"
USER_NO_STOP="y"
USER_INSTALL_TYPE="local"
USER_DIR="${OSSEC_DIR}"
USER_DELETE_DIR="y"
USER_ENABLE_ACTIVE_RESPONSE="y"
USER_ENABLE_SYSCHECK="y"
USER_ENABLE_ROOTCHECK="y"
USER_UPDATE="n"
USER_AGENT_SERVER_IP=""
USER_ENABLE_EMAIL="y"
USER_EMAIL_ADDRESS="${EMAIL}"
USER_EMAIL_SMTP="${SMTP_SERVER}"
USER_ENABLE_FIREWALL_RESPONSE="y"
USER_WHITE_LIST=""
USER_CA_STORE="/etc/ssl/certs/ca-certificates.crt"
EOF

    ./install.sh
    log "OSSEC installed successfully"
}

# Configure OSSEC for Splunk integration
configure_ossec() {
    log "[5/8] Configuring OSSEC for Splunk integration..."
    
    # Backup original configuration
    cp "${OSSEC_DIR}/etc/ossec.conf" "${OSSEC_DIR}/etc/ossec.conf.backup"
    
    # Create new configuration with JSON output
    cat > "${OSSEC_DIR}/etc/ossec.conf" << EOF
<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <logall>yes</logall>
    <logall_json>yes</logall_json>
    <email_notification>yes</email_notification>
    <smtp_server>${SMTP_SERVER}</smtp_server>
    <email_from>ossec@$(hostname)</email_from>
    <email_to>${EMAIL}</email_to>
    <white_list>127.0.0.1</white_list>
    <white_list>::1</white_list>
    <white_list>localhost.localdomain</white_list>
    <white_list>$(hostname)</white_list>
  </global>

  <rules>
    <include>rules_config.xml</include>
    <include>pam_rules.xml</include>
    <include>sshd_rules.xml</include>
    <include>telnetd_rules.xml</include>
    <include>syslog_rules.xml</include>
    <include>arpwatch_rules.xml</include>
    <include>symantec-av_rules.xml</include>
    <include>symantec-ws_rules.xml</include>
    <include>pix_rules.xml</include>
    <include>named_rules.xml</include>
    <include>smbd_rules.xml</include>
    <include>vsftpd_rules.xml</include>
    <include>pure-ftpd_rules.xml</include>
    <include>proftpd_rules.xml</include>
    <include>ms_ftpd_rules.xml</include>
    <include>ftpd_rules.xml</include>
    <include>hordeimp_rules.xml</include>
    <include>roundcube_rules.xml</include>
    <include>wordpress_rules.xml</include>
    <include>cimserver_rules.xml</include>
    <include>vpopmail_rules.xml</include>
    <include>vmpop3d_rules.xml</include>
    <include>courier_rules.xml</include>
    <include>web_rules.xml</include>
    <include>web_appsec_rules.xml</include>
    <include>apache_rules.xml</include>
    <include>nginx_rules.xml</include>
    <include>php_rules.xml</include>
    <include>mysql_rules.xml</include>
    <include>postgresql_rules.xml</include>
    <include>ids_rules.xml</include>
    <include>squid_rules.xml</include>
    <include>firewall_rules.xml</include>
    <include>cisco-ios_rules.xml</include>
    <include>netscreenfw_rules.xml</include>
    <include>sonicwall_rules.xml</include>
    <include>postfix_rules.xml</include>
    <include>sendmail_rules.xml</include>
    <include>imapd_rules.xml</include>
    <include>mailscanner_rules.xml</include>
    <include>dovecot_rules.xml</include>
    <include>ms-exchange_rules.xml</include>
    <include>racoon_rules.xml</include>
    <include>vpn_concentrator_rules.xml</include>
    <include>spamd_rules.xml</include>
    <include>msauth_rules.xml</include>
    <include>mcafee_av_rules.xml</include>
    <include>trend-osce_rules.xml</include>
    <include>ms-se_rules.xml</include>
    <include>zeus_rules.xml</include>
    <include>solaris_bsm_rules.xml</include>
    <include>vmware_rules.xml</include>
    <include>ms_dhcp_rules.xml</include>
    <include>asterisk_rules.xml</include>
    <include>ossec_rules.xml</include>
    <include>attack_rules.xml</include>
    <include>local_rules.xml</include>
  </rules>

  <syscheck>
    <disabled>no</disabled>
    <frequency>79200</frequency>
    <scan_on_start>yes</scan_on_start>
    <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes">/bin,/sbin,/boot</directories>
    <directories check_all="yes">/usr/local/bin,/usr/local/sbin</directories>
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore>/etc/mail/statistics</ignore>
    <ignore>/etc/random-seed</ignore>
    <ignore>/etc/random.seed</ignore>
    <ignore>/etc/adjtime</ignore>
    <ignore>/etc/httpd/logs</ignore>
    <ignore>/etc/utmpx</ignore>
    <ignore>/etc/wtmpx</ignore>
    <ignore>/etc/cups/certs</ignore>
    <ignore>/etc/dumpdates</ignore>
    <ignore>/etc/svc/volatile</ignore>
  </syscheck>

  <rootcheck>
    <disabled>no</disabled>
    <check_files>yes</check_files>
    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
    <check_ports>yes</check_ports>
    <check_if>yes</check_if>
  </rootcheck>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/messages</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/secure</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/auth.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/syslog</location>
  </localfile>

  <localfile>
    <log_format>apache</log_format>
    <location>/var/log/apache2/access.log</location>
  </localfile>

  <localfile>
    <log_format>apache</log_format>
    <location>/var/log/httpd/access_log</location>
  </localfile>

  <active-response>
    <disabled>no</disabled>
    <ca_store>/etc/ssl/certs/ca-certificates.crt</ca_store>
  </active-response>
</ossec_config>
EOF

    # Set proper permissions
    chmod 640 "${OSSEC_DIR}/etc/ossec.conf"
    chown root:${OSSEC_GROUP} "${OSSEC_DIR}/etc/ossec.conf"
    
    log "OSSEC configuration updated for Splunk integration"
}

# Configure systemd service
configure_service() {
    log "[6/8] Configuring OSSEC systemd service..."
    
    cat > /etc/systemd/system/ossec.service << EOF
[Unit]
Description=OSSEC HIDS
After=network.target

[Service]
Type=simple
User=root
Group=root
ExecStart=${OSSEC_DIR}/bin/ossec-control start
ExecStop=${OSSEC_DIR}/bin/ossec-control stop
ExecReload=${OSSEC_DIR}/bin/ossec-control restart
PIDFile=${OSSEC_DIR}/var/run/.daemon_pid
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

    systemctl daemon-reload
    systemctl enable ossec
    log "OSSEC service configured and enabled"
}

# Start services
start_services() {
    log "[7/8] Starting OSSEC service..."
    systemctl start ossec
    sleep 5
    log "OSSEC service started successfully"
}

# Verify installation
verify_installation() {
    log "[8/8] Verifying OSSEC installation..."
    
    # Check if service is running
    if systemctl is-active --quiet ossec; then
        log "✓ OSSEC service is running"
    else
        error "✗ OSSEC service is not running"
        return 1
    fi
    
    # Check if JSON logs are being generated
    if [ -f "${OSSEC_DIR}/logs/alerts/alerts.json" ]; then
        log "✓ JSON alerts file exists"
    else
        warn "JSON alerts file not yet created (this is normal for new installations)"
    fi
    
    # Check if OSSEC directories exist and have proper permissions
    if [ -d "${OSSEC_DIR}" ] && [ -O "${OSSEC_DIR}" ]; then
        log "✓ OSSEC directory structure is correct"
    else
        error "✗ OSSEC directory structure issue"
        return 1
    fi
    
    log "OSSEC installation verification completed successfully"
}

# Main installation function
main() {
    log "Starting OSSEC-Splunk