Yintoni i-Wazuh: Iqonga loMthombo oVulekileyo loKhuseleko lwe-Cybersecurity lwale mihla

Informatec Digital » Khu seleko » Yintoni i-Wazuh: Iqonga loMthombo oVulekileyo loKhuseleko lwe-Cybersecurity lwale mihla

I-Cybersecurity ibe yinto ephambili ebalulekileyo kwiinkampani zabo bonke ubungakanani. Kwilizwe ledijithali, izoyikiso zivela ngesantya esidizayo, ezifuna ukukhangelwa kwezisombululo ezisebenzayo ezibhaqa, zithintele, kwaye ziphendule kuyo nayiphi na inzame yokungena. Abo balawula amaziko e-IT bakhangela izixhobo ezinamandla, eziguquguqukayo, kwaye, ukuba kunokwenzeka, ezikhululekileyo kwimiqobo ehlala ibandakanya iilayisenisi zorhwebo ezibizayo.

Phakathi kweenketho ezahlukeneyo ezikhoyo, I-Wazuh iye yafumana umhlaba de yaba yireferensi kwabo bafuna ukukhusela iinkqubo zabo ngendlela ehlakaniphile neyoqoqosho.Eli qonga lomthombo ovulekileyo lidibanisa ezona teknoloji zininzi zokhuseleko zibe sisisombululo esinye, esilungele zombini uqalo kunye neenkampani ezinkulu.

Yintoni iWazuh kwaye kutheni ibalulekile kukhuseleko lwe-cyber?

I-Wazuh liqonga elibanzi elivulelekileyo le-cybersecurity eligxile ekukhuseleni amaziko e-IT, nokuba kukwizakhiwo, kusekwe, kufakwe ikhonteyina, okanye kubume belifu. Ukususela ekuqalisweni kwayo kwi-2015 njengenguquko ye-OSSEC eyaziwayo, i-Wazuh ikhule ibe sisixhobo esikhokelayo, kunye noluntu olukhulayo lwabasebenzisi kunye nabaphuhlisi abagxile ekunikezeni ukhuseleko olufikelelekayo kunye nolunamandla.

Umsebenzi oyintloko we-Wazuh kukusebenza njenge-HIDS (i-Host-based Intrusion Detection System), oko kukuthi, inkqubo yokukhangela ukungena efakwe ngokuthe ngqo kwizixhobo eziza kuhlolwa. Oku kukuvumela ukuba uhlalutye ngokucokisekileyo indlela yokuziphatha, iilog, imfezeko yefayile, kunye noqwalaselo lwenkqubo nganye ukubona naziphi na iinzame ezikrokrisayo zokufikelela okungagunyaziswanga, i-malware, okanye ukuphazamisa.

Kodwa i-Wazuh ayipheleli kwimisebenzi ye-HIDS. Ndiyabulela ekuziphendukeleni kwayo okuqhubekayo kunye nokudibanisa kunye nobuchwepheshe obufana ne-SIEM (uLwazi lwezoKhuseleko kunye noLawulo lweSigigaba) kunye ne-XDR (i-Detection Eyongeziweyo kunye neMpendulo), iqonga liyakwazi ukuqokelela, ukulungelelanisa nokuhlalutya idatha yokhuseleko evela kwimithombo emininzi, ukuvelisa izilumkiso, ukuphendula ngokusebenzayo kwiziganeko kunye nokunceda ukuthobela imigaqo efana ne-DSS.R okanye i-PCI.R

I-Wazuh Architecture kunye neMicimbi

Ukuqonda amandla e-Wazuh, kubalulekile ukuqonda indlela i-architecture yayo eyakhiwe ngayo. Isisombululo siquka ikakhulu izinto ezine eziphambili:

• Iiarhente: Zifakwe kwizixhobo zokugqibela (iiPC, iiseva, oomatshini bokwenene, iimeko zefu, njl.) kwaye banoxanduva lokuqokelela idatha yokhuseleko, ukuhlalutya iziganeko, ukubeka iliso ukuthembeka kwefayile, kunye nokuqhuba uhlalutyo olucwangcisiweyo kunye nokukhusela imisebenzi.
• Umncedisi: Ifumana ulwazi kuzo zonke ii-arhente, isebenze kwaye iyihlalutye isebenzisa iikhowuda kunye nemithetho eyivumela ukuba ibone iipateni ezingaqhelekanga okanye izoyikiso. Eli candelo lilawula ii-arhente, lizihlaziya ukude, kwaye lingakhula ngokuthe tye kwimowudi yeqela ukukhonza iziseko ezinkulu.
• Isalathisi: Ngokusekwe kukhangelo olukhulu oluluqilima kunye nobuchwephesha bokuhlalutya, igcina kwaye izalathise zonke izilumkiso kunye neziganeko ezithunyelwe ngumncedisi kwifomathi ye-JSON, ivumela ukukhangela okukhawulezayo, ukulungelelaniswa, kunye nokugcinwa kwexesha elide lokungena.
• Dashboard: I-interface yewebhu apho abasebenzisi banokujonga yonke idatha eqokelelweyo kwaye bayihlalutye ngexesha langempela, ulungiselele imithetho, uvelise iingxelo, kwaye ufikelele kwiimpawu eziphambili zokulawula iqonga.

Elinye lawona mandla makhulu kaWazuh kukukwazi ukuhanjiswa kuzo zombini izakhiwo ezilula kunye neqela elikhulu elisasazwe, elivumela ukuba likhule ngokusekwe kwiimfuno zombutho ngamnye.

Inqaku elidibeneyo:

Yintoni ihashing? Inkcazo epheleleyo, ukusetyenziswa, kunye nendlela esebenza ngayo kukhuseleko lwedijithali.

Zeziphi iimpawu ezinikezelwa nguWazuh?

IWazuh ibalasele kuluhlu lwayo olubanzi lweempawu, ezigubungela phantse lonke ukhuseleko lwangoku lwe-cybersecurity, ukubonakala, kunye neemfuno zokuphendula.

• Uhlalutyo lwelogi kunye nesiganeko: Iiarhente ziqokelela ulwazi oluneenkcukacha kwiinkqubo kunye nezicelo ngexesha langempela, ngokukhuselekileyo ukuthumela le datha kumncedisi ukuhlalutya.
• IFayile yokuHlolwa kweMfezeko (FIM): Uhlala ebeka esweni ezona folda zibalulekileyo kunye neefayile, ukubona utshintsho kumxholo, iimvume, okanye ubunini obunokubonisa ukuphazamisa okanye ukuhlaselwa.
• Uvavanyo loLungiselelo loKhuseleko (SCA): Isebenzisa iskena esizenzekelayo senkqubo kunye noqwalaselo lwesicelo, iqinisekisa ukuba ziyahambelana nezona ndlela zilungileyo nemimiselo yoshishino, kwaye ikwazisa ngako nakuphi na ukutenxa.
• Ukufunyanwa kweMalware kunye neNgozi: Isebenzisa imigaqo yobhaqo, ubukrelekrele bezoyikiso, kunye nezalathi ze-IOC ezaziwayo ukuchonga indlela yokuziphatha ekrokrisayo.
• Ukufunyanwa koMngcipheko weCVE kunye noLawulo: Iiarhente zivelisa iingxelo ezinceda ukuchonga, ukubona, kunye nokujongana ngokukhawuleza nobuthathaka obaziwayo kwiinkqubo ngokunxibelelanisa uluhlu lwesoftware kunye nedathabheyi ehlaziyiweyo yobungozi.
• Impendulo yesiganeko esisebenzayo: Ayifumani nje kuphela, kodwa inokwenza ngokuzenzekelayo izenzo zokulungisa ngokuchasene nezisongelo eziqhubekayo (umzekelo, ukuvala inkqubo, ukwahlula ikhompyutha, ukusungula izikripthi, njl. njl.).
• Ukubek'esweni okungenamsebenzi: Ukongeza kwi-agent-based based protection, ivumela ukuhlanganiswa kwezixhobo ezingenako ukufaka isofthiwe, ezifana ne-firewalls, i-switchers, i-routers, okanye iinkqubo zokufumanisa i-network intrusion (NIDS), ukwandisa ukhuseleko lokhuseleko.
• Ukhuseleko lweemekobume zemixube kunye nelifu: Iququzelela ukudityaniswa kunye nokubekw'esweni kwamaqonga elifu afana ne-AWS, i-Azure, i-GCP, okanye i-Microsoft 365, ikwabeka iliso kwizikhongozeli ze-Docker kunye neenkqubo ezibonakalayo, ezibonelela ngokubonakala okupheleleyo kwiziseko ezingundoqo zanamhlanje.
• Ukuthotyelwa kwesiqhelo: Ibonelela ngolawulo oluthile kunye neemodyuli zokunceda ukuhlangabezana neemfuno zokulawula ezifana ne-GDPR, i-NIST, i-TSC, i-HIPAA, i-PCI DSS, kunye nabanye, ukubonelela ubungqina obulungele uphicotho kunye nokunika ingxelo.
• Uhlalutyo lwasenkundleni kunye nokulandelelwa: Igcina yonke idatha efanelekileyo, ivumela uphando olunzulu lweziganeko zokhuseleko kunye nokuququzelela uphicotho olulandelayo.
• Uluhlu lwe-IT kunye nempilo: Yakha uluhlu lwempahla lwangoku lwazo zonke ii-asethi ezibekwe esweni, ulawulo oluququzelelayo, ukuthotyelwa, kunye nokusabela kubuthathaka.

Inqaku elidibeneyo:

Yintoni iTelnet? Ukusebenza, ukusetyenziswa, ukhuseleko kunye nezinye iindlela

Yintoni eyahlula uWazuh kwezinye ii-IDS kunye nee-SIEMs?

I-Wazuh yavela njengenguquko yemfuno: ukunika isisombululo esinamandla nesibhetyebhetye ngaphandle kokuxhomekeka kwiimvume ezixabisayo zobunini. Kodwa ixabiso layo elikhethekileyo lilele kwiinkalo ezininzi eziphambili:

• Indalo yomthombo ovulekileyo: Ivumela nayiphi na inhlangano ukuba ifake, ilungelelanise, kwaye iyenze ngokwezifiso iqonga ukuze lihambelane neemfuno zabo, ngelixa ligcina iindleko kunye nokuphepha ukutshixa komthengisi owoyikekayo okuqhelekileyo kunye nezisombululo zorhwebo.
• Uluntu olusebenzayo nolukhulayo: Njengeprojekthi evulekileyo, uluntu lunikela ngemithetho, ukuphuculwa, kunye nenkxaso, ukukhawulezisa izinto ezintsha kunye nokuququzelela intsebenziswano.
• I-Multiplatform: Ixhasa iintlobo ngeentlobo zeenkqubo zokusebenza, kubandakanya iLinux, iWindows, iMacOS, i-AIX, iSolaris, kunye neHP-UX, iqinisekisa ukugqunywa kweemeko ezingqongileyo.
• Isikali: I-architecture yayo isekela yonke into ukusuka kwincinci ukuya kwi-deploy-scale-scales, eyenza ukudalwa kwamaqela asasazwayo kwimibutho emikhulu.
• Ukudityaniswa ne-Elastic Stack: Inika umaleko onamandla wohlalutyo olubonakalayo, kunye needeshibhodi ezilungele ukusetyenziswa, ukunika ingxelo, kunye nolawulo oluphezulu lwesilumkiso.
• Ukubekw'esweni okuneenkcukacha kwiziseko zelifu kunye nezikhongozeli: Ihamba ngaphaya kwengcamango ye-IDS yendabuko, ibonelela ngokubonakala kunye nokukhusela kwiindawo zedijithali kunye nokusabalalisa.
• Ukuzenzekela impendulo: Idibanisa izakhono ze-XDR ukulungiselela iimpendulo ezizenzekelayo, ukuphucula isantya sokusabela kwiziganeko.

Ukuqonda ngcono ukuba itekhnoloji yokhuselo iqhubela phambili njani kwiindawo zale mihla, sicebisa ukuba uphonononge ukuba yintoni ukhuseleko lwamafu.

Uninzi lweemeko ezifanelekileyo zokusetyenziswa kweWazuh

Ukusebenza kukaWazuh kuyayivumela ukuba iphunyezwe kwiintlobo ngeentlobo zeemeko zehlabathi lokwenyani ngaphakathi kweenkampani.

• Ukhuseleko lwendawo yokugqibela: Ikuvumela ukuba ubeke iliso, uhlalutye, kwaye uphendule kwizisongelo zokhuseleko kwiikhompyuter kunye neeseva, zombini zasekhaya kunye ne-cloud-based.
• Uphicotho lokuthobela: Iququzelela ukuveliswa kweengxelo ezizenzekelayo ukubonisa ukuthotyelwa kwemigangatho kunye nemimiselo.
• Ukufunyanwa kohlaselo olukwinqanaba eliphezulu: Ngokunxibelelanisa iziganeko kunye nokusebenzisa ubukrelekrele bezoyikiso, unokuchonga iinzame zokungena ezintsonkothileyo okanye intshukumo esecaleni.
• Ukhuseleko kwindawo yelifu nakwisikhongozeli: Ibonelela ngokubonakala kwindlela yokuziphatha yemikhosi kunye nezikhongozeli (i-Docker, i-Kubernetes), ukufumanisa ubuthathaka kunye ne-anomalies kwezi ndawo.
• Ulawulo lwesivuseleli esisembindini: Imanyanisa ulwazi lokhuseleko oluvela kwiindawo ezahlukeneyo ukuya kwideshibhodi enye, iququzelela uphando lweziganeko kunye nokubekwa phambili.

I-SIEM kunye ne-XDR: Ukutsiba kukaWazuh kukhuseleko olupheleleyo

Enye yezinto ezintle zikaWazuh zilele ekudityanisweni kweteknoloji ye-SIEM kunye ne-XDR. Kodwa kuthetha ukuthini kanye oku?

I-SIEM (IiNkcukacha zoKhuseleko kunye noLawulo loMsitho): Ijolise ekuqokeleleni nasekuhlalutyeni ulwazi lokhuseleko oluvela kwimithombo emininzi (iinkqubo zokungena, usetyenziso, uthungelwano, izixhobo, njl.njl.), ukulungelelanisa le datha ukuchonga iipatheni ezinobungozi kunye nokuvelisa izilumkiso ezizenzekelayo.

XDR (UFundo olwandisiweyo kunye neMpendulo): Ihamba inyathelo eliya phambili ngokwandisa umda wokubeka iliso kunye nokudibanisa kwiindawo zokuphela, iiseva, uthungelwano, amafu, kunye nezicelo, ukulungelelanisa iimpendulo ezizenzekelayo kunye nophando olulula kuhlaselo olunzima.

I-Wazuh idibanisa zombini itekhnoloji, ivumela amaqela okhuseleko ukuba asebenze ngokubonakalayo. Ngokubonakala okupheleleyo kubonelela kunye nokuzenzekelayo kweempendulo, amaxesha okuphendula ayancipha kwaye ukukwazi ukuqulatha ngokukhawuleza nayiphi na isiganeko kuphuculwe.

Ukufakela kunye nokusebenza yonke imihla

Ukufakela kunye nokugunyazisa i-Wazuh ilula ngokumangalisayo xa kuthelekiswa nezinye izisombululo ezifanayo. Ngombulelo kumthombo wayo ovulelekileyo, amaxwebhu asesidlangalaleni kwaye maninzi, kwaye kukho uluntu olusebenzayo olunika inkxaso kunye neengcebiso.

Ukusasazwa kunokulungelelaniswa kwindawo nganye: ukusuka kufakelo oluncinci kumncedisi omnye womzimba okanye wenyani ukuya kumaqela antsonkothileyo alawula amawaka eendawo zokuphela, ezidityaniswe namaqonga elifu, okanye kunye nezixhobo ngaphandle kokukwazi ukufaka iiarhente.

Ukugcinwa kwemihla ngemihla yenye yezinto ezixatyiswa kakhulu ngabasebenzisi. Ulawulo oluphakathi ukusuka kwideshibhodi kunye nokuzenzekelayo kwemisebenzi emininzi yesiqhelo (uhlaziyo, izaziso, ukulungelelaniswa kwesiganeko) ukunciphisa umzamo ofunwa liqela lokhuseleko xa kuthelekiswa nezinye iindlela.

Ngaphezu koko, uhlaziyo oluqhelekileyo kunye nokongezwa rhoqo kwezinto ezintsha kusivumela ukuba sigcine ukhuseleko luphambili, ngaphandle kokuxhomekeka kwimijikelezo emide yophuhliso lwezorhwebo.

Iingenelo eziphambili kunye neenzuzo zeWazuh

Ukukhetha i-Wazuh njengesisombululo se-cybersecurity ibonelela ngeenzuzo ezininzi kwiimveliso zobunini.

• Ugcino lweendleko ezibalulekileyo: Ukuba ngumthombo ovulekileyo, isisombululo sikhululekile ngokupheleleyo kwaye asifuni iilayisensi zokuthenga, okwenza kube nomtsalane ngakumbi kwimibutho enezixhobo ezilinganiselweyo.
• Ukubhetyebhetye ngokupheleleyo: Ikhowudi ingenziwa ngokwezifiso okanye ilungiswe ukuze ihambelane neemfuno ezithile zendawo nganye.
• Uhlaziyo kunye nenkxaso yoluntu: Uluntu lwamazwe ngamazwe olusebenzayo lugcina uphuhliso luphila kwaye lunikezela ngoncedo lokusombulula iingxaki kunye nemibuzo.
• Amandla okudibanisa: Iyahambelana nezixhobo zeqela lesithathu kunye nelifu elikhulu kunye nababoneleli bezakhiwo, okwenza kube lula ukudibanisa ukhuseleko kwiindawo ezinzima.
• Ukubonakala kokhuseleko lwehlabathi: Ikuvumela ukuba ubeke iliso kuwo onke amanqaku abalulekileyo kwisiseko sakho ngexesha lokwenyani kunye nakwideshibhodi enye ebonakalayo, uququzelela umngcipheko ongcono kunye nolawulo lwezoyikiso.

Ukufunda ngakumbi malunga nendlela yokukhusela iinkqubo zakho ngezisombululo ezivulekileyo, unokufunda malunga nokhuseleko lwamafu.

Inqaku elidibeneyo:

I-TSforge Activation: Isixhobo esicela umngeni kuKhuseleko lweMicrosoft