Skip to content

Fix Synology NAS ruleset field names and dead storage-fault rule #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leonfullxr merged 1 commit into from
Jul 28, 2026
Merged

Fix Synology NAS ruleset field names and dead storage-fault rule #90

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion integrations/synology_nas/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ cp integrations/synology_nas/decoders/nas_synology_decoders.xml /var/ossec/etc/d

#### Copy the Custom Rules

The custom rules map the decoded fields to specific alerts, such as alerting on 2FA failures, SSH blocks, or degraded volumes. Copy the rules file to the Wazuh Manager:
The custom rules map the decoded fields to specific alerts, such as alerting on login failures, automated IP blocks, or degraded volumes. Copy the rules file to the Wazuh Manager:

```bash
cp integrations/synology_nas/rules/nas_synology_rules.xml /var/ossec/etc/rules/
Expand Down
19 changes: 13 additions & 6 deletions integrations/synology_nas/rules/nas_synology_rules.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,28 +8,28 @@
<rule id="100401" level="5">
<if_sid>100400</if_sid>
<match>failed to log in</match>
<description>Synology NAS: Login FAILURE for user '$(synology_user)' from $(srcip) via $(synology_app).</description>
<description>Synology NAS: Login FAILURE for user '$(user)' from $(srcip) via $(synology_app).</description>
<group>authentication_failed,</group>
</rule>
Comment thread
Copilot marked this conversation as resolved.

<rule id="100402" level="3">
<if_sid>100400</if_sid>
<match>successfully passed the first authentication of 2FA</match>
<description>Synology NAS: User '$(synology_user)' passed first 2FA step from $(srcip).</description>
<description>Synology NAS: User '$(user)' passed first 2FA step from $(srcip).</description>
<group>authentication_success,</group>
</rule>
Comment thread
Copilot marked this conversation as resolved.

<rule id="100403" level="3">
<if_sid>100400</if_sid>
<match>signed in to</match>
<description>Synology NAS: User '$(synology_user)' successfully logged into $(synology_app) from $(srcip).</description>
<description>Synology NAS: User '$(user)' successfully logged into $(synology_app) from $(srcip).</description>
<group>authentication_success,</group>
</rule>
Comment thread
Copilot marked this conversation as resolved.

<rule id="100404" level="2">
<if_sid>100400</if_sid>
<match>logged out</match>
<description>Synology NAS: User '$(synology_user)' logged out from $(synology_app).</description>
<description>Synology NAS: User '$(user)' logged out from $(synology_app).</description>
</rule>
Comment thread
Copilot marked this conversation as resolved.

<rule id="100405" level="7">
Expand Down Expand Up @@ -63,8 +63,15 @@

<rule id="100409" level="10">
<if_sid>100400</if_sid>
<match>was removed|was degraded</match>
<description>Synology NAS: CRITICAL STORAGE FAULT - Drive $(synology_drive) removed or Volume $(synology_volume) degraded.</description>
<match>was removed</match>
<description>Synology NAS: CRITICAL STORAGE FAULT - Drive $(synology_drive) was removed.</description>
<group>hardware_fault,data_loss_risk,</group>
</rule>

<rule id="100410" level="10">
<if_sid>100400</if_sid>
<match>was degraded</match>
<description>Synology NAS: CRITICAL STORAGE FAULT - Volume $(synology_volume) is degraded ($(synology_status)).</description>
<group>hardware_fault,data_loss_risk,</group>
</rule>

Expand Down