Zammad Instalation & Configuration - RTvsBT/RTvsBT GitHub Wiki

Installation

Installation video

Ansible

Instalation

Zammad is installed via an Ansible script. This script is located at this repo. The ansible script will install all the packages and repo's that are needed to set up the Zammad server.

Problems

The Ansible script could potentially show errors. Try running it for a second time and see if the error persists. If it does try to figure it out via googling.

Configure Zammad

First, you need to add a host entry to your hosts file.

Windows: Go to C:\Windows\System32\drivers\etc\hosts and edit it in an editor that has administrator privileges.
Linux: Go to \etc\hosts and edit it in an editor that has superuser/root privileges.

If you have opened the hosts file on your system add the following: [IP_OF_ZAMMAD] zammad.cs-workshop.lab

After you have successfully done that you can go to zammad.cs-workshop.lab and configure the system.

Initial setup

At first, you get a setup screen.

Setup screen

Click on the blue button and go through the setup by first creating an administrator account. This account will be used for the configuration of Zammad. After that set, the company name to Blue Team and set the system URL to zammad.cs-workshop.lab Next settings we can skip by leaving it on default and where necessary skipping it entirely. The next option will be about an email account. You can skip this for now as it is easier to configure by using the Zammad configuration GUI.

Users

Now everything is set up and you are on the dashboard. Go to the settings located at the bottom left of the screen. Go towards the Users option under the manage section.

From there delete the default user called Nicole Braun. To do this click on the user and scroll down where it says active. Turn this to inactive to deactivate the account. Then click on the three dots on the left side of the user and click on remove. Follow the instructions and submit your data deletion request. This user will be deleted in about 10 minutes. After this, you can add all the necessary users to your group.

To create a user, follow these steps. Click on the New User button and fill out the information. Every user can use their email address for their account. There are three different Users.

Administrator

These users will need administrator permissions for Zammad to further configure and look at Zammad in detail. Add them to the following permission roles:

Admin
Agent
Customer

SOC employee (Trainees)

These users are going to create tickets for Security Incidents. They need to be able to create and view ongoing tickets. Furthermore, they also need to assign tickets to the appropriate people. These are the permissions they need:

Agent
Customer

VERIS

VERIS is a guideline for documenting incidents. Its main purpose is to analyze the incidents in a clearer and faster way. It does this by adding extra metta data like confidence rating, Alert ID, and a summary.

Metadata

To add these metadata items we need to add them to the ticket object. Go to Settings>System>Objects>Ticket. Here you find the GUI for configuring the data entries that are stored in the database. We need to add several attributes. To add an attribute click on the New Attribute button. Use the following data to add all the different attributes. If parameters are missing leave them as default.

Attribute #1

Name: alert
Display: Alert ID
Format: Text
Type: Text
MaxLength: 120
Permissions:
- ticket.customer.create_middle = false, false
- ticket.customer.edit = false, false
- ticket.agent.create_middle = true, false
- ticket.agent.edit = true, false

Attribute #2

Name: confidence
Display: Confidence Rating
Format: Select
- Key: low | Display: Low
- Key: medium | Display: Medium
- Key: high | Display: High
Permissions:
- ticket.customer.create_middle = false, false
- ticket.customer.edit = false, false
- ticket.agent.create_middle = true, false
- ticket.agent.edit = true, false

Attribute #3

Name: confirmed_incident
Display: Is incident
Format: Boolean
- Key: true | Display: Yes
- Key: false | Display: No
Permissions:
- ticket.customer.create_middle = false, false
- ticket.customer.edit = false, false
- ticket.agent.create_middle = true, false
- ticket.agent.edit = true, false

Attribute #4

Name: source
Display: Source
Format: Select
- Key: Suricata | Display: Suricata
- Key: Wazuh | Display: Wazuh
Permissions:
- ticket.customer.create_middle = false, false
- ticket.customer.edit = false, false
- ticket.agent.create_middle = true, false
- ticket.agent.edit = true, false

Attribute #5

Name: source_ip
Display: Source IP
Format: Text
Type: Text
MaxLength: 120
Permissions:
- ticket.customer.create_middle = false, false
- ticket.customer.edit = false, false
- ticket.agent.create_middle = true, false
- ticket.agent.edit = true, false

Attribute #6

Name: target_ip
Display: Target IP
Format: Text
Type: Text
MaxLength: 120
Permissions:
- ticket.customer.create_middle = false, false
- ticket.customer.edit = false, false
- ticket.agent.create_middle = true, false
- ticket.agent.edit = true, false

Macro's

Macros are very useful tools to speed up the ticketing process. It does this by automatically assigning values and change attributes to tickets. For instance, if we have detected that a ticket is a false-positive. We normally have to add the false-positive tag, assign ourselves as ticket owners, set the value of is incident to false, and close the ticket. Zammad luckily offers a feature where we can do this all automatically. Add two macro’s and modify the existing “Close & Tag as Spam” macro. You can use the following screenshot as a guide.

False positive macro Spam macro