diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index d5c847fc..6c1a043b 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -3,7 +3,7 @@ FROM waystonesystems/baseimage-centos:0.2.0 # Arguments ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_VERSION=4.3.10-0.debug +ARG WAZUH_VERSION=4.4.3-0.debug # Environment variables ENV API_USER="foo" \ @@ -16,7 +16,10 @@ ENV FILEBEAT_DESTINATION="elasticsearch" RUN set -x && \ groupadd -g 1000 wazuh && \ useradd -u 1000 -g 1000 -d /var/ossec wazuh && \ - curl -o /tmp/wazuh-manager-$WAZUH_VERSION.x86_64.rpm https://packages.wazuh.com/cloud/4.3.x/rpm/wazuh-manager-$WAZUH_VERSION.x86_64.rpm && \ + # Retrieve DEV package + #curl -o /tmp/wazuh-manager-$WAZUH_VERSION.x86_64.rpm https://packages-dev.wazuh.com/pre-release/yum/wazuh-manager-$WAZUH_VERSION.x86_64.rpm && \ + # Retrieve PROD package + curl -o /tmp/wazuh-manager-$WAZUH_VERSION.x86_64.rpm https://packages.wazuh.com/cloud/4.4.x/rpm/wazuh-manager-$WAZUH_VERSION.x86_64.rpm && \ yum update -y && \ yum upgrade -y &&\ yum install -y openssl vim expect python-boto python-pip python-cryptography postfix bsd-mailx mailx ca-certificates && \ @@ -101,11 +104,11 @@ RUN chmod 755 /entrypoint.sh && \ chmod 755 /entrypoint-scripts/85-save_wazuh_version.sh # Load wazuh alerts template. -ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat -RUN chmod go-w /etc/filebeat/wazuh-template.json +#ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat +#RUN chmod go-w /etc/filebeat/wazuh-template.json # Expose ports EXPOSE 55000/tcp 1514/udp 1515/tcp 514/udp 1516/tcp # Run all services -ENTRYPOINT ["/entrypoint.sh"] \ No newline at end of file +ENTRYPOINT ["/entrypoint.sh"] diff --git a/wazuh/config/permanent_data.env b/wazuh/config/permanent_data.env index d5e2dc3e..e7c923e5 100644 --- a/wazuh/config/permanent_data.env +++ b/wazuh/config/permanent_data.env @@ -22,6 +22,8 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" @@ -53,6 +55,7 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/orm.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud" @@ -62,6 +65,7 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/cpe_helper.json" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/var/db/mitre.db" @@ -76,4 +80,4 @@ PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/agents/*" PERMANENT_DATA_DEL[((i++))]="/var/ossec/wodles/cve.db" PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/vulnerabilities/cve.db" PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/fim/db/fim.db" -export PERMANENT_DATA_DEL +export PERMANENT_DATA_DEL \ No newline at end of file